Privacy Notice

1. Personal data we collect

We collect personal data directly from you, from your use of MotoAI, from dealers or service partners involved in a request, and from permitted technical or public sources.

• Identity, account, and contact details, including name, Malaysian mobile number, verification records, role, and account preferences.
• Marketplace and transaction details, including saved cars, searches, enquiries, viewing or finance interests, dealer inventory, leads, campaigns, Agent requests, quotes, appointments, and status updates.
• Content you provide, including messages, forms, listing information, vehicle or product photos, documents, feedback, and support correspondence.
• Technical and usage data, including IP address, device and browser information, session events, referral or campaign attribution, cookies or similar storage, and security logs.
• Notification data, including Web Push subscription endpoints, device keys, delivery status, and notification preferences.
• Payment and commercial records, including package, invoice, payment status, provider reference, and billing details. Payment providers may collect card or bank details directly; MotoAI should not store full card credentials.
• Location or service-area information you choose to provide, such as state, city, postcode, dealer location, or preferred service area.

2. Why we use personal data

We process personal data only for identified and reasonably related purposes.

• Provide, personalise, secure, and improve car discovery, shortlists, dealer tools, Agent workflows, support, and notifications.
• Verify accounts, prevent fraud or abuse, investigate incidents, maintain audit records, and protect users and the platform.
• Connect buyers, dealers, service providers, payment providers, and operational teams when requested or needed to deliver a service.
• Process enquiries, appointments, quotes, payments, referrals, campaigns, and partner fulfilment.
• Measure product performance and attribution, understand demand, maintain search visibility, and develop aggregated or de-identified insights.
• Send service messages and, where permitted, marketing communications; meet legal, regulatory, tax, accounting, and dispute obligations.

3. Consent and choices

Where consent is required, we ask for it in a form appropriate to the processing. Some data is necessary to create an account, respond to a request, keep the service secure, or complete a transaction; declining it may limit the relevant feature.

You may withdraw consent for optional processing and direct marketing, turn off browser notifications, or change communication preferences. Withdrawal does not affect processing already carried out and may be subject to legal or contractual requirements.

4. Processors, partners, and disclosures

We may disclose only the data reasonably needed to hosting, cloud database and storage, authentication and messaging, Web Push, analytics, security, support, payment, search-distribution, dealer, workshop, inspection, logistics, finance or insurance referral, and professional-adviser providers. Dealers and partners may act as separate data controllers for their own dealings with you.

We may also disclose data where required by law, to protect rights or safety, during a corporate transaction, or with your instruction or consent. Where data is processed outside Malaysia, the operator should use appropriate contractual, security, consent, and legal transfer safeguards.

5. Retention

We retain personal data only as long as reasonably needed for the stated purpose, security, disputes, and legal or accounting obligations. The owner must approve the final retention schedule before launch.

Operationally, account and marketplace records may be kept while an account or request is active; enquiries and support records may generally be kept for up to 24 months after closure; security logs may generally be kept for up to 12 months; and transaction, invoice, consent, or compliance records may be kept for up to seven years where required. Push subscription data is removed or disabled when unsubscribed, invalid, or no longer needed. Data is then deleted, anonymised, or securely isolated.

6. Security and data incidents

We use proportionate administrative, technical, and physical safeguards such as access controls, authentication, encryption in transit, environment separation, logging, provider review, backups, and deletion controls. No system is completely secure.

Suspected personal data breaches are assessed and contained. Where applicable, the operator will notify the Personal Data Protection Commissioner as soon as practicable and notify affected people without unnecessary delay when significant harm is caused or likely.

7. Access, correction, deletion, and other requests

Subject to Act 709 and permitted exceptions, you may ask whether we process your personal data, request access to it, correct inaccurate or outdated data, withdraw consent, object to direct marketing, or ask us to prevent processing likely to cause damage or distress. You may also request portability where applicable and ask us to delete or anonymise data that is no longer needed.

Deletion is not absolute: we may retain data needed for security, transactions, disputes, legal duties, or another lawful purpose. Send a request to the placeholder email in section 10 with your name, mobile number, request type, and enough detail to locate the data. We may verify identity before responding. You may also contact Malaysia's Personal Data Protection Commissioner.

8. Children

MotoAI is not designed for children under 18 to create accounts or transact independently. A parent or legal guardian should contact us if a child has provided personal data without appropriate involvement so we can assess and remove it where required.

9. Changes to this notice

We may update this notice when the service, providers, or law changes. We will post the revised date and give additional notice where a material change requires it. The version in effect when data is processed will apply, subject to applicable law.

10. Contact and requests

Email the address below for access, correction, consent withdrawal, direct-marketing objection, portability, deletion, security, or privacy questions.

OWNER REVIEW REQUIRED: privacy@motoai.my is a launch placeholder. Confirm the monitored inbox, registered operator name, company number, Malaysian postal address, and DPO contact (if applicable) before publication.