Privacy Policy

Effective 1 August 2026

Who we are

This policy is published by Axtraction AI Sdn Bhd (no. 202301042335), a company registered in Malaysia with its office at Level 27 Penthouse, Centrepoint North, Mid Valley City, Lingkaran Syed Putra, 59200 Kuala Lumpur. Our group also includes Axtraction AI Limited (no. 79826532), registered in Hong Kong SAR at Unit 2A, 17/F, Glenealy Tower, 1 Glenealy, Central.

Axtraction AI Sdn Bhd decides how the personal data described here is handled, except where your agreement is with Axtraction AI Limited. In that case the Hong Kong company decides, and the same standards apply.

We have appointed a data protection officer. You can reach them at privacy@axtraction.ai.

What this policy covers

This English policy is our global privacy notice. It applies wherever we do business, subject to any mandatory rights and duties under the law that applies to you. Our Bahasa Malaysia notice explains the position for Malaysia.

This policy covers personal data we control about people who visit axtraction.ai and people who contact us or work with us in a business capacity.

It also explains our role when personal data is held inside a customer's deployment. The customer controls that data; we handle it only on their instructions.

The website

axtraction.ai is a static site. It sets no cookies. It runs no analytics, no tracking pixels, and no third-party scripts. There is nothing to sign up for and no page asks you to submit anything. Even our typeface is served from our own domain, so opening a page sends no request to any domain other than ours.

The site is hosted on Google Cloud and served through its content delivery network. As with any website, the hosting provider processes standard technical request data such as your IP address, the page requested, and your browser's user agent. That is what makes it possible to deliver the page and to keep the site available and secure. We do not use it to profile you and we do not combine it with anything else.

When you email us

Email is the only contact channel on this site. If you write to us, we receive whatever you choose to send: usually your name, your email address, the organisation you work for, and the content of your message.

Providing personal data to us is voluntary, and you choose what to include. If what you provide is not enough for us to identify or answer your request, we may be unable to respond or take the step you ask for. If information is mandatory for a contract or legal requirement, we will tell you when we collect it and explain what happens if you do not provide it.

We use this information to answer you and keep a record of our dealings with you if a working relationship follows. Under Malaysian law we rely on your consent, given by choosing to write to us, and on the need to take steps at your request before entering into an agreement. Where the GDPR applies to a particular case, we rely on our legitimate interest in answering enquiries and in managing business relationships.

Sometimes your details reach us another way: you hand over a card at an event, a colleague introduces you, or a customer or partner passes on a contact. We record the same kind of business details and the source available to us in that case. We will tell you that source where the law requires it or if you ask us.

No automated system makes decisions about you based on what you send. A person reads your message.

Please do not send sensitive material by email. It is not a secure channel. Tell us what you need to share and we can arrange a safer route.

Email we send you

If you are a business contact, we may write to you about our products and what we are building. To do that we use your name, work email address, job title, the organisation you work for, and our record of earlier conversations. We write only about Axtraction AI's own products and services, never on behalf of anyone else, and we do not pass your details to another company so that it can market to you.

You can ask us to stop at any time, at no cost. Reply to any message and say so, or write to privacy@axtraction.ai. We act on your request and we do not ask you to give a reason.

Who else handles your data

We keep the number of companies that touch your data small, and each is bound by contract terms that limit what they may do with it.

• Google Cloud hosts this website and its content delivery network.
• Microsoft provides our company email, so a message you send us is stored in a Microsoft 365 mailbox.
• Our customer relationship management provider holds business contact details and a record of our correspondence, so the team can pick up a conversation without asking you to repeat yourself.

These providers run infrastructure in more than one country, so your data may be handled outside Malaysia. Each is engaged on data protection terms that require them to handle it only on our instructions and to protect it wherever it sits. Where the Malaysian PDPA applies, we make a cross-border transfer only on a basis permitted by section 129 and keep a record of the basis used. We do not sell personal data.

How long we keep it

Business contact details and correspondence stay with us while we have, or reasonably expect to have, a working relationship with you or the organisation you represent, and for up to seven years after we last hear from you. Government and enterprise relationships go quiet for long stretches and then pick up again, so a short clock would mean asking you to repeat a conversation we already had.

Seven years is not an arbitrary figure. It matches the period we are required to keep business records under Malaysian and Hong Kong tax and company law, and it outlasts the six-year window for bringing a contract claim in either place. Running contact records on the same clock gives us one retention rule to follow instead of several.

Technical request data handled by our hosting provider is short-lived, and we do not retain it for analysis. You can ask us to delete what we hold about you sooner than seven years. We will do that unless we are required to keep it, and we will say so if that is the case.

Data inside a customer deployment

When we deploy a product for a customer, that customer decides what personal data goes into the system and what it is used for. They are the data controller. We act as a data processor on their instructions, under the agreement we hold with them.

Every engagement uses a single-tenant deployment that runs where the customer chooses: in their own cloud account, on their own premises, or in an environment we host for them. We do not use one customer's data for another customer.

We also do not train AI models on it. The Data Processing Addendum makes that a standing default: no training, fine-tuning or model development on a customer's data, including on our own models, unless that customer instructs us in writing. Two narrow things sit outside it. In deployments we run, we keep security logs of events such as bulk export, so we can investigate misuse of the product. For those logs we are the controller rather than the processor, we rely on our legitimate interests, and we hold them for no more than twelve months. Separately, we use aggregated measures of how the system performs to improve it, once they have been anonymised so they identify no customer and no person.

Our products carry out automated processing, including profiling. Where that output feeds a decision about a person, the customer decides how it is used and is responsible for any impact assessment the law requires. We give them the documentation about how the system works so they can complete one.

If you believe your personal data sits inside a system we run for a customer and you want to exercise a right over it, contact that organisation. They hold the relationship with you and they decide. If you come to us instead, we pass your request to them.

Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct it where it is wrong or out of date;
• delete it, or stop using it, where the law allows;
• stop sending you anything you did not ask for.

Depending on where you are, you may also be able to ask for your data in a portable form, object to processing we base on legitimate interests, or withdraw consent you gave earlier.

Email privacy@axtraction.ai or write by post to the Data Protection Officer, Axtraction AI Sdn Bhd, Level 27 Penthouse, Centrepoint North, Mid Valley City, Lingkaran Syed Putra, 59200 Kuala Lumpur. We may need to confirm who you are before we act. Requests are answered within the period set by applicable law, and sooner where we can.

If our answer does not satisfy you, you can complain to the data protection regulator where you live or work.

How we protect your data

Axtraction AI Sdn Bhd is certified to ISO 27001:2022 for information security management. Traffic to this website is encrypted in transit. Access to our business systems is limited to the people who need it and is reviewed.

Children

Our products and this site are built for organisations, not for children. We do not knowingly collect personal data from children.

Changes to this policy

If we change this policy, the effective date at the top of this page changes with it. Where a change materially affects you, we will describe it here rather than quietly amend the text.