Privacy notice

01.Who is responsible for your data

The service operator and data controller is coursebuilder. For privacy questions or requests, email [email protected].

This notice covers account holders, course authors and visitors, including people viewing published courses. We handle personal data in accordance with the obligations that apply to us under Malaysia’s Personal Data Protection Act 2010 (Act 709), as amended, and other applicable law. A course author or receiving learning platform may have separate responsibilities for personal data it collects or publishes.

02.Personal data we collect

• Account data: your name, email address, password hash, account role and account timestamps.
• Course and file data: course text, AI instructions, generated suggestions, references, media, quizzes and other material you create or upload.
• Service and security data: sign-in and administrative events, request method, route and path, response status and duration, affected record identifiers, changed field names, account role, coarse browser family and a daily rotating one-way hash derived from an IP address. We do not store submitted field values in the audit context, and our first-party analytics and security-event tables do not store raw IP addresses.
• Optional analytics: page path, route, referring host, date, account ID when signed in and a daily rotating visitor hash, collected only after you consent.
• Bot protection and infrastructure: where enabled, Cloudflare Turnstile receives device and browser signals and your IP address to check sign-in and registration attempts. Hosting, network and error-log systems may also process IP addresses and technical request data. The hashing described above applies to our first-party analytics and security-event tables, not every infrastructure or provider log.
• Communications: information you include in support messages or privacy requests.

Please do not upload personal, confidential or sensitive information that is not needed. If your course includes another person’s data or third-party material, you are responsible for having the necessary authority to use it.

03.Where data comes from and what is required

Most personal data comes directly from you. An organisation, course author or authorised administrator may also provide information about you, and technical and security records are created when you use the service. A name, email address, password and valid registration code are required to register; without the required information, we cannot provide an account. You may browse public pages without registering.

Uploading references, requesting AI generation and enabling analytics are optional. The content needed for a feature must be provided if you choose that feature. Refusing analytics does not prevent use of the core service. If necessary security verification cannot be completed, sign-in or registration may not be available.

04.How and why we use data

We use personal data to create and manage accounts; provide course authoring, AI-assisted generation, publishing and exports; save your work; authenticate users; prevent fraud and misuse; diagnose problems; maintain and improve the service; respond to requests; establish or defend legal claims; and comply with law. With your consent, we use minimised analytics to understand general product usage.

AI features create content suggestions at your request. They do not make decisions about you that produce legal or similarly significant effects. When processing relies on consent, you may withdraw that consent without affecting processing that occurred beforehand.

We rely on consent where required, or on another basis permitted by applicable law, such as providing the service you request, complying with legal duties or protecting legal rights. This notice itself is not a request for blanket consent to unrelated uses. We will provide further information and seek consent where required before a new purpose is introduced.

05.When data is shared

We may share data with service providers that help operate the service, such as hosting, database, storage, email, security, logging and AI providers; professional advisers; a successor involved in a lawful business transfer; and public authorities when disclosure is required or permitted by law. These recipients receive only the data reasonably needed for their role.

Authorised access: administrators can access accounts and courses to administer, support and secure the service. Assigned moderators can access courses available to them in the review workflow. A private course is therefore not a promise that only its author can ever access it.

AI processing: when you request generation, your instructions, relevant course content and selected reference excerpts may be sent to the configured AI provider. The current default integration uses DeepSeek. Its Privacy Policy describes provider retention and uses, including service improvement and model training, subject to the agreement that applies to the service. Remove unnecessary identifiers and do not submit sensitive personal data or material your organisation has not authorised for external processing. You can author courses without requesting AI generation.

Security verification: where enabled, Cloudflare Turnstile processes technical signals for bot protection. See Cloudflare’s Turnstile Privacy Addendum for its processing practices.

Your sharing choices: a published course is available to anyone who obtains its signed public link until the owner rotates the link or unpublishes the course. This cannot recall downloads, screenshots or exports already shared. Embedded video, external images and linked services may receive your IP address, browser information and referrer when loaded or opened, under their own privacy practices. A learning platform receiving an export may separately record learner progress or assessment results. We do not sell personal data.

06.Processing outside Malaysia

Some service providers may process personal data outside Malaysia. DeepSeek’s published privacy policy identifies storage in the People’s Republic of China; using the default direct DeepSeek integration can therefore involve processing there. Hosting, email, security and other providers may use additional locations depending on the deployment. Contact us for information about the recipients and locations relevant to your data.

International processing may be subject to different laws. Before transferring personal data, we must have a basis permitted by applicable law and assess the destination, recipient and relevant safeguards. Where required, safeguards include contractual restrictions, access controls and an assessment of protection. Your use of the service is not a waiver of applicable transfer requirements.

07.Cookies and local storage

You can change your choice at any time through “Cookie settings” in the footer. Essential cookies cannot be disabled through the consent panel because they are needed for the service to work securely. Browser controls can also delete or block cookies, but doing so may affect sign-in and other features.

The analytics choice controls our optional first-party analytics. It does not disable necessary security checks or control storage and tracking on a separate learning platform or external media service. Those services have their own controls and notices. A daily visitor hash is a pseudonymous identifier, not a guarantee of anonymity.

08.Retention and security

We keep account and course data while the account is active and afterwards only for as long as reasonably needed for recovery, legal obligations, disputes, security or an outstanding request. Optional analytics is scheduled for deletion after 14 months, and security-event records after 180 days. Residual copies may remain in backups until the applicable backup cycle completes.

We use reasonable technical and organisational safeguards, including password hashing, secure session controls, role-based access, request-forgery protection, private file storage, signed public links, rate limiting, security headers, audit records and data minimisation. No online service can guarantee absolute security.

You may request account closure or deletion through the contact above. We assess what can be removed and explain any lawful retention that remains necessary. External recipients may have separate retention duties. If a personal-data breach requires notification, we will notify the Commissioner and affected people as required by applicable law.

09.Your choices and rights

Subject to applicable law, you may ask whether we hold your personal data; request access to or correction of it; withdraw consent; object to direct marketing; ask us to stop processing likely to cause damage or distress; and request deletion when the data is no longer required. You can update your name and email in your profile and change analytics consent through “Cookie settings”.

You may also request in writing, including by email, that your personal data be transmitted directly to another data controller, subject to applicable law, technical feasibility and data-format compatibility.

Send requests to [email protected], identifying the account or data concerned and what you would like us to do. We may ask for proportionate proof of identity. We will respond within the applicable statutory period and explain any lawful refusal, extension or permitted fee. Do not send passwords or unnecessary identity documents. Withdrawing consent may affect features that need the data, but does not affect processing already lawfully completed or retention required by law.

If you are concerned about information another person included in a course, give us its location so we can investigate. You may also complain to Malaysia’s Personal Data Protection Commissioner without first completing our internal process.

10.Children

The authoring service is not directed to children under 18. An organisation, parent or guardian that enables a minor to use it must have lawful authority, provide age-appropriate notices, obtain any required consent and supervise that use. Course authors must consider their learners’ ages and must not submit children’s personal data to AI features. Contact us if you believe a child’s data has been provided without appropriate authority so we can assess the situation and take appropriate action.

11.Changes to this notice

We may update this notice when the service, our practices or applicable law changes. We will post the revised notice here, update the date above and provide additional notice for material changes where required. Where a new use requires consent, we will seek it before that processing. This notice is available in English and Bahasa Melayu.