Privacy Policy

Last updated: 9 September 2026

WebX builds and hosts websites for Malaysian businesses. To do that, we handle some of your personal data. This policy explains what we collect, why, how long we keep it, and what your rights are under Malaysia's Personal Data Protection Act 2010 (PDPA).

We have tried to write this in plain language. If anything is unclear, email us at michael@webx.my.

1. Who we are

WebX is operated by Pixl Digital (002880290-P), a business registered in Malaysia. For anything in this policy, contact:

Email: michael@webx.my

Pixl Digital is the data user (the party responsible for your personal data) under the PDPA.

2. What this policy covers

The WebX website (webx.my) and its pages.
The WebX customer app, where you sign in, fill in your website details, and request changes.
Websites we build and host for customers, but only the parts we run: hosting. The content on a customer's website belongs to that customer (see section 10).

3. What we collect, and when

When you buy. Your name and email address, from the checkout. You sign in with a one-time email link; we never store passwords, because there are none.

When you fill in your website details. Information about your business: what it does, your contact details, opening hours, the pages you want, and any text you write. Also the files you upload: logo, photos, and similar.

When you pay. A new order can be paid by bank transfer to our account (you transfer, we confirm) or, once available, by card through Stripe. Card details go to Stripe, not to us. We never see or store card numbers. We keep the order records: what you bought, when, for how much, and the payment status.

When you contact us or request changes. The messages and change requests you send us, so we can act on them and keep a history for your site.

Visitors to customer websites. The websites we host set no cookies and run no analytics scripts at present. If we add visitor statistics later, they will be cookieless and aggregate only, and this policy will say so.

Visitors to webx.my and the customer app. Our own website uses no analytics and sets no cookies. The customer app sets a session cookie when you sign in and a cart cookie during checkout. That is all they do.

4. What we use your data for

Building your website. Your business details, text, and photos are what the site is made from.
Hosting and maintaining your website, and carrying out the changes you request.
Composing your website. Your Site is built by our own software from your details and photos. We may use Anthropic's Claude to improve the text of your website; when we do, your business details and website text are processed by Anthropic for that purpose only.
Billing: charging for your subscription and add-ons, sending receipts, and reminding you before renewal.
Service emails: sign-in links, "your site is live" notices, change confirmations, renewal and expiry notices.
Marketing emails, only if you agreed (see section 5).
Keeping the service safe: preventing abuse, checking uploads, and keeping records where the law requires.

We do not sell your personal data. We do not share it with anyone except the service providers in section 7, and only so they can do their jobs for us.

5. Consent and marketing

Most of the processing above is needed to deliver what you bought. We cannot build and host your website without your business details.

We do not send marketing email at present. If we start, we will ask for your consent first, every such email will carry an unsubscribe link, and opting out will never affect your service or the emails needed to run it (receipts, renewal notices, and the like).

6. How long we keep your data

We keep uploaded files only as long as we need them to do the work. You can ask us by email to delete any file we hold.

Data	How long we keep it
Uploaded files (logo, photos)	Deleted from our upload area within 37 days of upload.
Your answers and files, if you pay but do not finish	Your answers are kept so you can come back and finish; uploaded files follow the 37-day rule above.
Your account and the text of your website details	Kept while your account exists, so you can pick up where you left off at any time.
Your website's data (content, design record, processed images)	Kept while you are subscribed. After your subscription ends, your site goes into cold storage for 12 months from expiry, so you can reactivate it. After that, we send a final warning email and then permanently delete it.
Order and billing records	Kept as long as Malaysian law and payment-dispute rules require.

Note the distinction: your original uploads are deleted within 37 days, but the processed images used on your live site are part of your website's data and stay for as long as your site does.

7. Where your data goes

We use a small number of service providers. Some of them process data outside Malaysia:

Cloudflare, DNS, content delivery and security for our sites (data may pass through servers outside Malaysia).
Vultr (server hosting) and RunCloud (server management), where our app and the websites we host run.
SendGrid, which delivers our emails (sign-in links, receipts, notices).
Stripe, card payments, once available. Stripe holds your card details; we never do.
Anthropic, only when we use Claude to improve your website text.
A freelance specialist we engage, only if you buy the Google Analytics setup or Google Search Console setup add-on. They do that setup inside your own Google account, using access you grant, and you can remove that access yourself at any time. They receive your business name, your website address, and the contact details needed to complete the setup.

Each provider only receives what it needs for its role, under its own security and privacy commitments. By using WebX, you consent to this transfer and processing outside Malaysia where it is needed to deliver the service.

8. Your rights under the PDPA

You have the right to:

Access the personal data we hold about you.
Correct data that is wrong or out of date.
Withdraw consent to processing, including marketing consent, at any time.
Limit processing of your data as the PDPA provides.

To exercise any of these, email michael@webx.my from the email address on your account, and tell us what you want done. We will respond within the timeframes the PDPA sets. If you withdraw consent for data we need to run your website, we may not be able to keep providing the service. We will tell you before anything is affected.

Your website details can be changed by sending us a change request from your account, and any uploaded file is deleted on request by email.

9. Security

No passwords exist on WebX. Sign-in is by a one-time email link, so there is no password to steal.
Connections to our sites and app are encrypted (HTTPS).
Uploaded files are checked and re-encoded before use, and identifying metadata (such as photo EXIF data) is stripped.
Access to customer data is restricted, and the systems that hold it are hardened and backed up.
We keep files only as long as needed. The shortest retention is the best protection.

No system is perfectly secure, but we keep the amount of data we hold small and its lifespan short.

10. Data on customer websites

Customer websites display information the customer chose to publish: their business name, phone number, address, and similar. The customer is responsible for what they publish. WebX's role is hosting it. Customer sites carry no forms, so they collect no visitor data themselves.

11. Changes to this policy

If we change this policy, the new version appears on this page with a new "last updated" date. If a change meaningfully affects how we handle your data, we will tell you by email first.

12. Contact

Questions, requests, or complaints about your personal data:

Pixl Digital (002880290-P) Email: michael@webx.my Email us

For formal PDPA requests (access, correction, withdrawal), please use email from the address on your account, so we can verify it is really you.

If you are not satisfied with our response, you may complain to the Personal Data Protection Department (JPDP) of Malaysia.