Seed Light Privacy Policy

Seed Light (Seed Light PLT, SSM No. 202504001688, LLP0043191-LGN) is a web design and digital marketing agency based in Bayan Lepas, Pulau Pinang. In this policy, "we" and "us" mean Seed Light PLT, and "you" means anyone who visits our website, contacts us, applies for a job with us, or hires us.

This policy covers:

• This website, https://seed-light.com, and every page on it.
• Our forms, free tools, calculators and free resources.
• Messages you send us by email, WhatsApp, phone or our contact form.
• Job applications sent through our careers pages.
• The work we do for clients, and the client contact details we hold to run those projects.

It does not cover other companies' websites we link to, or the social platforms we post on. Those have their own policies, and we do not control them.

We follow Malaysia's Personal Data Protection Act 2010 (PDPA). If you are in the UK or the European Union and would like your request handled under the standards you are used to, say so when you write to us and we will do that.

What you give us

• Contact form and messages. Your name, email address, phone number, business name, website address, the service you are after, the budget range you pick and whatever you write in the message box.
• WhatsApp, email and calls. Your phone number or email address, and the content of what you send us.
• Bookings. When you book a call, our scheduling provider collects your name, email address, the time you pick and any answers you type into the booking form.
• Job applications. Your name, email address, phone number, the links you share, the salary you tell us you are looking for, what you write in the message box and the CV file you attach.
• Free tools. The calculators work entirely in your browser: the numbers you type are not sent to us or stored. We do record which result band you landed in, never the values you typed. The website checkers send the web address you enter to our server, which then fetches that page and, depending on the checker you are using, sends the address or its domain name on to Google PageSpeed Insights for a speed test, to Google and Cloudflare public DNS and to the RDAP domain registry for technical checks, and to Google Places when you check a local listing. The Automation Opportunity Finder sends the answers you choose to an AI provider in the United States so it can generate the suggestions. We do not store the answers or the addresses you check, and we do not use them to create an account.
• Client projects. Billing details, the logins and access you give us for your own platforms, and the content you hand over for the work.

What we collect automatically

• Pages you visit, how you got here, roughly how long you stay and which links or buttons you click.
• Device and browser type, screen size, language, and an approximate location worked out from your IP address, usually to city level.
• Speed and error measurements, so we can see when a page is slow or broken.

What we do not collect

• We never ask for card numbers or bank credentials on this website. No payment is taken here.
• We do not ask for sensitive personal data such as health, religion or political views, and you should not send it to us.
• The website addresses you type into our free checkers are used to run that one report and are not stored against you. What you type into the automation finder is not saved either.

Every use below has a plain reason behind it.

• To reply to you. Answering your message, sending a proposal, and following up if you asked us to.
• To do the work. Running your project, sending invoices, reporting on results and keeping you updated.
• To run the website. Keeping it up, keeping it fast, and stopping spam and abuse.
• To understand what works. Seeing which pages and ads bring people who go on to contact us, so we spend our own marketing budget sensibly.
• To hire. Reviewing your application, arranging interviews and letting you know the outcome.
• To meet our obligations. Keeping the accounting and tax records Malaysian law requires us to keep.

We do not sell your data, we do not rent it, and we do not hand it to data brokers. We do not use your details to make automated decisions about you.

Cookies are small files a website stores in your browser. We use a small number of them, in three groups.

• Needed to run the site. These keep the site working and secure. They cannot be switched off from here.
• Measurement. Google Analytics tells us which pages get read and which lead to a call. Our hosting provider also measures page speed without using cookies at all.
• Advertising. The Meta pixel tells us when someone who saw one of our Facebook or Instagram ads later contacted us, and lets us stop showing ads to people who already have.

You can block or delete cookies in your browser settings, and you can turn on your browser's do-not-track option. Nothing on this site is locked behind cookies, so you keep full access either way. Blocking them only means our numbers miss your visit.

We advertise on Google and on Meta platforms, so we need to know which ads actually bring customers. Two things are worth spelling out.

The Meta pixel. A small script from Meta runs on our pages and records that a visit or a form submission happened. It also reads the Meta cookies already in your browser if you use Facebook or Instagram.

Server-side conversion data. When you send the contact form, we also tell Meta that a lead came in. Your email address and phone number are scrambled into an unreadable code on our server before they are sent, using a one-way method that cannot be reversed back into your details. Meta uses it only to match the lead to an ad click. Your IP address and browser type go with it, which is how that matching works.

If you would rather not be counted this way, block third-party scripts in your browser or use Meta's own ad settings, then reach us by email, WhatsApp or phone instead of the form.

We share personal data only with the companies that help us run the business, and only with what they need. Each one is bound by its own contract and privacy terms.

• Website hosting. Serves the pages and keeps security logs.
• Email delivery. Sends us your form submission and sends our replies.
• Our content system. Stores job applications and the CV you attach, on a server we control.
• Analytics. Google Analytics, for page and conversion measurement.
• Advertising. Meta, for the ad measurement described above.
• Scheduling. The booking tool behind our call calendar.
• Free website checkers.Depending on the checker you run on an address you enter: Google's PageSpeed service for speed and Core Web Vitals, Google and Cloudflare public DNS resolvers and the RDAP domain registry for technical checks, and Google Places for local listing checks.
• Automation Opportunity Finder. An AI provider in the United States, which receives the answers you select so it can generate the suggestions.
• Accounting and banking. For invoices and payments on live projects.

We will also share data if a law, a court or a regulator requires it, or to protect our rights, our clients or someone's safety. If the business is ever sold or restructured, records may transfer to the new owner under the same protections.

Some of the providers above run on servers outside Malaysia, mostly in Singapore, the European Union and the United States. That means your data may be stored or processed there.

Before we use a provider we check that it commits to protection at least equal to what the PDPA expects, through its own contract terms and standard data protection clauses. If you would rather your details did not leave the country, tell us and we will handle your request by email or phone only.

• Messages that did not become a project. Up to twenty-four months, then deleted, in case you come back to us.
• Client records. For as long as we work together, then seven years for the accounting and tax records the law requires.
• Job applications and CVs. Twelve months, in case another role opens up, then deleted.
• Analytics records. Up to fourteen months, and they are not tied to your name.
• Free tool and checker inputs. Not stored once the report is shown.

You can ask us to delete your data sooner. See your rights below.

• The whole site is served over an encrypted connection.
• Accounts that hold personal data use two-step verification and unique passwords kept in a password manager.
• CVs are stored so they can only be opened by us, never on a public web address.
• Forms are rate limited and spam trapped, so bots cannot flood them.
• Access is limited to the people who need it to do the work.

No system is perfectly safe, and we cannot promise that. If a breach ever affects your data, we will tell you and the relevant authority as quickly as we can, and explain what happened and what to do.

Under the PDPA you can ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct anything that is wrong or out of date.
• Delete what we hold, where we are not required to keep it.
• Stop using your data for marketing, which we will action right away.
• Withdraw consent you gave earlier. That does not undo anything done before you withdrew it.
• Limit how we process your data where you have a good reason.

Email hello@seed-light.comwith the words "data request" in the subject line, and tell us which of the above you want. We may ask one or two questions to confirm it is really you. We reply within 21 days, which is the period the PDPA sets. There is no charge.

Applications go to our careers inbox and are copied into a private list in our own content system. Only Gregory Yeoh and anyone helping with that hire can see them.

Your CV is stored outside the public media library, so it never sits on a web address someone could stumble onto. We keep applications for twelve months in case a suitable role opens, then delete them. Tell us if you would rather we delete yours as soon as the role is filled.

Applying for a job does not put you on any marketing list, and a job application is never treated as a sales lead or passed to any advertising platform.

When we build or run a website for a client, we often touch data that belongs to that client's customers, such as form submissions, orders or mailing lists. In that situation the client decides what happens to it and we act on their instructions.

We use that access only to do the agreed work, we do not copy it for our own use, and we hand back or remove our access when the project ends. If you are a customer of one of our clients and want your data removed, ask that business directly and we will support them in handling it.

Our services are for businesses, and this site is not aimed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, email hello@seed-light.com and we will delete it.

If you think we have handled your data badly, tell us first. Email hello@seed-light.com and we will look into it and come back to you with what we found.

You also have the right to complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), which oversees the PDPA in Malaysia.

We update this page when the way we work changes, for example when we add or drop a tool. The current version always lives here with the date at the top. If a change materially affects how we use data you already gave us, we will tell the people affected by email.

Seed Light PLT, Imperial Grande, Persiaran Relau, Sungai Ara, 11900 Bayan Lepas, Pulau Pinang, Malaysia.

Email: hello@seed-light.com. Phone: +60 16-411 9138. The person responsible for data protection here is Gregory Yeoh.

Our terms of service cover the rest of the relationship, and you can reach us any time from the contact page.