Privacy Policy

Last updated: October 2026

1. Overview & Zero-Retention Architecture

Tenkei Labs PLT ("Tenkei", "we", "our", or "us") operates on a strict Zero-Retention Architecture for sensitive identity documents and corporate compliance texts. Customer uploaded source files—including SSM corporate profiles, MyKad scans, passports, CDD/UBO forms, and confidential draft board minutes—are processed transiently in volatile memory purely for extraction, AML screening, or statutory review, and are instantly purged upon completion.

Note: Generated PDF compliance certificates and audit review memos are provided exclusively via direct web download and are not transmitted or stored via email. System emails are restricted strictly to account verification and automated corporate tax invoice delivery following workspace credit top-ups.

2. Information We Collect

Account Information: Registered email address, user ID, and credit balance records.
Audit Logs & Metadata: Timestamps, jurisdiction settings, screening query inputs (names or entities checked), statutory clause citations, match confidence scores, and action IDs required for compliance audit trails.
Billing & Corporate Tax Data: Company/billing name, registered business address, SSM registration number, Tax ID/SST number, billing contact email, transaction history, and payment confirmation tokens. We do not store full credit card numbers or banking passwords.

3. Compliance with PDPA & Regional Data Protection

We comply with the Malaysian Personal Data Protection Act 2010 (PDPA) and applicable regional privacy standards. Because source identity documents and draft board minutes are purged immediately after processing, data retention risks are minimized by design.

4. Data Sharing & Third-Party Sub-processors

Compliance queries and document texts are transmitted securely via encrypted channels (TLS 1.3) to external third-party infrastructure for database cross-referencing and statutory reasoning analysis. Data is processed strictly to perform the requested lookup or review and is never sold, rented, or used for public AI training.

We utilize third-party sub-processors under the following functional categories:

Service / Sub-processor Category	Purpose / Function	Data Location
Anthropic (Claude API)	AI Document Parsing, Statutory Reasoning & Entity Resolution Analysis	United States
Transactional Email Delivery	Account Authentication Verification & Automated Corporate Tax Invoice Delivery	United States / Global
Web Hosting & Edge Infrastructure	Application Hosting & Serverless API Routing	Singapore / Global Edge
Cloud Database & Authentication Infrastructure	Encrypted Cloud Database Storage, Auth & Audit Logging	Singapore
Global Watchlist & Sanctions Feeds	Sanctions, PEP & Watchlist Database Matching	EU / US
Licensed Payment Processing Gateways	Payment Settlement, Card Authorization & Tax Invoicing	Malaysia / Global

5. Contact Information

For privacy inquiries or data access requests under PDPA, contact our Compliance Officer at [email protected].