Privacy
How we handle the files you send
This notice describes personal data Cache Canvas Core holds about clients and site visitors. It is written for the Personal Data Protection Act 2010 of Malaysia. Last updated 4 August 2026.
Data controller
Cache Canvas Core, 31 RMH Kedal PSN HLMN Ampang HLMN Ampang Mewah,Ipoh,Perak,31400,Malaysia, is the controller for enquiry records, invoices, and session administration. Email info@cachecanvascore.digital or telephone +6055110881.
What we collect
From the contact form and email: your name, email address, the ritual type you select, the piece of work you ask about, and the message you write. From invoices: billing name, address if you supply one, and payment references you or your bank send. From sessions: attendance, notes we take, and copies of glossaries and aggregated or hashed exports you provide. From the website: the cookie choice described on the cookies page, and standard server logs (IP address, browser type, pages requested) kept by the host for security.
We do not want, and ask you not to send, personal data about the people who use your habit product — names, emails, phone numbers, identity card numbers, precise device identifiers, or health notes that identify a patient. If an export still contains such data, we will ask you to send a clean file and we will delete the unfit copy. Health or school data about your end users is your responsibility; we are not their clinic or school.
Why we hold it
We use enquiry data to reply and to quote. We use contract and invoice data to deliver the work, collect fees, and meet tax record duties in Malaysia. We use session notes and permitted exports only to perform the diagnostic, workshop, review, or advisory you booked. Cookie data is used as you choose: essential storage of that choice, and visit counts only if you accept. We do not sell personal data.
Retention
Unsuccessful enquiries are kept up to 18 months so we can recognise a follow-up. Contracts, invoices, and tax records are kept for seven years, or longer if Malaysian tax rules then in force require it. Permitted exports and annotated tables are kept for 90 days after the final deliverable, then deleted from studio machines unless you ask us in writing to hold them for an advisory that is still running. Advisory files are deleted 90 days after the last paid month. Cookie choice remains in your browser until you clear it.
Your rights
Subject to the PDPA and any applicable exemption, you may request access to personal data we hold about you, correction of inaccurate data, and information about how it is processed. You may withdraw consent where processing is based on consent (for example analytics cookies). You may complain to us first at info@cachecanvascore.digital, and to the Personal Data Protection Commissioner of Malaysia. We will need enough information to identify you before we act on a request.
International transfers
The studio is in Malaysia. Email and file transfer may pass through processors outside Malaysia (for example an email host). Where we use such a processor, we do so to communicate with you or to store encrypted backups of client files we are still entitled to hold. We do not upload your export into a public model, a community forum, or an unrelated vendor’s marketing list. If you require that files remain only on Malaysian soil, say so before the export is sent; we will say whether we can meet that constraint or must decline the work.
Children
This site is aimed at people commissioning professional work, not at children. We do not knowingly collect personal data from anyone under 18. Classroom-adjacent products are discussed with the adult who commissions us, not with students.
Changes
If this notice changes in a way that affects how we use personal data we already hold, we will state the date above and, for active clients, mention it in the next invoice or session note.