Chuzoly Privacy Policy (Privacy Notice)
Last updated: 10 November 2026 · Version 1.1
This notice explains what personal data Chuzoly (https://chuzoly.com) collects, why, who it is shared with, and how you can access, correct or delete it. It is our written notice under section 7 of Malaysia’s Personal Data Protection Act 2010 (as amended by the Personal Data Protection (Amendment) Act 2024) (“PDPA”). It is published in Bahasa Melayu and English, and both versions say the same thing. A Chinese version is provided for convenience. If the versions differ, the Bahasa Melayu and English versions prevail.
1. Who we are
Chuzoly is a website that recommends AI tools by task. It is run from Malaysia by Chuzoly (“Chuzoly”, “we”, “us”), which you can contact at leeyongwei210084@gmail.com. We are the data controller for the personal data described here.
Contact for all privacy matters, including access, correction, deletion and complaints: leeyongwei210084@gmail.com (subject line: “Privacy request”).
2. The short version
- You can browse the whole site without giving us any personal data. We do not use cookies for analytics or advertising. If you sign in, we set one necessary session cookie so we can keep you signed in.
- We only collect personal data when you choose to post a comment, send feedback, submit a tool, apply to sponsor, subscribe to the newsletter, or create an account (including saving favorites to that account or taking out a Chuzoly Pro membership).
- Comments (nickname and text) are public. Do not put personal details in them.
- We never sell your personal data.
- We use a few service providers to run the site: Cloudflare (hosting and database), Kit (newsletter email), Stripe (sponsor payments and Chuzoly Pro memberships) and Gmail (for replying to email). Some of them are outside Malaysia.
- You can ask us at any time to access, correct or delete your data, or to stop emailing you. If you have an account, you can also delete it yourself from /account/.
3. What we collect, why, and whether you must provide it
| Feature | Personal data | Purpose | Voluntary or required |
|---|---|---|---|
| Comments on tool and scenario pages | Nickname and comment text (shown publicly); the page and language version; time posted; a pseudonymised hash of your IP address (not shown publicly) | Showing your comment; preventing spam, floods and duplicate posts (rate limits) | Voluntary. Nickname and text are required to post. If you do not provide them, you cannot post, but you can still use the whole site. |
| Feedback form (/feedback/) | Feedback type and message; the related page (optional); email address (optional); language; time sent; IP hash | Fixing errors, considering suggestions, replying to you if you gave an email; preventing abuse | Voluntary. The message is required to send feedback. Email is optional; without it we cannot reply. |
| Tool submission form (/submit/) | Tool name and official website; a short description; related scenario or category (optional); email address (optional); language; time sent; IP hash | Reviewing the suggestion for a possible listing; replying if you gave an email; preventing abuse. Submissions are not published automatically. | Voluntary. Tool name, official website and description are required. Email is optional; without it we cannot reply. |
| Sponsorship application (/advertise/) | Tool name and website; contact name; contact email; preferred start date, message and highlights (optional); language; time sent; IP hash | Reviewing your application, replying and arranging the sponsorship; preventing abuse | Voluntary. Tool name, website, contact name and email are required, because we cannot review or reply to an application without them. |
| Sponsor payment (only if your application is accepted) | Payment details you enter on Stripe’s checkout page, the tool name/URL and scenario fields on that page | Taking payment and keeping business and tax records | Required only if you choose to pay for a sponsorship. Card details go to Stripe; we never see or store your full card number. |
| Newsletter | Email address; language; the page you subscribed from; subscription and unsubscription times; subscription status; IP hash; technical sync status with Kit | Sending the confirmation email and the Chuzoly weekly email; handling unsubscribes; preventing abuse | Voluntary. Email is required to subscribe. |
| Account and sign-in (/login/, /account/) | Your email address; language; time of the request; a one-way hash of your IP address (to rate-limit login emails); a hashed session token in a necessary cookie after you sign in | To send you a one-time login link, keep you signed in, and let you manage your plan. We do not use a password. | Voluntary. An email address is needed only if you want an account. |
| Saved tools (favorites) after you sign in | The identifiers of tools you save, a short name and description copied from our public listings, and the time you saved them | To show your list on /favorites/ and sync it across devices | Voluntary. You can remove items or delete your account. The free plan keeps 3; Pro has no cap. Favorites you save while signed out stay only in your browser and are sent to us only when you later sign in, so we can merge them into your account. |
| Need-based search counts | A daily count, keyed either to your account or to a one-way hash of your IP address and the date (Malaysia time). We do not store the raw IP or the text of your search. | To enforce the free plan’s daily limit of 5 need-based searches and to prevent abuse. Browsing scenarios and tool pages is not counted. | Automatic when you submit a need-based search. |
| Chuzoly Pro payments | The payment details you enter on Stripe Checkout, your Stripe customer and subscription identifiers, and your membership status and period end | To take the USD 7 monthly subscription, keep your membership up to date, and let you cancel in the Stripe customer portal | Only if you choose to subscribe. Card details go to Stripe; we do not see or store the full card number. |
| Campaign (UTM) statistics | Only the utm_source, utm_medium and utm_campaign values in the link you clicked, the landing page path and the date (UTC) | Counting visits per marketing channel in aggregate | Automatic when you arrive through a tagged link. No IP, IP hash, device, browser, referrer, cookie or visitor ID is recorded, so this data does not identify you. |
| Page-view statistics (Cloudflare Web Analytics) | Aggregate page views, measured without cookies | Understanding which pages are used | Automatic. See section 6. |
| Email you send us | Your email address and whatever you write | Replying to you | Voluntary. |
Source of the data. We collect this data directly from you through the forms above. The IP hash is computed from the connection your browser makes to our site. We do not buy data or collect it from other sources.
About the IP hash. We never store your raw IP address. For spam control we store a one-way SHA-256 hash of your IP address (for IPv6, of its /64 network prefix) combined with a secret value. It cannot be shown publicly or reversed by others, but because the same address always gives the same hash, we treat it as personal data and protect it accordingly.
Please do not send us sensitive personal data (for example health, religious, political or biometric data, or financial details) in comments, feedback, tool submissions or applications. We do not ask for it.
Children. Chuzoly is meant for a general adult audience. If you are under 18, please get your parent’s or guardian’s consent before posting a comment, sending feedback, submitting a tool, creating an account, taking out a membership or subscribing.
4. Who we share personal data with
We do not sell or rent personal data, and we do not share it for other companies’ marketing. We only disclose it to the following classes of third parties:
- Service providers that process data for us (data processors):
- Cloudflare, Inc. (USA, global network): website hosting (Cloudflare Pages), our database (Cloudflare D1, where comments, feedback, tool submissions, sponsorship applications, newsletter records, UTM counts, user accounts, sessions, saved tools and daily search counts are stored), Web Analytics and, if enabled, the Turnstile bot check.
- Kit, Inc. (kit.com, USA): newsletter delivery. When you subscribe, your browser sends your email address directly to Kit. Kit sends the confirmation email (double opt-in) and each newsletter. If Kit suspects automated sign-ups, it may show you its own security check. Kit may record whether an email is opened and whether links in it are clicked.
- Stripe: payment processing for accepted sponsors and for Chuzoly Pro memberships.
- Google (Gmail): our contact mailbox, used to reply to feedback, tool submissions, sponsorship and privacy requests.
- The public: your comment nickname and text, and the time it was posted, are visible to everyone.
- Authorities and advisers: where required or permitted by law (for example a court order, or a request from the Personal Data Protection Commissioner or police), or to establish, exercise or defend legal claims.
- A successor: if Chuzoly is transferred to another operator, the data may be transferred with it under this notice. We will tell you before that happens.
5. Transfers outside Malaysia
Our service providers store or process data outside Malaysia, including in the United States and in other countries where Cloudflare operates data centres. The United States has no single national data protection law that is substantially similar to the PDPA. We therefore rely on the conditions in section 129 of the PDPA: we choose established providers that commit by contract (their data processing terms) to protect personal data and keep it secure, and we tell you about the transfer in this notice. By subscribing to the newsletter, you also consent to your email address being sent to Kit in the United States for that purpose.
6. Cookies, analytics and browser storage
- No analytics or advertising cookies. Cloudflare Web Analytics measures page views without cookies or local storage and does not record URL query strings. As our host, Cloudflare necessarily processes your IP address and technical request data to deliver pages and protect the site against attacks. See Cloudflare’s privacy policy.
- Necessary sign-in cookie. After you sign in, we set an HttpOnly, Secure, SameSite=Lax cookie named
pa_sessionso we can recognise your session. It is not used for advertising. It lasts up to 30 days, or until you sign out or delete your account. - Browser storage that stays on your device. If you switch between dark and light themes, your choice is saved in your browser’s localStorage. Tools you save while signed out are also stored only in localStorage on this device. If you arrive through a tagged link, a flag (
pa_utm) is saved in sessionStorage so the visit is counted only once, and it is cleared when you close the tab. Theme preference and the signed-out favorites list are not sent to us as identifiers. If you later sign in, the signed-out favorites may be merged into your account (the free plan then keeps the 3 most recently saved if you are over the cap). - Third-party sites. Tool links, affiliate links and sponsored links take you to other websites. Those sites, and affiliate networks, may use their own cookies to track referrals. Their privacy policies apply there, not ours.
7. How long we keep data
| Data | Retention |
|---|---|
| Public comments | While the comment is displayed. Deleted within 30 days of your deletion request, or of us removing it. |
| IP hash on comments, feedback, tool submissions, applications and subscriptions | Deleted (cleared) after 30 days. Spam checks only need it for up to 24 hours. |
| Feedback | Up to 12 months after we receive it, then deleted. |
| Tool submissions | Up to 12 months after we receive them, then deleted. |
| Sponsorship applications not taken up | Up to 12 months after the application, then deleted. |
| Records of accepted sponsorships and payments | As long as Malaysian tax and business record laws require (generally 7 years). |
| Newsletter subscription | Until you unsubscribe. Your email is deleted from our database within 30 days after you unsubscribe. Kit keeps a record that you unsubscribed so that it does not email you again; if you want Kit to delete your email too, tell us and we will ask Kit to delete it. Sign-ups that Kit did not accept are deleted after 30 days. |
| UTM counts | Kept indefinitely as aggregate statistics. They contain no personal data. |
| Account (email, plan status) | Kept until you delete the account. |
| Sign-in sessions | Until the session expires (up to 30 days), you sign out, or you delete the account. |
| Login-link tokens | Until they expire or are used (about 20 minutes), then removed by our cleanup job. |
| Server-side saved tools | Until you remove them or delete your account. |
| Need-based search counts | Deleted shortly after the day they refer to (within about 48 hours after that day ends in Malaysia time). |
| Paid membership payment records | Kept for the period required by Malaysian tax and business-record law (generally 7 years). |
| Emails with us | Up to 24 months after the last message, unless needed for a legal claim. |
When these periods end, an automated cleanup job deletes or clears the data.
8. Security
Data is sent to us over HTTPS. Feedback, tool submissions, applications and subscriber data are never shown publicly and can be read only by the Chuzoly team through access-controlled tools. Raw IP addresses are not stored. We require our service providers to keep data secure, as data processors are also required to do under the PDPA. No system is perfectly secure. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and, where the breach is likely to cause you significant harm, notify you as the PDPA requires.
9. Your rights
Under the PDPA you can:
- Access the personal data we hold about you and get a copy. We will reply within 21 days. We do not charge a fee for this.
- Correct data that is inaccurate, incomplete, misleading or out of date. We will reply within 21 days.
- Withdraw consent and ask us to stop processing, for example by unsubscribing or asking us to delete a comment.
- Ask us to delete your comment, feedback, tool submission, application, subscription or account data. You can also delete your account yourself from /account/.
- Stop direct marketing. Every newsletter email has an unsubscribe link, or you can email us.
- Ask us not to process data in a way that is likely to cause you substantial damage or distress.
- Data portability. Ask us to send your data to another organisation where this is technically feasible.
How to make a request. Email leeyongwei210084@gmail.com with the subject “Privacy request”. Tell us what you want and enough detail for us to find the data: for a comment, the page, nickname, approximate date and text. For a subscription or application, write from the same email address, or we may ask a simple question to confirm the data is yours. We may refuse or limit a request where the PDPA allows, and we will tell you why.
Complaints. If you are not satisfied with our reply, you can complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi, https://www.pdp.gov.my).
10. Visitors outside Malaysia
Chuzoly is run from Malaysia and is governed by Malaysian law. If you are in another country, such as the EU, UK or Singapore, your local law may give you similar rights, such as access, correction, deletion, objection and portability. We will handle requests from anywhere in the same way, through the contact above. Where such laws require a legal basis, we rely on your consent (newsletter), on taking steps at your request (sponsorship applications, replies to feedback, tool submissions), and on our legitimate interest in running and protecting the site (comments, spam prevention, aggregate statistics). You may also complain to your local data protection authority. This paragraph does not claim that Chuzoly is certified under, or fully compliant with, any foreign law.
11. Changes to this notice
We will update this page when our data practices change and change the “Last updated” date. If a change materially affects how we use data we already hold, we will announce it on the site and, for newsletter subscribers, in the newsletter before it takes effect.