1. Who We Are
IntegrAItion ("we", "us", "our") provides AI consulting, automation and custom business systems from Kuching, Sarawak, Malaysia. This notice covers our website, enquiries and the information we handle when delivering client services.
We decide how to handle our own website enquiries and business correspondence. When we process personal data on a client's behalf, we follow the client's documented instructions and the applicable project agreement. Our role depends on the work we perform, not just where a server is located.
For privacy questions, contact hello@integraition.io.
2. What We Collect
Website Visits
We use Cloudflare Web Analytics to measure visits and website performance. It does not use analytics cookies or track visitors across websites. We do not run advertising trackers.
Our own measurement counts page views, intake steps, and clicks on contact and booking links. It records the date, broad source such as Google or Instagram, page, service and page that led to the intake. These event records contain no answers, names, contact details, full URLs or stored IP addresses. Random event IDs prevent duplicate counts; they are not visitor IDs. A contact click does not tell us whether a message was sent or a call was booked.
Cloudflare processes network information to deliver and protect the site. Our submission endpoint uses the request's IP address to limit repeated requests. That address is not included in the saved brief or our measurement records. Operational error logs may contain a submission identifier, business type and error details.
Browser Storage
We store a broad visit-source category in your browser's tab storage. It can be used while the page stays open. When a page loads, a saved category may be reused if it is less than 30 minutes old. This is a reuse window, not a promise that the browser deletes the record after 30 minutes.
Local browser storage can also hold campaign tags, the referring website, the landing page and an arrival date. We use an arrival record for attribution for up to 90 days and send those details to us only with a brief you submit. An expired value can remain in your browser until it is replaced or cleared; expiry stops its use for attribution.
You can clear these records through your browser's site-data controls. Our own optional measurement and source storage respect Do Not Track and Global Privacy Control signals. These controls do not prevent us from receiving a brief you choose to send, and they do not control the separate practices of external services.
Starting-Point and Contact Enquiries
If you use Find my starting point, we receive the information you choose to submit: business type, problems, team size, rough work volume, existing tools, decision-maker role, timing, name, contact details, notes and the intake conversation. The brief can also include the page and campaign details that brought you to the site.
The intake runs in your browser without calling an AI provider. Your answers and contact details stay there until you send your brief. A name, business type and valid email address or WhatsApp number are required to submit it. Without a contact method, we cannot reply. You may also contact us directly by email or WhatsApp.
Submissions pass through our Cloudflare account to our business email, which uses Gmail. Cloudflare keeps a recovery copy for 90 days. We record the submission ID, date, source and whether the email service accepted the notification. These delivery records can be linked to the corresponding brief while it is retained.
Please do not send credentials, patient records, customer exports or other sensitive files through the website intake. If the work requires sensitive information, we agree a suitable access method with you separately.
Client Work
Client business documents and operational records normally remain on the client's own server. Depending on the agreed work, we may access business records, workflows, employee or customer information, source code and configuration. We also hold project correspondence, proposals, invoices and delivery records where needed for the engagement.
3. How We Use Your Data
We use information to:
- Respond to enquiries, understand the requested work and prepare proposals
- Build, configure, test and hand over the agreed system, and provide agreed support
- Administer contracts, payments and business records
- Measure website use, check enquiry delivery and protect our services from abuse
- Handle privacy requests, legal obligations and disputes
We do not sell personal data or disclose a client's confidential records to other clients. We do not use client operational records to train our own general-purpose models. Any project-specific model training needs separate written agreement. External AI services have their own product terms and controls, as explained below.
4. Services & AI Providers
We use service providers where needed for the purposes in this notice:
- Cloudflare hosts and protects the website, processes briefs, routes email and stores the website records described here
- Google / Gmail handles our business email and submitted enquiry copies
- Calendly handles booking information if you follow a booking link; WhatsApp handles messages if you use that contact option
- GitHub may host private development repositories containing source code and project configuration
When you follow an external contact or booking link, that service receives the information you provide and may process device or usage information under its own notice. Other project-specific providers and access arrangements are identified in the agreed scope.
External AI Processing
Some projects may use external AI APIs or applications, including products from OpenAI or Anthropic. Documents can remain on your server while selected text, files or requests are sent to a connected service. Whether this happens depends on the system and its configuration.
Before sending client information to an external AI service for a project, we agree the provider, product, information involved and required controls. A provider's no-training policy does not necessarily mean zero retention. Requests, responses, files and logs can have different rules. Any zero-retention requirement must be checked against the selected service, settings and agreement.
For local AI deployments, the agreed design identifies where documents, model requests, logs and backups are processed and which external connections are permitted. We claim local-only processing only for the workflow and configuration that have been checked.
We may also disclose information where required by law or where necessary to establish or defend a legal claim, subject to applicable privacy requirements.
5. Storage & Access
We do not keep a separate copy or backup of client business documents and operational records unless the client asks us to provide storage. Hosting and any backup service are agreed for each project; a dedicated server is not included in every engagement.
Development source code, configurations and correspondence are separate from client operational records. Development work can use local machines and private repositories. Access to client systems and information is limited to what is needed for the agreed work.
If we store a backup for you, the agreement specifies its contents, location, access, retention, return or deletion, and who is responsible for checking restoration. Requirements for local processing, dedicated infrastructure and restricted external connections are agreed before production use.
6. Data Retention
Website Records
Cloudflare recovery copies of intake briefs are configured to expire after 90 days. Our own measurement events and brief delivery records are removed by a scheduled daily cleanup once they are older than 90 days. Legacy anonymous intake-step totals expire after 400 days. These periods do not delete copies in our email account or records held separately by service providers.
Enquiry Emails
We review inactive enquiries monthly. If an enquiry has not become a project and there has been no meaningful contact for 12 months, we delete it at the next review unless it is still needed for an open request, an agreed engagement, a legal obligation or a dispute. This is a manual review process, not an automatic Gmail deletion timer.
Client Correspondence and Delivery Records
We keep correspondence and development materials while needed to deliver and support the agreed work. After support ends, we review them at least annually and remove personal data that is no longer needed. Contracts, invoices and records needed for an unresolved claim are kept for the period required for that purpose or by applicable law. We restrict any retained records to that purpose.
Records on Your Server and Optional Backups
Business documents and operational records on your server follow your retention settings. Ending our engagement does not automatically delete those records. We do not keep a separate archive as a standard service. If you ask us to store a backup, the agreed backup arrangement sets how long we hold it and how it is returned or deleted.
Specific retention or deletion commitments in an existing agreement continue to apply. Provider-held copies, logs and recovery systems can follow separate deletion cycles under the selected service's terms; we do not promise immediate deletion from every provider system.
7. International Processing
Cloud and communications services can process information in Malaysia and other countries. The location of your main server does not determine every processing location.
For client projects, required hosting regions, external providers and transfer arrangements are agreed before the relevant processing starts. Any overseas transfer must meet the requirements of applicable law and the project agreement. If a required restriction cannot be met by a service, we agree a different approach before using it for that information.
8. Your Choices & Rights
You can contact us to request access to or correction of your personal information, ask about retention, or request deletion. Depending on the law that applies, including Malaysia's personal data protection law or the GDPR where applicable, you may also have rights to restrict or object to processing, withdraw consent, or receive a portable copy.
Withdrawing consent does not affect processing already carried out lawfully. If information is necessary for an enquiry or service, restricting its use may affect our ability to respond or deliver that service. We will explain any relevant limitation or reason we must retain information.
Send requests to hello@integraition.io. We may ask for enough information to verify your identity and locate the records before disclosing or changing them. We handle requests within the time limits required by applicable law.
If the information belongs to a client's system and we act on that client's behalf, the client normally handles the request. We can help direct it to the appropriate contact and assist within our agreed role. You may also complain to the relevant privacy regulator, including Malaysia's Personal Data Protection Commissioner where applicable.
9. Policy Changes
We may update this notice as our services or practices change. We publish the revised date on this page and notify active clients of material changes relevant to their engagement. A website update does not override existing contractual data-handling commitments or rights under applicable law.
10. Contact
For privacy enquiries and requests, email hello@integraition.io. Include enough context for us to locate the enquiry or project, but do not send passwords or sensitive records with your initial request.