Privacy Policy

1. Introduction

Sebina AI, operated by RIMAUTEK SDN. BHD. ("we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered website builder platform at sebina.ai (the "Service").

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you subscribe to a paid plan, we collect billing information processed securely through our third-party payment provider. We do not store your full payment card details.

2.2 Project Data

We store the website content, code, and configuration files you create using our platform. This includes text, images, design preferences, and deployment settings. Your project data is stored securely in our cloud infrastructure.

2.3 Office Documents

When you use Office, we store the documents you create and the details you put on them. Those details usually include information about other people — your customers' names, addresses, email addresses, phone numbers and what they bought. You decide what goes on a document; we store it so you can produce, share and keep a record of it. If you share a document, anyone holding that link can view it until you stop sharing. You can delete a document at any time, and deleting it removes its contents from our systems, subject to routine backups.

2.4 Usage Data

We automatically collect information about how you interact with the Service, including AI token usage, pages visited, features used, deployment activity, and technical data such as browser type, IP address, and device information.

2.5 AI Interaction Data

When you use our AI features, we process the prompts and descriptions you give us, the files, links and voice recordings you send, and — when you ask the AI to work on one of your websites — that website's code, content and database records, which can include your customers' details. We use them to generate website content, documents, images, video and audio, and they are processed by the AI services named in section 4. To check and improve quality, we review a sample of conversations with email addresses, Malaysian mobile numbers and IC numbers removed; Anthropic's Claude helps us grade them. We also use conversations with our AI website editor, including your messages, to train and test our own AI models; passwords and secret keys are removed, other personal details may remain. Your AI interactions are not shared with third parties for marketing purposes.

2.6 Payment and Payout Data

When the Managed Payment Gateway is enabled on your websites, we process your customers' checkout details on your behalf — name, email address, order details and payment status. We never receive or store full card numbers or online-banking credentials; those stay with the payment provider. To process your withdrawals we also collect your payout bank details (bank name, account number and account holder name).

2.7 Visitor Chat

You can chat with Sebina on our homepage without an account. We store the messages you send and the replies, keep them together with an essential cookie in your browser that lasts up to 30 days, and use a one-way hash of your IP address that changes every day — never the address itself — only to apply fair-use limits. Your messages are processed by our AI providers in the same way as any other AI interaction. Please do not share sensitive personal information in the visitor chat. If you create an account shortly afterwards, a copy of that conversation is placed in your account so you can carry on from where you left off. Either way, the homepage conversation itself is deleted automatically 30 days after your last message.

2.8 WhatsApp Notifications

On a paid plan you can choose to receive your task reminders on WhatsApp. The link is made only by a message you send yourself: you send our WhatsApp number a one-time code shown in your Settings, and we record that you agreed and which version of the wording you saw. To make the link we store the WhatsApp number you messaged us from and WhatsApp's account ID for it. What we send you is your task titles (and any names you put in them), their due times, a summary of reminders you missed, a test message when you ask for one, and short fixed replies to the messages you send us. These messages are carried by WhatsApp, a service of Meta Platforms, and may be processed outside Malaysia. They are sent from a dedicated phone used for nothing else; that phone is set to delete messages after 7 days and keeps no chat backup. Our server keeps the text of each message we send you for up to 24 hours, only so WhatsApp can deliver it again if a delivery fails. When you reply, we read your message only to act on it — for example to mark a task done or snooze a reminder — and answer with a fixed reply; no AI model reads your WhatsApp messages. We do not store the text of your messages in our database: our WhatsApp server keeps each message you send us for up to 24 hours, to process it and so that our answer can quote it, and then deletes it. When we cannot answer a question, our reply gives you a link that opens Sebina AI with your words filled in; that reply is kept like any other message we send you, and nothing reaches Sebina AI unless you send it there yourself. Each reminder's record in your notification history notes whether it was delivered on WhatsApp and WhatsApp's id for that message — never its text — and stays with your notification history. WhatsApp data is never used to train or tune AI models. You can reply STOP at any time to stop WhatsApp messages, or disconnect WhatsApp in Settings → Notifications. What we keep after you disconnect or delete your account is described in section 6.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To process your transactions and manage your subscription
• To generate AI-powered website content based on your inputs
• To deploy and host your websites on our infrastructure
• To send you service-related communications (subscription reminders, security alerts)
• To send the task reminders you set — in the app, by email and, if you connect it, on WhatsApp
• To monitor and analyze usage patterns to improve our platform
• To detect, prevent, and address technical issues and abuse

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• AI and search services: MiniMax, DeepSeek, ILMU and, when we configure it, Anthropic process text and code; Anthropic's Claude also grades the quality-review sample described in section 2.5. Higgsfield passes image, video and audio requests to the model used, including models made by OpenAI, Google, ByteDance, Kuaishou, MiniMax and ElevenLabs. Sogni generates images and video. ElevenLabs turns text into speech and voice recordings into text. Image searches go through Apify, Google and Pexels, web searches through public search engines, and web pages you link may be read through Jina Reader. Your prompts, the files, links and voice recordings you give us, the content being generated and, when the AI works on one of your websites, that website's code, content and data are processed through their services, which may be outside Malaysia.
• Payment processors: CHIP processes payments for Sebina plans and token packs. If you choose to pay in USDT, NOWPayments processes that payment and receives only the amount, the coin, an order number and the product name. We do not store your full payment card details.
• CHIP (payment provider): When you sell through the Managed Payment Gateway, payment, refund and payout processing is performed through CHIP; the checkout details described in section 2.6 are shared with CHIP for that purpose.
• Cloud Infrastructure: We use trusted third-party cloud providers for database storage and website hosting.
• Image Services: Third-party stock image services are used to source images for generated websites.
• Google Maps place searches: When you ask for places, we send the search query and the area you provide to Google Maps. Place cards load current details and available photos from Google; chat history stores place identifiers rather than copies of those details or photos. Google handles this information under the Google Privacy Policy.
• WhatsApp (Meta Platforms): If you connect WhatsApp to receive task reminders (section 2.8), the messages we send you and your replies are carried by WhatsApp, a service of Meta Platforms, and may be processed outside Malaysia. WhatsApp handles them under the WhatsApp Privacy Policy.
• Legal Requirements: We may disclose information if required by law or to protect our rights.

5. Data Security

We implement industry-standard security measures including HTTPS encryption for all data transmission, encrypted database storage, secure authentication systems, and regular security monitoring. However, no method of transmission over the Internet is 100% secure.

6. Data Retention

We retain your account data and project files for as long as your account is active. What happens when you delete your account is described in section 6.1 below. Homepage visitor chats (section 2.7) are deleted automatically 30 days after the last message. If a conversation was copied into an account when someone signed up, that copy is kept with the account like any other chat, and the homepage conversation is still deleted on the same schedule. If you connect WhatsApp (section 2.8): the phone that sends our WhatsApp messages is set to delete them after 7 days and keeps no chat backup; our server keeps the text of a message we send you, and of a message you send us, for up to 24 hours and then deletes it; each reminder's WhatsApp delivery status (WhatsApp's id for the message and whether it was delivered, never message text) is kept with your notification history. We keep the WhatsApp number you connected, and WhatsApp's account ID for it, with your account — also after you disconnect — until your account deletion is completed. Our WhatsApp server also keeps a short record for every WhatsApp number that has messaged our number — the number, WhatsApp's account ID for it, when it last messaged us and whether it replied STOP, never message text — so that a STOP is always honoured; this record is kept after you disconnect or delete your account. Our database keeps the same record until your account deletion is completed, unless another account uses that number; a number you linked earlier and then replaced stays in it.

6.1 Deleting Your Account

You can ask us to delete your account in Settings (Danger Zone), or without signing in at sebina.ai/account/delete: we email you a link, and you confirm on the page it opens. From the moment you confirm, you can no longer sign in and all your sessions end, so download anything you want to keep before you ask. Our staff complete the deletion. We aim to do so within 30 days, but it can take longer while money owed to you is still clearing or waiting for your bank details, or while we must keep the account for a legal reason. We email you when it is done.

Until our staff start the deletion, you can cancel it with the Cancel link in the email we send you, or by writing to [email protected]; if you have lost the email, enter your address at sebina.ai/account/delete and we send a new link. Once the deletion has started it can no longer be cancelled. If you cancel, you can sign in again and your account carries on, with these exceptions: level commissions on payments made while your request was open are not paid to you — they go to the next member up your line — and no first-time bonus is paid for them; work and checkout pages we stopped when you asked (queued /newgen jobs, a site edit that was running, Studio Director videos, open CHIP payment pages and unpaid domain reservations) are not restarted; your plan was not renewed automatically while the request was open, so it may have ended; and a payout we had already started stays paid. While your request is open your websites stay online, but they stop taking new payments through Sebina's Managed Payment Gateway; payment channels you connected yourself keep working.

When the deletion is completed we remove your websites (they go offline, and their files, databases and hosting are deleted), your projects, your Studio and Office files, your chats with Sebina, your tasks (including tasks you gave to other members), contacts, notifications and support tickets, and the other content of your account, and we anonymise your profile: your name, email address, phone number and photo are removed, and you appear to other members as "Deleted member". Your sign-in record is deactivated, not erased. Files of yours that another member's live website still uses are kept for that website. Your comments on other members' tasks are removed and your name in their task history is replaced. The in-app notifications other members received about you or your tasks are removed; emails and WhatsApp messages already sent to them cannot be recalled; our notification records keep your account id but not your name, but the copies of those emails kept by our mail system (section 6.3) still show your name and the task's title. Tasks other members created stay with them. Builds you ran, and your chats, on a project that has since been transferred to another member stay with that project. Domains you bought through Sebina stop serving your websites and we do not renew them; they are not transferred to you and stay registered to us until their paid term ends. Parked domains are removed, and the mail service of your own domains is switched off.

Money. When you ask, we show what we expect to pay out and what will be forfeited; the final amounts are worked out when the deletion is completed and can differ, for example after a refund or a late sale. Each wallet is paid out on its own when RM10 or more of it can be paid: your affiliate wallet under the plan status and wallet reserve you had on the day you asked (if your plan was not active that day, nothing is paid from it), and your Managed Payment Gateway wallet once nothing in it is still clearing. For a deletion payout this RM10 minimum replaces the usual payout minimum in our Terms. We pay to the bank account you give us when you ask, or that you give through a link we email you; if that link expires unused after the target date, the money may be forfeited. Money that reaches a wallet before we erase your account data (the last stage of the deletion) is paid out under the same rules. When the deletion is completed, everything we have not paid out is forfeited: amounts under RM10, credit that can only be spent, your wallet reserve, money not payable because your plan was not active, money we could not pay because you did not give us bank details, any time left on your paid plan (there is no refund), prepaid domain years, your AI tokens and your reward tickets; a wheel prize waiting to be paid by hand is not paid. Money that reaches a wallet after that (for example a late sale) is reviewed by our staff and forfeited.

6.2 What We Keep After Deletion

• Payment, tax and accounting records — what you paid, what you sold through the Managed Payment Gateway (including your buyers' names and email addresses), refunds and payouts — including the name and email address of the payer and, for payouts, your full legal name, the bank account they were paid to and any DuitNow QR image you gave us. We keep these for at least 7 years after the deletion is completed, because the law requires us to keep them.
• Your affiliate history (commissions, withdrawals and wallet movements) and your place in other members' referral trees, so that their commission history stays correct. Your profile there is anonymised. We keep this with no set end date, because other members' earnings depend on it.
• A one-way code made from each email address on your account (never the addresses themselves), for 7 years after the latest deletion of an account with that address, and then deleted. A new account made with one of those addresses gets no referral code of its own, cannot be placed in a referral tree, and its payments earn no commission or first-time bonus for anyone.
• The record of your deletion: its dates, the ids of your former projects, the names and ids of your former domains, a log of each completion step, the amounts paid out, forfeited or written off, and the name, email address and language you had when you asked, for at least 7 years. A request you cancelled is kept too, with any bank details you gave.
• Your usage and reward records — AI token, ticket and wheel history and AI usage charges — and the record of the domains you bought (names, prices and dates), linked to your anonymised profile.
• The record of which version of our Terms and this Privacy Policy you accepted, and when.

6.3 What Our Mail System Keeps

Mail sent or received through Sebina Mail on your own domains is kept, with its delivery records, with no set end date: when your account is deleted, your domains' mail service is switched off (no sending, receiving or mailbox sign-in), but the stored messages are not deleted. The emails Sebina sends to you or for your websites — sign-in codes, receipts, website form notifications and the account-deletion emails themselves — and the emails we sent to other members about you or your tasks are also kept, with their delivery records, with no set end date.

6.4 What Is Not Deleted by Us

Conversations already used to train our own AI models are not removed from those models or their training copies (section 2.5). Copies of your requests held by the AI services that processed them (section 4) are kept or deleted under those services' own policies; images and videos made through Higgsfield also stay in the library of our Higgsfield account, and we do not delete them. Our WhatsApp server's short record of numbers that have messaged us is kept as described above, and the WhatsApp service keeps its own records. Operational backups and logs are not edited to remove you; they are overwritten in their normal cycle.

7. Your Rights

You have the right to:

• Access and download your personal data and project files — before you ask to delete your account, because you cannot sign in afterwards
• Correct inaccurate information in your profile
• Delete your account — in Settings (Danger Zone), or at sebina.ai/account/delete without signing in; section 6.1 says what is deleted and section 6.2 what is kept
• Export your website code and content
• Opt out of non-essential communications

To exercise these rights, contact us at [email protected] or [email protected].

8. Cookies

We use essential cookies for authentication and session management, including the cookie that keeps a homepage visitor chat together. When you use sebina.ai in a web browser — including the dashboard — our pages load the Google tag for Google Ads (AW-18256660695). It sets Google cookies when a page loads and tells Google which of our pages you visit, so that we can measure whether our ads lead to sign-ups; Google may also use it to show our ads to people who have visited us. Google handles that data under the Google Privacy Policy. The tag is not loaded in the Sebina AI app, on documents you share, at sebina.ai/webmail or on the account-deletion pages. Apart from it, we add no third-party advertising or analytics scripts to our pages.

9. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we discover that we have collected data from a child, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy. Sebina AI, operated by RIMAUTEK SDN. BHD., reserves the right to update or change the Terms of Service and this Privacy Policy at any time; when we make changes, you will be presented with the updated documents in the app and must accept them to continue using the Service, and your acceptance (version and date) is recorded on your account.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at: