Privacy Policy
1 · Who we are
Key Plan Ai (“KPAi”, “we”) is a service of 666 WEBSITE SERVICES, a sole proprietorship registered in Malaysia, registration number 202503173690 (PG0573295-W). We process personal data as a data user under Malaysia’s Personal Data Protection Act 2010 (PDPA). This notice explains what we collect, why, and the choices you have. It is provided in English, 中文 and Bahasa Malaysia; if the versions differ, the English version applies.
2 · What we collect
Your account details (name, email, company, phone, language, avatar); your subscription and invoices through Stripe — we never hold card numbers; the content you add (projects, drawings, areas, progress, notes and photos — a photo may carry the date it was taken); and technical records such as sign-ins, the activity log of who changed what, and error reports.
3 · Why we use it
To run KPAi: show your projects to the people you invite, record who changed what, bill your plan, answer support email, and send the emails the service needs — verification, invitations and billing reminders, in your chosen language. We do not send marketing without asking first, and we never sell personal data.
4 · AI reading of drawings
When you upload a drawing, its image is sent to our AI provider, Anthropic, to read the title block — for extraction only. The result returns to your project; the drawing is not used to train Anthropic’s models. What the AI reads counts for nothing until a person confirms it, and you can correct it or run the read again at any time.
5 · Where your data lives
Your data is stored with Supabase (database, files and sign-in) in Singapore and served by Vercel (web app) and Railway (drawing processing), also in Singapore regions. That means data leaves Malaysia; we keep it in Singapore to stay close and with providers holding strong security certifications, as the PDPA’s transfer rules require care for.
6 · Who we share it with
Only the processors that run the service for us: Supabase (database, storage, sign-in), Vercel (hosting), Railway (drawing processing), Anthropic (AI reading of drawings), Stripe (payments), Resend (email) and Sentry (error reports). Each receives only what its job needs. We disclose personal data to authorities only where Malaysian law requires it.
7 · How long we keep it
For as long as your account is active. A deleted project can be restored for 30 days, then it is purged. Export files delete themselves after 7 days. When your account is deleted, its data leaves the live database promptly and rotates out of backups within about 30 days. Invoices are kept as long as tax law requires.
8 · Your rights under the PDPA
You may ask for a copy of your personal data, correct it (most of it directly on your Profile page), withdraw consent, or ask us to delete your account. Write to 666websitepro@gmail.com — we answer within 21 days, as the PDPA requires. You may also complain to the Personal Data Protection Commissioner (JPDP).
9 · Security
Every database table enforces row-level security, files open only through short-lived signed links, all traffic is encrypted in transit (HTTPS), and secret keys exist only on the servers. Progress changes are logged with who and when. No system is perfectly secure — if a breach ever affects you, we will tell you without undue delay.
10 · Cookies and contact
KPAi uses only the cookies needed to keep you signed in and remember your language — no advertising or tracking cookies. Questions about privacy: 666websitepro@gmail.com. If this notice changes meaningfully we email every account and update the date above.