Privacy Policy
Effective 12 October 2026 · Last updated 13 October 2026 (renamed from LegalByte Edu to EduByte)
This Privacy Policy explains what personal data LegalByte Sdn Bhd (Registration No. 202501044817 (1646225-D)) (“LegalByte”, “we”, “us”) collects when you use EduByte at legalbyte.my/edu, what we store, where it is stored and processed, who receives it, how long we keep it, and your rights. We are the data controller of this data and we process it in accordance with the Personal Data Protection Act 2010 of Malaysia, as amended (the “PDPA”).
Language
This Policy is also available in
Bahasa Malaysia. If the two versions differ, the English version applies.
1. The short version
- We keep your name, email, the exam sitting you tell us, your practice answers, your marks and your conversations with the tutor.
- We store them in Malaysia. To mark an answer or reply to you, the text is sent to an AI model that may run outside Malaysia; nothing is kept there.
- We do not sell your data, show you adverts, or use your answers to train AI models.
- You can ask us for a copy of your data, to correct it, or to delete your account.
2. What personal data we collect and store
| Category | What it includes | Where it comes from |
|---|
| Account | Your full name, email address, the exam sitting you enter, which invite code you used, when you joined and last logged in. Your password is held by our sign-in provider; we never see or store it. | You, when you sign up. |
| Your study work | The full text of the practice answers you write, the marks and feedback for each, how long you spent, your tutor conversations (your messages and the AI replies), quick-check and quiz results, and the progress figures worked out from them. | You, and the AI marking and tutoring you ask for. |
| Security records | Sign-in sessions with the IP address and browser details, and a log of account events: sign-up, login, email verification, password reset and opening a document from the library. | Generated automatically. |
| Usage | For each AI request: the model used, its size and cost, and the time. This is what the study allowance and daily limits are counted from. | Generated automatically. |
| Technical | Short-lived counters used to limit repeated attempts (your IP address, and a scrambled form of your email), and server logs. Logs do not contain your answers or messages. | Generated automatically. |
| Site statistics | Page address (without anything after a question mark), referring page, approximate location (country, region, city), and device and browser type. No cookies are used for this. | Collected automatically by our hosting provider (section 8). |
Your name, email, a password, an invite code and your exam sitting are needed to create your account; without them we cannot provide EduByte. We do not ask for your identity card number, date of birth, phone number, address or payment details, and EduByte has no file upload.
Please keep other people out of it. Do not put real client information or other people’s personal data into your answers or messages.
3. How we use your data, and why
| Purpose | Data used | Basis |
|---|
| Run EduByte for you: sign you in, mark your answers, answer your questions, show your progress and suggest what to study next | Account, your study work | Needed to perform our agreement with you |
| Apply fair-use limits and control our costs | Usage | Needed to perform our agreement with you |
| Keep EduByte secure: stop repeated attempts and misuse, investigate incidents | Security records, technical | Needed for our agreement and to meet our legal duties |
| Send service emails: verification codes, password resets, important notices about EduByte or these documents | Account | Needed to perform our agreement with you |
| Improve our questions and marking using combined figures that do not identify you | Your study work, in aggregate | Your consent, given when you agree to this Policy; you may withdraw it by emailing us |
| See how the site is used overall | Site statistics | Your consent, which you may withdraw (section 8) |
| Comply with the law, court orders and requests from regulators | Any category, only as required | Legal obligation |
We do not use your answers or messages to train, fine-tune or develop any AI model, and the AI providers we use are not allowed to keep them or train on them.
No sale, no adverts, no marketing without asking. We do not sell your data or use it for advertising. We will not send you marketing emails unless you have agreed to receive them. EduByte’s marks and readiness estimates are study feedback; we do not use them to make decisions about you.
4. How the AI handles your work
When you ask for an answer to be marked, we send the answer, the question and its marking points to an AI model. When you message the tutor, we send your message, the recent part of that conversation and a short summary of your progress. The models are provided through Amazon Bedrock under Amazon Web Services’ data processing terms, and include models developed by OpenAI and by Anthropic, all running on AWS infrastructure. We never send your work to a consumer AI app. The model processes the request to return a result and does not keep it.
To find the right legislation and cases, the tutor searches our legal library. The search text, which can include words from your question, is processed by Google Cloud.
5. Where your data is stored and processed
Stored in Malaysia. Your account, your study work and our records are stored in the AWS Asia Pacific (Malaysia) region. Sign-in (Amazon Cognito) and our service emails (Amazon SES) also run there.
Some processing happens outside Malaysia:- AI marking and tutoring. Requests run on Amazon Bedrock global cross-region inference, so they may be processed in any AWS commercial region in the world. Nothing is stored there.
- Library search. Search text is processed by Google Cloud in Asia Pacific, or in the United States if that region is unavailable.
- The website. EduByte’s pages are served by Vercel from Singapore.
We transfer personal data outside Malaysia only as section 129 of the PDPA permits, including where it is needed to perform our agreement with you, and only to providers bound by written terms that protect it to a standard at least equal to the PDPA.
6. Who we share your data with
We share personal data only with the service providers below, each limited to what it needs.
| Provider | What it does | Location |
|---|
| Amazon Web Services | Hosting, database, sign-in, service email, and the AI models through Amazon Bedrock | Malaysia for storage; AI processing in AWS regions worldwide |
| Google Cloud | Search of the legal library (search text only) | Asia Pacific, with the United States as a fallback |
| Vercel | Website hosting and cookieless page statistics | Singapore |
| Google Fonts | Typefaces for the site (receives your IP address when a font loads) | Global |
We do not share your answers, marks or progress with any examining body, college, university, employer or other student. We may disclose personal data to authorities where the law or a court order requires it, and to a successor if our business is merged or sold, who must honour this Policy.
7. How long we keep your data
| Data | How long |
|---|
| Account and your study work | While you have an account. If you ask us to delete your account, we delete your account details, answers, marks and tutor conversations within 30 days. |
| Usage and security records | Kept after an account is deleted, but then linked only to an internal reference number and not to your name or email, for as long as needed for our accounts, security and legal duties. |
| Sign-in sessions | A session ends after 12 hours or when you log out. Ended sessions are kept as security records. |
| Verification codes and attempt counters | Minutes: a code lasts 15 minutes and is used once. |
| Server logs | A short period, for troubleshooting. |
8. Cookies and browser storage
We do not use advertising or tracking cookies. EduByte uses:
- One essential sign-in cookie (
lb_edu_session), secure and not readable by scripts, which lasts up to 12 hours. - Browser storage to remember the subject and paper you last chose and whether you have seen the welcome tour. It stays in your browser and you can clear it at any time.
- Cookieless page statistics from our hosting provider, Vercel, which count page views and measure page speed without cookies or anything that follows you to other sites. Visitors are counted with a short-lived code that is discarded within 24 hours. A standard tracker blocker in your browser stops it, and EduByte works normally without it.
9. How we protect your data
We use measures suited to the risk, including encryption in transit and at rest, a dedicated EduByte database, passwords held only by our sign-in provider, sign-in tokens stored in scrambled form, limits on repeated sign-in and code attempts, a log of account events, and restricted staff access. No system is perfectly secure. If a personal data breach is likely to cause you significant harm, we will tell you without undue delay, and we will notify the Personal Data Protection Commissioner as the PDPA requires.
10. Your rights
Subject to the PDPA and its exceptions, you may:
- access the personal data we hold about you and get a copy;
- correct data that is inaccurate, incomplete, misleading or out of date;
- receive or transmit your data to another data controller in a commonly used format, where technically feasible;
- withdraw consent to processing that relies on consent;
- ask us to stop processing that is likely to cause you substantial damage or distress;
- ask us to stop processing for direct marketing; and
- ask us to delete your account.
EduByte does not yet have buttons for these, so please email us (section 13) from the address on your account. We will respond within 21 days, as the PDPA requires, and may ask you to confirm your identity. If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).
11. Age
EduByte is for adults preparing for a professional examination. It is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, tell us and we will delete it.
12. Changes to this Policy
We will post any update here and change the “Last updated” date. If a change materially affects how we handle your data, including a new service provider that receives your study work, we will tell you by email or in the app at least 14 days before it takes effect.
13. Contact us and our Data Protection Officer
For privacy questions, to use your rights, or to reach our Data Protection Officer, email
support@legalbyte.my and mention EduByte. We are LegalByte Sdn Bhd (Registration No. 202501044817 (1646225-D)); our registered office address for postal correspondence is available on request.