Last updated: 5 October 2026
WebX builds and hosts websites for Malaysian businesses. To do that, we handle some of your personal data. This policy explains what we collect, why, how long we keep it, and what your rights are under Malaysia's Personal Data Protection Act 2010 (PDPA).
We have tried to write this in plain language. If anything is unclear, email us at [email protected].
1. Who we are
WebX is operated by Pixl Digital (002880290-P), a business registered in Malaysia. For anything in this policy, contact:
- Email: [email protected]
Pixl Digital is the data controller (the party responsible for your personal data) under the PDPA.
2. What this policy covers
- The WebX website (webx.my) and its pages.
- The WebX customer app at app.webx.my, where you buy, sign in, fill in your website details, and request changes.
- Websites we build and host for customers, but only the parts we run: hosting. The content on a customer's website belongs to that customer (see section 10).
3. What we collect, and when
When you buy. Your name, email address and country, from the checkout. There is no separate sign-up: your WebX account is created from your order, and we email you a sign-in link once your payment is confirmed. You sign in with a one-time email link, so you never need a password.
When you pay. You pay by card through Stripe, or by bank transfer to our account (you transfer, we confirm). Card details go to Stripe, not to us. We never see or store card numbers. If you pay by bank transfer, our bank statement shows us the name and account the payment came from. We keep the order records: what you bought, when, for how much, and the payment status.
If you buy a managed domain. The owner details that domain rules require, such as your name, address, email address and phone number, so the domain can be registered in your name.
When you fill in your website details. Information about your business: what it does, your contact details, opening hours, the pages you want, and any text you write. Also the files you upload: logo, photos, and similar. If you include details about other people, such as team members' names and roles or customer testimonials, please make sure they have agreed to appear on your website. On the Custom plan we fill in these details with you, so we also note down what you tell us in that session.
When you contact us or request changes. The messages and change requests you send us from your account or by email, so we can act on them and keep a history for your site.
Visitors to customer websites. Websites we build on the Instant and Custom plans set no cookies and run no analytics scripts at present.
Visitors to webx.my and the customer app. Our own website uses no analytics and sets no cookies, and its fonts load from webx.my itself, not from an outside font provider. The software that runs its pages keeps a few technical settings and a count of pages viewed in your browser's own storage; these stay on your device and are not sent to us or anyone else. The customer app sets a session cookie when you sign in and a cart cookie during checkout. The checkout page also loads Stripe's card payment form, which sets Stripe's own cookies to help prevent fraud. We use no analytics or advertising cookies on either.
Technical logs. Like most websites, our servers and Cloudflare keep technical logs (such as IP address, browser type and pages visited) for webx.my, the customer app and the websites we host. These logs are held for a short time, to keep the service working and secure.
4. What we use your data for
- Building your website. Your business details, text, and photos are what the site is made from.
- Hosting and maintaining your website, and carrying out the changes you request.
- Composing your website. On the Instant plan, your site is built by our own software from your details and photos, and we may use Anthropic's Claude to improve the text of your website. On the Custom plan, we use Claude to design your website. When we use Claude, your business details, your website text and, on the Custom plan, the files you supply (such as your logo and photos) are processed by Anthropic for that purpose only.
- Billing: charging for your subscription, add-ons and other fees, sending receipts, and reminding you before renewal.
- Service emails: sign-in links, reminders to finish your website details, "your site is live" notices, change confirmations, renewal and expiry notices.
- Marketing emails, only if you agreed (see section 5).
- Keeping the service safe: preventing abuse, checking uploads, and keeping records where the law requires.
We do not sell your personal data. We do not share it with anyone except the service providers in section 7, and only so they can do their jobs for us. The one exception is where the law requires us to disclose it, for example a lawful request from a Malaysian authority.
5. Consent and marketing
Most of the processing above is needed to deliver what you bought. We cannot build and host your website without your business details.
We do not send marketing email at present. If we start, we will ask for your consent first, every such email will carry an unsubscribe link, and opting out will never affect your service or the emails needed to run it (receipts, renewal notices, and the like).
6. How long we keep your data
We keep uploaded files only as long as we need them to do the work. You can ask us by email to delete any file we hold.
| Data | How long we keep it |
|---|---|
| Uploaded files (logo, photos) | Deleted from our upload area within 37 days of our importing them, which we do after you submit the questionnaire. If we import a file as soon as you upload it, the 37 days start then. The copies kept before import are explained below this table. |
| Your answers and files, if you pay but do not finish | Your answers are kept so you can come back and finish; uploaded files that you have not submitted are deleted within 40 days of upload, as explained below this table. |
| Your account and the text of your website details | Kept while your account exists, so you can pick up where you left off at any time. |
| Your website's data (content, design record, processed images) | Kept while you are subscribed. After your subscription ends, your site goes into cold storage for 12 months from expiry, so you can reactivate it. After that, we send a final warning email and then permanently delete it. |
| Order and billing records | Kept as long as Malaysian law and payment-dispute rules require. |
Our questionnaire. You fill in your website details in a questionnaire on app.webx.my. It is built with Fluent Forms, a form plugin that runs on our own server, not an outside form service. When you submit, we keep your answers as a form entry, which is our record of what you typed, and copy them into the record we build your website from. If you save the questionnaire to finish later, your saved answers are also stored in Fluent Forms. The entry does not record your IP address, country, browser or operating system, and your saved answers do not keep them. Your IP address and country are not recorded at all. When you save your answers to finish later, Fluent Forms notes your browser and operating system with them, and we delete these again as part of the same save, within a fraction of a second. The entry and your saved answers are kept on the same terms as the text of your website details in the table above.
Files you upload in the questionnaire. Before a photo or logo leaves your device, your browser makes it smaller if it is very large and saves it again as a new image, which removes photo metadata such as where the photo was taken. If your browser cannot do this, or the new image would be too large to upload, the file is uploaded as it is and we remove that metadata when we import it (see section 9). On our server, we keep a copy in a private folder that cannot be reached from the web, and Fluent Forms keeps its copies at web addresses that contain a long random code. These addresses are not published and cannot be guessed, but anyone who has an exact address could open the file.
As the first step of building your website after you submit, we import your files into our upload area and delete Fluent Forms' copies and our private copy. The form entry is kept, but its links to your files no longer open. Before you submit, the copies are kept so that a questionnaire you save and come back to still shows your photos, and files that have not been submitted are deleted once they are 40 days old. If a submit is refused, for example because an answer needs correcting, or we cannot complete it on our side, any further copies Fluent Forms has made are deleted once they are 7 days old. Our clean-ups run once a day, so a file may stay up to a day longer than these periods.
Note the distinction: your original uploads are deleted within the periods above, but the processed images used on your live site are part of your website's data and stay for as long as your site does.
7. Where your data goes
We use a small number of service providers. Some of them process data outside Malaysia:
- Cloudflare, the network, content delivery and security service in front of webx.my, app.webx.my and the websites we host, and the DNS provider for webx.my (data may pass through servers outside Malaysia).
- Vultr (server hosting) and RunCloud (server management), where our app and the websites we host run.
- SendGrid, which delivers our emails (sign-in links, receipts, notices).
- Google, which hosts our email inbox (Google Workspace), including the messages you send to [email protected].
- Stripe, which processes card payments. Stripe receives your card details and the billing details needed to take the payment, and its payment form collects information from your browser to help prevent fraud. Stripe holds your card details; we never do.
- Anthropic, only when we use Claude to improve your website text or, on the Custom plan, to design your website.
- A domain registration company, only if you buy the managed domain add-on. That company, and the body that runs your domain ending (such as MYNIC for .my and .com.my), receive the owner details needed to register the domain in your name. Depending on the domain ending, some of these details may appear in public domain records.
Each provider only receives what it needs for its role, under its own security and privacy commitments. By using WebX, you consent to this transfer and processing outside Malaysia where it is needed to deliver the service.
8. Your rights under the PDPA
You have the right to:
- Access the personal data we hold about you.
- Correct data that is wrong or out of date.
- Withdraw consent to processing, including marketing consent, at any time.
- Limit processing of your data as the PDPA provides.
- Ask us to transfer your personal data to another organisation, where the PDPA provides for this and it is technically possible.
To exercise any of these, email [email protected] and tell us what you want done. If you have a WebX account, send it from the email address on your account, so we can verify it is really you. We will respond within the timeframes the PDPA sets. If you withdraw consent for data we need to run your website, we may not be able to keep providing the service. We will tell you before anything is affected.
Your website details can be changed by sending us a change request from your account, and any uploaded file is deleted on request by email.
9. Security
- You never need a password on WebX. Sign-in is by a one-time email link, so there is no password of yours to steal.
- Connections to our sites and app are encrypted (HTTPS).
- Uploaded files are checked and re-encoded before use, and identifying metadata (such as photo EXIF data) is stripped.
- Access to customer data is restricted, and the systems that hold it are hardened and backed up.
- We keep files only as long as needed. The shortest retention is the best protection.
No system is perfectly secure, but we keep the amount of data we hold small and its lifespan short.
10. Data on customer websites
Customer websites display information the customer chose to publish: their business name, phone number, address, and similar. The customer is responsible for what they publish. WebX's role is hosting it. Websites we build on the Instant and Custom plans carry no forms and run no analytics scripts, so they collect no visitor data themselves (see section 3).
11. Changes to this policy
If we change this policy, the new version appears on this page with a new "last updated" date. If a change meaningfully affects how we handle your data, we will tell you by email first.
12. Contact
Questions, requests, or complaints about your personal data:
Pixl Digital (002880290-P)
Email: [email protected]
Customers can also reach us through their account at app.webx.my.
For formal PDPA requests (access, correction, withdrawal), please use email from the address on your account if you have one, so we can verify it is really you. If you do not have an account, email us and we will tell you what we need to verify your request.
If you are not satisfied with our response, you may complain to the Personal Data Protection Department (JPDP) of Malaysia.