Privacy Policy.

This Privacy Policy explains how eWallz Network (Ozem), which operates Ozem ("we", "us"), handles personal information when you use the Service at ozem.my. We process personal data in accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA"). By using the Service, you consent to the processing described in this Policy.

1. Information we collect

• Account data — your name, email address and the workspace subdomain you choose at registration.
• Content you create — the pages, code, data, uploads and settings of the sites you build, and the visitor accounts you create for those sites.
• Usage & technical data — logs and metadata needed to operate, secure and monitor the Service, such as request timestamps and error logs.
• Payment data — when you purchase credits, the transaction is handled by our payment provider. We receive a confirmation of the payment outcome but do not store your full card details.

2. How we use it

We use personal information to provide, maintain, secure and improve the Service; to process credits and billing; to communicate with you (including email verification, password resets and credit-balance alerts); and to comply with legal obligations and enforce our Terms of Service.

3. Cookies & sessions

We use only strictly necessary cookies. We never set advertising or third-party tracking cookies.

• Dashboard session cookie — keeps you signed in to your account on the platform domain.
• Visitor sign-in cookie — set on a published site's own address, and only when a visitor signs in to that site. It is host-only, marked httpOnly and SameSite=Lax, holds the sign-in token for that site, and is used solely to keep the visitor signed in. It is never used for tracking or analytics, and it is cleared when the visitor signs out. Because it is strictly necessary to deliver the sign-in the visitor requested, it is exempt from prior-consent requirements.

4. Analytics on published sites

If a site owner enables analytics, page views on their published site are counted server-side in a privacy-preserving way: our analytics set no cookies and store no raw IP addresses. Unique visitors are estimated using a salted, daily-rotating one-way hash that cannot be reversed to identify an individual. The only cookie that may be set on a published site is the strictly necessary sign-in cookie described in section 3, and only if a visitor signs in.

5. AI & MCP processing

When you connect an AI assistant or other client through the MCP interface, the instructions and tool calls you initiate are processed to operate your sites. Access tokens issued from your account are stored securely and are never exposed to the JavaScript of a published page. You are responsible for the actions performed through tokens you create.

6. Service providers

We rely on third parties to operate the Service — for example hosting infrastructure, an email delivery provider and a payment provider (CHIP). These providers act as processors on our behalf and handle data only as needed to deliver their service to us.

7. Visitor sites & owner responsibility

Websites built by our users are their own content. Any personal data those sites collect from their visitors is controlled by the respective site owner, not by Ozem. If you visit a user-built site, please review that site owner's own notices. The one exception is the strictly necessary sign-in cookie that Ozem sets to operate visitor sign-in, as described in section 3; this is not owner content.

8. Retention

We keep account and content data while your account is active and for as long as needed to provide the Service or comply with legal obligations. Raw analytics events are kept only for a limited window; aggregate daily totals may be retained for longer. If you delete your account, we will remove Your Content and personal data, subject to any legal retention requirements.

9. Your rights under the PDPA

Subject to the PDPA, you have the right to access and request correction of your personal data, to withdraw your consent to its processing, and to limit how it is processed. Please note that withdrawing consent may mean we can no longer provide the Service to you. You can manage or delete your account from your settings, or exercise any of these rights by contacting us at support@ozem.my.

10. Security

We use reasonable technical and organisational measures to protect personal data, including encrypting secrets such as API tokens at rest. However, no system is perfectly secure, and we cannot guarantee the absolute security of your data.

11. Children

The Service is not directed to children under the age required by your local law to consent to the processing of their personal data, and we do not knowingly collect data from them. If you believe we have collected data from a child, please contact us so we can remove it.

12. Changes & contact

We may update this Privacy Policy from time to time; material changes take effect when the updated Policy is posted on this page. The data controller is eWallz Network (Ozem). For questions or requests regarding your personal data, contact us at support@ozem.my.

See also our Terms of Service.