Personal Data Protection Notice

1. (a)We do not train AI models on your material. Our own models are not trained on it, and we switch on the no-training setting wherever a model provider offers one.
2. (b)We do not sell your data, and we do not pass it to anyone for their own marketing.
3. (c)Every agent on the platform is AI. Meera is not a person. None of them is.
4. (d)A person always decides. Nothing that affects you legally is decided by the system alone, and every Output comes to you to review.
5. (e)Data about your own customers and staff stays yours. You decide what happens to it; we only act on your instructions. Clause 3 explains the split.
6. (f)Your uploads are stored in Malaysia. Some of the services we use to process them are not. Clause 9 lists where.

Oeru is organised into Departments, each run by an AI agent. As at the date of this Notice the Departments are Marketing, Customer Service and Sales.

Our data protection officer is your contact for anything in this Notice:

This matters, because it decides who is responsible for what.

Where we are your processor:

1. (a)you are the data controller, and a controller’s duties under the Act are yours;
2. (b)telling those individuals about this processing is your job, not ours. We have no relationship with your customers or staff and cannot notify them;
3. (c)you are responsible for the consents you needed to obtain, and for answering a request one of them makes to you; and
4. (d)Schedule 1 to our Terms of Use sets out the contract between us for that processing, and it prevails over this Notice in respect of it.

Clause 10 explains the practical arrangements, including what we do if one of those individuals comes to us directly.

We do not ask for sensitive personal data and the platform is not built for it. Clause 11 applies if it reaches us anyway.

We collect no personal data from a member of the public who uses a voucher published through Boost. A voucher is redeemed with the merchant at the merchant’s premises. There is no registration, no sign-up and no data capture by us at the point of redemption. If the merchant takes a name, a telephone number or any other detail at that point, the merchant collects it for the merchant’s own purposes, as data controller, and we neither receive it nor process it.

We rely on your consent, and on Section 6(2) of the Act where it permits processing without consent, in particular where processing is necessary to perform our contract with you or to comply with a legal obligation.

We do not sell personal data, and we do not disclose it to anyone for their own marketing.

AI is how the service works, so this Clause is worth reading.

What happens. You describe what you need to Meera. Meera prepares an Instruction Brief and routes it to a Department. The Department’s agent generates the Output from your material. To do that, the relevant material is sent to third-party AI model providers, processed, and returned.

Every agent is AI. None is a person. Their names, personas and faces are created by us and depict no real individual. We label each agent as AI wherever you meet one.

We do not train AI models on your material. We train no model of our own on it. Our model providers process it under their own terms, and where a provider offers a setting that excludes submitted material from being used to improve its models, we switch that setting on.

We do not use your material to serve anyone else. Your Customer Material and Customer Data are used to produce your Outputs, and for nothing else, apart from the security and abuse checks in Clause 6 and aggregated or de-identified analysis that cannot be traced back to you.

A person always decides. No decision with a legal effect on you, or which otherwise significantly affects you, is made by the system alone. Routing an Instruction Brief is an administrative step. Every Output comes to you to review, and you are free to accept it, change it or discard it.

AI output can be wrong. An Output may contain errors or statements that look right and are not. Check it before you use it.

We keep your prompts, Instruction Briefs and Outputs so that you can return to your work and so that we can investigate misuse. Clause 12 gives the retention periods.

We share personal data with these classes of third party, and no others:

1. (a)providers of cloud storage, database and website hosting;
2. (b)providers of the AI models used to generate Outputs;
3. (c)providers of transactional email, messaging and analytics;
4. (d)our payment processor, Stripe;
5. (e)the social media platforms on which a Boosted campaign is published;
6. (f)our professional advisers, including auditors, accountants, bankers, insurers and lawyers;
7. (g)a regulator, government agency, law enforcement agency, court or tribunal, where the law requires or allows it;
8. (h)companies in our group, for the purposes in Clause 6; and
9. (i)a person to whom we transfer, or propose to transfer, our business or a material part of it, together with that person’s advisers.

Each provider we engage must process personal data only on our instructions, keep it secure to the standard in Section 9 of the Act, and tell us about any breach affecting it.

Where we act as your processor, we share Customer Data only with the classes above, or as you instruct, or as the law requires.

Our payment processor is Stripe. You pay on Stripe’s own page. We send Stripe your email address, so that it can send you the receipt, and the Plan or pack of Credits you are buying, the amount and your Account reference, so that the payment is matched to your Account. Your card details are entered on Stripe’s page and go to Stripe only: we never see or store them. If you take a Plan, Stripe also keeps your subscription and the card you pay with, so that it can charge you each month until you cancel. We keep what you bought, what you paid and Stripe’s reference for the payment in your Account’s Credit records. For the payment it takes for us, Stripe acts on our instructions. For your card details, and for the checks the law requires of a payment provider, it acts on its own account, under its own privacy policy.

What you upload is stored in Malaysia. Some of the services that process it are not. The places are:

We transfer personal data out of Malaysia on one or more of the bases in Section 129 of the Act: that the place has a law substantially similar to the Act, or ensures an adequate level of protection at least equivalent to it, as we assess it; that you have consented; that the transfer is necessary to perform our contract with you, or a contract with a third party made in your interest; or that we have taken all reasonable precautions and exercised all due diligence to ensure the data will not be processed there in a way that would contravene the Act.

We carry out a transfer impact assessment for each place, review it at least every three years, and sooner if the law there or the recipient’s systems change materially. Where we rely on precautions and due diligence, we put contractual clauses in place with the recipient giving protection at least equivalent to the Act.

What you upload will often contain other people’s personal data. When you give it to us you confirm that:

1. (a)you are entitled to disclose it to us and to let us process it as described here and in Schedule 1 to our Terms of Use;
2. (b)you have given every notice and obtained every consent the Act requires of you; and
3. (c)where it is sensitive personal data, the explicit consent required by Section 40 of the Act has been given.

Telling those individuals about this Notice, or its substance, is your responsibility.

You can limit what we process about them: remove or mask it before you upload, upload only what the Output needs, and ask us to delete it under Clause 13.

If one of them comes to us directly, we will normally pass the request to you, because you know what the material is and why it was supplied, and we will give you reasonable help in answering it.

We do not keep personal data longer than we need it, as Section 10 of the Act requires.

We may keep data longer where the law requires it, or where we need it to bring or defend a legal claim, and only for as long as that lasts.

We take practical steps to protect personal data from loss, misuse, unauthorised or accidental access, disclosure, alteration and destruction, as Section 9 of the Act and the Personal Data Protection Standard require. Those steps include sign-in by one-time code, restricting internal access to people who need it, encrypting data in transit, keeping each customer’s material separate, and imposing security obligations on every provider we engage.

No transmission over the internet is completely secure. We take the steps above, but we cannot guarantee absolute security, and anything you send us is sent at your own risk. Keep your one-time codes to yourself, and tell us at once if you think your Account has been accessed without your authority.

For personal data we hold as controller, you can ask us to do the following. Write to our data protection officer at the address in Clause 2.2. We may ask for enough information to confirm who you are and to find the data.

For Customer Data, where we are your processor, the request goes to you rather than to us, and we help you answer it under Schedule 1 to our Terms of Use.

We may refuse an access or correction request in the circumstances the Act allows. If we do, we tell you in writing, with reasons, within 21 days.

If you are unhappy with how we have handled your data, you can complain to the Personal Data Protection Commissioner. We would rather you came to our data protection officer first, so we can put it right.

If a personal data breach happens which causes or is likely to cause significant harm, we notify the Personal Data Protection Commissioner as soon as we can, and in any event within 72 hours of the breach, in the form the Commissioner requires.

If the breach causes or is likely to cause significant harm to you, we tell you without unnecessary delay and within 7 days of notifying the Commissioner. We will explain what happened, what it may mean, what we have done, what you can do, and how to reach our data protection officer.

If a breach affects Customer Data you control, we tell you without undue delay and give you what you need to meet your own duties under Section 12B of the Act. Notifying the Commissioner and the individuals is then yours to do.

Every provider we engage must tell us about a breach affecting data it processes for us, and help us deal with it.