Privacy Policy

Last updated: 3 June 2026

LulusAI ("we", "us", "our") operates the lulusai.my platform and related mobile applications (the "Service"). This Privacy Policy explains how we collect, use, share, and protect personal information when you use the Service. We comply with the Personal Data Protection Act 2010 of Malaysia ("PDPA") and its 2024 amendments.

1. Who this policy applies to

This policy applies to students, parents, teachers, school administrators and visitors who use the Service. The Service is designed for secondary-school learners (typically aged 13–19) preparing for Malaysian SPM and equivalent examinations.

2. Information we collect

Account information — name, email address, phone number, role (student / parent / teacher / school admin), school name, form level, and chosen subjects.
Authentication data — hashed passwords, login timestamps, IP address, and device/browser information used for security and rate-limiting.
Learning data — diagnostic and practice attempts, scores, time spent, streak and mastery progress, AI tutor conversations, written submissions (essays, summaries, prompt-engineering practice), uploaded photos for AI marking ("Snap & Check"), and flashcard progress.
Parental / school linkage — when a parent links a student account, or a school admin enrols students, the linkage and basic identifiers are stored.
Payment data — handled by our payment processor (Billplz). We store only the transaction reference, plan, status and last payment date. We do not store full card or bank account details on our servers.
Communication data — contact-form messages, support requests, and (if opted in) WhatsApp / email reminder delivery logs.
Cookies and analytics — session cookies for login, and minimal usage analytics to improve the Service.

3. How we use your information

To provide and personalise the Service — including AI tutoring, learning paths, diagnostic feedback, writing-marker grading, library and flashcard recommendations.
To allow parents and teachers to monitor a linked student's progress.
To process payments, free trials, refunds and subscription renewals.
To send reminders, weekly AI progress reports and important account or security notifications.
To protect the Service from abuse, fraud, and security incidents.
To comply with legal obligations and respond to lawful requests by authorities.
To improve our Service through aggregate, de-identified analytics.

4. AI processing & third-party providers

The Service uses large language model providers (currently Anthropic and OpenAI) to power AI tutoring, writing marking, and the AI Sandbox. When you submit a question, an essay, a photo of handwritten work, or a prompt for comparison, the relevant content is sent to the provider's API for processing. We require these providers to handle the content according to their published privacy and data-use policies and we do not authorise them to train their models on student submissions.

We also use the following categories of third-party processors:

Hosting — Hostinger (servers and database).
Payments — Billplz (and, in future, Stripe).
Messaging — Meta WhatsApp Cloud API (for opt-in reminders) and SMTP email delivery.

5. Children and parental consent

The Service is intended for learners aged 13 and above. If you are under 18, you should obtain consent from a parent or legal guardian before creating an account and using paid features. Parents may at any time review, correct, or request deletion of their child's data by contacting us at hello@lulusai.my.

6. Sharing and disclosure

We share personal information only in the following situations:

With your consent — for example, when you choose to link a parent or teacher account.
With your school — if your account is provisioned by a school, your registered teachers and school administrators may view your learning data within that school.
With service providers listed above, under contractual data-protection obligations.
Legal compliance — to comply with a court order, regulatory request or applicable law.
Corporate transactions — in the event of a merger, acquisition or asset sale, subject to continued protection of your data.

We do not sell personal information to advertisers or data brokers.

7. Data retention

We retain account and learning data while your account is active and for a reasonable period afterwards to support audit, dispute resolution, and reactivation. You may request deletion of your account and associated data at any time. Aggregate, de-identified data may be retained indefinitely for analytics.

8. Security

We use industry-standard safeguards including HTTPS encryption in transit, hashed passwords, CSRF protections, prepared SQL statements, role-based access controls, and rate limits. No system is perfectly secure; if you suspect a security issue, please notify us immediately.

9. Your rights under the PDPA

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Withdraw consent for processing (which may affect your ability to use the Service).
Request deletion of your account and associated personal data.
Lodge a complaint with the Personal Data Protection Department, Malaysia.

To exercise these rights, email hello@lulusai.my. We will respond within 21 days of receiving a valid request.

10. International data transfers

Some processors (AI providers, payment gateways, messaging providers) operate outside Malaysia. By using the Service you consent to your personal data being transferred to those jurisdictions, subject to safeguards equivalent to those required by Malaysian law.

11. Cookies

We use session cookies to keep you logged in and CSRF tokens to protect your session. We do not use advertising cookies. You can disable cookies in your browser, but parts of the Service may stop working as a result.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or by a prominent notice on the Service. Continued use of the Service after an update constitutes acceptance of the revised policy.

13. Contact us

Questions about this policy, or to exercise your data-protection rights, contact:
LulusAI · hello@lulusai.my

This page describes our standard practices. For school-provisioned accounts, your school's data processing agreement with us governs any conflict with this policy.