Privacy Policy

1Who we are

Curios (curios.my) is run by BSYX LABS (202603086039), a business registered in Malaysia.

For owners’ own details, we decide how they are used. For the details of a page’s visitors and customers, the page’s owner decides, and we handle them on the owner’s behalf.

2What we collect

• If you make a page: your email address, and your password, which we keep only as a scrambled hash that can’t be turned back into it. If you sign in with Google, your name and email address from your Google account.
• What you put on your page: your name, bio, photos, links, social profiles and items. If you take orders, your DuitNow QR and your bank account name and number, which your customers see, and, if you connect CHIP, your CHIP Brand ID and secret key, which we keep encrypted and no one sees. The websites, text and files you give your page to read: we keep the facts drawn from them and short excerpts, not the files.
• If you pay for a plan: the plan, amount and date, the CHIP purchase and, if you turn on auto-renew, your card’s brand and last four digits. You log in to your bank or enter your card on CHIP’s and your bank’s pages; we never see those details.
• If you chat on a page: what you type and the page’s replies. The questions people ask are also kept without who asked them, so the owner can see what people want to know.
• If you leave your number in a chat: your phone number, and what the chat understood you wanted, such as a product, a date or a place.
• If you order from a shop: your name, your WhatsApp number, pickup or delivery, the day, your address for a delivery, any note, what you ordered, and the payment receipt you upload. If you pay online: your email address, for CHIP’s receipt, and how you paid (the bank you chose, or your card’s brand and last four digits). You log in to your bank or enter your card on CHIP’s and your bank’s pages; we never see those details.
• Your IP address, which our servers use to block abuse and record in their logs. We use no advertising or analytics trackers.

Giving us your details is up to you, but without them we can’t make your page, pass your number to the owner, or place your order.

3Why we use it

• to run pages, chats and shops, and to get each message, number and order to the right owner;
• to have an AI answer visitors from an owner’s facts, and pick out what someone who left their number wanted;
• to send account emails, such as confirming your address or resetting your password, and the emails an owner turns on, such as a new lead, a new order, a receipt, or a reminder that their plan is ending;
• to take payment and keep accounting records;
• to keep Curios secure, including blocking abuse and checking new passwords against known data breaches.

We don’t sell personal data, and we don’t use it for advertising.

4Who else sees it

• The page’s owner sees the chats on their page, the numbers left with them, and the orders and receipts sent to them.
• Anthropic (United States): its Claude models read chat messages and a page’s facts and sources, to write answers and pick out facts.
• OpenAI (United States): turns questions and facts into numbers (embeddings) so the chat can find the right fact.
• CHIP (Malaysia): takes Business plan payments, and receives your email address, your page’s name and the amount. Your card details go to CHIP, never to us; for auto-renew, CHIP keeps a token of your card that only works for Curios’s charges.
• CHIP (Malaysia): processes online payments for shop orders, through the shop owner’s own CHIP account, and receives the customer’s name, WhatsApp number and email address, what they ordered and the amount. The money goes to the owner’s CHIP account, and CHIP emails the customer the receipt.
• Have I Been Pwned: receives the first five characters of a hash of a new password, never the password, to check it hasn’t leaked in a breach.
• Our hosting, storage and email providers, who store data and send email for us.
• Authorities, where the law requires us to share.

Under their business terms, Anthropic and OpenAI don’t train their models on what we send them.

Photos on a page, and receipts uploaded with an order, are stored as files at long, random addresses. Anyone who has a file’s exact link can open it, so don’t share it.

5Outside Malaysia

Some of these providers handle data outside Malaysia, including in the United States. We only use providers that protect it to a standard comparable to the PDPA, as the Act requires.

6How long we keep it

• Chats, numbers left in chats, and orders with their receipts: deleted automatically 12 months after they were made. An owner can delete a lead sooner, and its chat goes with it.
• The questions people ask, without who asked: kept while the page exists, as part of what the page knows. The owner can delete them.
• Your account and page: kept until you ask us to close your account.
• Payment records: kept for 7 years, as Malaysian tax law requires.
• Server logs: kept only as long as we need them to keep Curios secure.

7Cookies

We use one cookie to keep you signed in, curios_session. It signs you out after 14 days without a visit, and after 30 days at most. Three more are used only while you sign in with Google, and are gone within 10 minutes.

Your browser also remembers your shop basket until you close the tab, the page address you chose before signing up, and the alerts you have closed. None of these follow you to other sites.

8Keeping it safe

Passwords are hashed, the secret in each order link is stored only as a hash, and every connection uses HTTPS. No system is perfectly secure: if a breach puts your data at risk, we will tell you and the authorities as the law requires.

9What you can ask of us

Under the PDPA you can ask to see the personal data we hold about you, to correct it, and to stop us using it or delete it where we don’t need it to run your account or to meet a legal duty. Owners can change most of their details themselves.

Email [email protected] from the address on your account. We reply within 21 days.

Visitors and customers: your details belong to the page’s owner to manage, so ask the owner first. If you can’t reach them, write to us and we will help.

10Children

Curios isn’t meant for children under 13, and owners under 18 need a parent’s or guardian’s permission. If you think a child has given us personal data, tell us and we will delete it.

11Changes to this policy

We may update this policy. When we do, we change the date at the top, and for a significant change we email owners before it applies.

12Contact

Write to [email protected]. This policy is written in English and Malay; if the two differ, the English version applies.