Seed Light Privacy Policy

Seed Light (Seed Light PLT, SSM No. 202504001688, LLP0043191-LGN) is a web design and digital marketing agency based in Bayan Lepas, Pulau Pinang. In this policy, "we" and "us" mean Seed Light PLT, and "you" means anyone who visits our website, contacts us, applies for a job with us, or hires us.

This policy covers:

• This website, https://seed-light.com, and every page on it.
• Our forms, free tools, calculators and free resources.
• Messages you send us by email, WhatsApp or phone, and calls you book through Calendly.
• Job applications sent through our careers pages.
• Applications sent through our freelance partner network page.
• The work we do for clients, and the client contact details we hold to run those projects.

It does not cover other companies' websites we link to, or the social platforms we post on. Those have their own policies, and we do not control them.

We follow Malaysia's Personal Data Protection Act 2010 (PDPA). If you are in the UK or the European Union and would like your request handled under the standards you are used to, say so when you write to us and we will do that.

What you give us

• Messages. Your phone number or email address, and the content of what you send us by WhatsApp, email or phone.
• Calendly bookings. When you book a call, Calendly collects your name, email address, the time you pick and any answers you type into the booking form.
• Job applications. Your name, email address, phone number, where you heard about us, the links you share, the salary you tell us you are looking for, what you write in the message box and the CV file you attach.
• Partner network applications. The partner form stores your contact details, location, skills, services and starting prices, portfolio links and availability in Seed Light's own content system, and also emails those details to partners@seed-light.com. Seed Light uses this information to match people and small agencies with future projects. To ask for your application and its stored details to be deleted, email partners@seed-light.com.
• Free tools. The calculators work entirely in your browser: the numbers you type are not sent to us or stored. We do record which result band you landed in, never the values you typed. The website checkers send the web address you enter to our server, which then fetches that page and, depending on the checker you are using, sends the address or its domain name on to Google PageSpeed Insights for a speed test, to Google and Cloudflare public DNS and to the RDAP domain registry for technical checks, and to Google Places when you check a local listing. The Automation Opportunity Finder sends the answers you choose and anything you type in its free-text box to an AI provider in the United States so it can generate the suggestions. Checker results may remain in a short-lived server cache for up to ten minutes. We do not store the automation finder answers themselves, and we do not use any of these inputs to create an account.
• Client projects. Billing details, the logins and access you give us for your own platforms, and the content you hand over for the work.

What we collect automatically

• Pages you visit, how you got here, roughly how long you stay, what you type into site search, and which links or buttons you click.
• Device and browser type, screen size, language, and an approximate location worked out from your IP address, usually to city level.
• Vercel Web Analytics cookieless page views, plus speed and error measurements, so we can see when a page is slow or broken.

What we do not collect

• We never ask for card numbers or bank credentials on this website. No payment is taken here.
• We do not ask for sensitive personal data such as health, religion or political views, and you should not send it to us.
• The website addresses you type into our free checkers are used to run that report and may remain in a short-lived server cache for up to ten minutes. They are not stored against you. What you type into the automation finder is not saved.

Every use below has a plain reason behind it.

• To reply to you. Answering your message, sending a proposal, and following up if you asked us to.
• To do the work. Running your project, sending invoices, reporting on results and keeping you updated.
• To run the website. Keeping it up, keeping it fast, and stopping spam and abuse.
• To understand what works. Seeing which pages and ads bring people who go on to contact us, so we spend our own marketing budget sensibly.
• To hire. Reviewing your application, arranging interviews and letting you know the outcome.
• To meet our obligations. Keeping the accounting and tax records Malaysian law requires us to keep.

We do not sell your data, we do not rent it, and we do not hand it to data brokers. We do not use your details to make automated decisions about you.

Cookies are small files a website stores in your browser. We use a small number of them, in three groups.

• Needed to run the site. These keep the site working and secure. They cannot be switched off from here.
• Measurement. Google Analytics tells us which pages get read and which lead to a call. Vercel Web Analytics records cookieless page views, and Vercel Speed Insights measures page speed.
• Advertising. The Meta pixel tells us when someone who saw one of our Facebook or Instagram ads later contacted us, and lets us stop showing ads to people who already have.

You can block or delete cookies in your browser settings and manage how Meta uses your activity in Meta's ad settings. This site does not read browser do-not-track or Global Privacy Control signals. Nothing on this site is locked behind cookies, so you keep full access if you block them.

We advertise on Google and on Meta platforms, so we need to know which ads actually bring customers. Two things are worth spelling out.

The Meta pixel. A small script from Meta runs on every page, including careers pages. It records page views, and Meta's automatic events can record button clicks and details about the page. On pages outside careers, we send a Contact event when you click a WhatsApp or phone link, and a Lead event when you complete a Calendly booking. A completed Calendly booking on a careers page sends a CareersContact event instead. On careers pages, we send separate CareersView, CareersContact and JobApplication events. CareersView records the role, CareersContact records the contact channel, including booking, and JobApplication records the role and page only. These separate events let us include or exclude job seekers in Meta audiences without mixing them with customers. The partner network form sends a separate PartnerApplication custom event that records the selected primary role and applicant type only. The pixel also reads Meta's cookies in your browser, including cookies connected with Facebook or Instagram.

Automatic advanced matching. This is switched on. When a button is clicked, the pixel can read details already typed into form fields on that page, including email, name, phone, gender, city, state, postcode, date of birth, country and external ID. It hashes those details in your browser and sends the hashes to Meta. This can include details typed into the job application form on a careers page.

Server-side conversion data. When you complete a Calendly booking on a page outside careers, our server also sends Meta a Lead event. It includes an event ID, the page address, your IP address, browser type and Meta's _fbp and _fbc cookies when they exist. It does not include your email address, phone number or the answers in your booking form.

To limit this tracking, block or delete cookies in your browser, block third-party scripts and use Meta's ad settings. Meta's automatic events can record clicks on any page, so choosing email instead of WhatsApp or phone does not prevent Meta from recording the click. On careers pages, WhatsApp, phone and email clicks are sent as CareersContact events. Google Analytics receives careers_view, careers_whatsapp, careers_phone, careers_email, careers_booking and job_application. None of these is a Google Analytics key event.

We share personal data only with the companies that help us run the business, and only with what they need. Each one is bound by its own contract and privacy terms.

• Website hosting. Serves the pages and keeps security logs.
• Email delivery. Sends us job applications and sends our replies.
• Our content system. Stores job applications and the CV you attach, on a server we control.
• Analytics. Google Analytics for page and conversion measurement, plus Vercel Web Analytics for cookieless page views and Vercel Speed Insights for speed measurement.
• Advertising. Meta, for the ad measurement described above.
• Scheduling. Calendly, the booking tool behind our call calendar.
• Free website checkers. Depending on the checker you run on an address you enter: Google's PageSpeed service for speed and Core Web Vitals, Google and Cloudflare public DNS resolvers and the RDAP domain registry for technical checks, and Google Places for local listing checks.
• Automation Opportunity Finder. An AI provider in the United States, which receives the answers you select and the free-text note you type so it can generate the suggestions.
• Accounting and banking. For invoices and payments on live projects.

We will also share data if a law, a court or a regulator requires it, or to protect our rights, our clients or someone's safety. If the business is ever sold or restructured, records may transfer to the new owner under the same protections.

Some of the providers above run on servers outside Malaysia, mostly in Singapore, the European Union and the United States. That means your data may be stored or processed there.

Before we use a provider we check that it commits to protection at least equal to what the PDPA expects, through its own contract terms and standard data protection clauses. If you have questions about where a provider processes your data, ask before sending it and we will explain the available channels.

• Messages that did not become a project. Up to twenty-four months, then deleted, in case you come back to us.
• Client records. For as long as we work together, then seven years for the accounting and tax records the law requires.
• Job applications and CVs. Twelve months, in case another role opens up, then deleted.
• Analytics records. Up to fourteen months, and they are not tied to your name.
• Free tool and checker inputs. Calculator inputs are not stored. Checker addresses and results may remain in a short-lived server cache for up to ten minutes.

You can ask us to delete your data sooner. See your rights below.

• The whole site is served over an encrypted connection.
• Accounts that hold personal data use two-step verification and unique passwords kept in a password manager.
• CVs are stored so they can only be opened by us, never on a public web address.
• Forms are rate limited and spam trapped, so bots cannot flood them.
• Access is limited to the people who need it to do the work.

No system is perfectly safe, and we cannot promise that. If a breach ever affects your data, we will tell you and the relevant authority as quickly as we can, and explain what happened and what to do.

Under the PDPA you can ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct anything that is wrong or out of date.
• Delete what we hold, where we are not required to keep it.
• Stop using your data for marketing, which we will action right away.
• Withdraw consent you gave earlier. That does not undo anything done before you withdrew it.
• Limit how we process your data where you have a good reason.

Email hello@seed-light.com with the words "data request" in the subject line, and tell us which of the above you want. We may ask one or two questions to confirm it is really you. We reply within 21 days, which is the period the PDPA sets. There is no charge.

Applications go to our careers inbox and are copied into a private list in our own content system. Only Gregory Yeoh and anyone helping with that hire can see them.

Your CV is stored outside the public media library, so it never sits on a web address someone could stumble onto. We keep applications for twelve months in case a suitable role opens, then delete them. Tell us if you would rather we delete yours as soon as the role is filled.

Applying for a job does not put you on any marketing list or count as a sales lead. Meta receives a JobApplication event containing the role and page only, never the form contents. Meta also receives CareersView and CareersContact events so job seekers can be included in or excluded from advertising audiences separately from customers. Automatic advanced matching can hash and send details typed into the form when a button is clicked, as described above. Google Analytics records careers page visits, careers contact clicks, completed careers bookings and job applications, but none of them is a key event. Your CV and application details themselves are still sent only to the careers inbox and private list described above.

When we build or run a website for a client, we often touch data that belongs to that client's customers, such as form submissions, orders or mailing lists. In that situation the client decides what happens to it and we act on their instructions.

We use that access only to do the agreed work, we do not copy it for our own use, and we hand back or remove our access when the project ends. If you are a customer of one of our clients and want your data removed, ask that business directly and we will support them in handling it.

Our services are for businesses, and this site is not aimed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, email hello@seed-light.com and we will delete it.

If you think we have handled your data badly, tell us first. Email hello@seed-light.com and we will look into it and come back to you with what we found.

You also have the right to complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), which oversees the PDPA in Malaysia.

We update this page when the way we work changes, for example when we add or drop a tool. The current version always lives here with the date at the top. If a change materially affects how we use data you already gave us, we will tell the people affected by email.

Seed Light PLT, Imperial Grande, Persiaran Relau, Sungai Ara, 11900 Bayan Lepas, Pulau Pinang, Malaysia.

Email: hello@seed-light.com. Phone: +60 16-411 9138. The person responsible for data protection here is Gregory Yeoh.

Our terms of service cover the rest of the relationship, and you can reach us any time from the contact page.