Privacy notice
Updated:
What is collected
Only what you send through the contact form: name, business name, industry, budget, timeline, email, phone number if you give one, your message, the pricing choices you made if you arrived from the pricing page, and the language of the page you used. If you become a client, two more things are stored when you accept a quotation through the portal: the name you type to confirm, and the moment you press the button. The portal also records when your link was last opened and how many times, so we know whether it reached you. Your IP address is not stored for either, and that is a choice rather than an oversight. Nothing else. No tracking cookies, no advertising pixels, no data shared with third parties for marketing. The client portal sets one cookie and only one: it holds your access link so you do not have to open it again every time, and it does not follow you to other sites. If you upload a file through the portal, its original filename, size, type and the time it arrived are stored too. The type is verified from the file's own contents rather than from its name. If you fill in the content form in the portal, your answers are stored too: premises address, phone number, opening hours, social media links and whatever else you type there. Much of it is asked for precisely so it can be published on your own website — the form says so at the point where you answer, and you can leave any of it blank. The question you were asked is stored alongside your answer, so the record keeps showing what you were actually asked even if the question is reworded later.
Why it is collected
To answer your enquiry and quote for the work. If you tick the marketing consent box, also to send occasional updates. That consent is separate from the enquiry and is never pre-ticked. Content form answers are used to build your website, and the date you submit them is used to work out the delivery estimate set out in your quotation terms.
Where it goes
The contact form sends an email through Resend, an email delivery service, so what you type arrives in an inbox. If you go on to become a client, a separate record is created: your name, business name, contact details, and any quotation issued to you. Those records sit in a Postgres database hosted by Neon, in Singapore, which is outside Malaysia. That is stated plainly because you are entitled to know where your data lives, not because it is buried. Your portal link is sent through Resend as well, or Amin sends it himself over WhatsApp when that is easier for you — in which case the link is as private as that chat, and you can ask for it to be revoked at any time. Nothing from any of this is shared with anyone for marketing. Files you upload through the portal — logos, photos, PDFs — are stored in Cloudflare R2, separately from the database. They are never reachable at a public web address: the only ways out are your own portal and Amin's internal panel, and both hand the file over as a download rather than as a page to be displayed. Your content form answers are stored in the same Neon database, not in a separate service, and are not sent by email.
Who can see it
Amin Solahuddin, and you. The internal dashboard holding every client record sits behind a login enforced before a request reaches the site at all, and exactly one account is permitted. If you are a client, you can also see your own records through the private link given to you: quotations, invoices and renewal dates. That link shows your records and only yours — it cannot show another client's, and internal notes are never rendered there. Anyone holding the link can see what it shows, so treat it like a password; it can be revoked immediately at your request, and revoking it signs out any device that already used it. If access is ever granted to a third person, this notice is updated first rather than afterwards.
How long it is kept
Two different periods, for two different reasons. Enquiry emails are kept while the conversation is still relevant and deleted when it is not; you can ask for one to be deleted sooner at any time. Client records, quotations and invoices are kept for seven years. That is not a choice: Malaysian tax law requires business records to be kept for that long. The name you type when accepting a quotation is part of that quotation, so it follows the same period. A portal link and the record of its use are not financial records, so the seven years do not apply to them: they are kept while you are a client and can be deleted at your request. Revoking a link stops access immediately; deleting its record is a separate request. Files you upload are kept while you are a client, and you can remove them yourself at any time through the portal. Removing one deletes the file for real; the record that it was sent, and when it was withdrawn, remains — the date content arrived is part of the project schedule. Content form answers are kept with your client record while you are a client, and can be deleted at your request afterwards.
Your rights
Under the Personal Data Protection Act 2010 you can request a copy of the information held about you, ask for it to be corrected, or ask for it to be deleted. Send the request to the address below and it will be handled. One limit is stated here rather than discovered later: financial records that tax law requires to be retained cannot be deleted before seven years have passed. Everything else can.
Privacy contact
For anything about this notice, contact SOLAHX using the details on the contact page.