Privacy Policy

Last updated: 7 November 2026

This policy explains what personal data HalusAI collects, why, who receives it, how long we keep it and how you can use your rights. It is written in plain English. A short notice in Bahasa Malaysia is at the end: Notis PDPA.

1. Who we are

HalusAI is a writing tool run from Malaysia by Halus App, Level 4, PAM Centre 99L, Jalan Tandok, Bangsar, 59100 Kuala Lumpur. In this policy, "HalusAI", "we" and "us" mean that business. We decide how the personal data described here is used, and Malaysia's Personal Data Protection Act 2010 (PDPA) applies to it.

Questions about privacy go to support@halus.app.

2. What we collect

• Account details. Your email address, your sign-in sessions, your word balances, purchases and plan, the language we write your emails in (English, or Bahasa Malaysia if you signed up from the Malaysian page), and whether you agreed to tips and offers by email, with the date and the wording you agreed to. Your own account has a password that you choose. We keep only a hashed form of it (scrypt), never the password itself. An account opened with a personal invite link, or from a DuitNow QR order page, has no email address: you open it with that invite link or from that order page. A shared login, which we set up so a group can use one email address and password, keeps only a hashed form of its password.
• Your texts and results. Every text you paste or upload, its results, every version the model wrote and the versions you pick. See job records below.
• Usage events. Records of actions in the service, such as signing in or starting a run. They store a hashed form of your IP address, never the raw address.
• Wrong passwords. When a wrong password is typed for an email address, we count it against a keyed hash of that address (never the address itself or the password typed), so signing in to that account can pause for 15 minutes after 10 wrong tries. The count is deleted within a day.
• Shared logins. If you sign in to a shared login, we keep a sign-in session for your browser and, with each text you send, a hashed form of your network (IP) address, never the raw address. We use them to apply the login's limits per browser and per network, and to show each browser only its own texts.
• Payment records. What you bought, when, the amount and currency, and the payment's status, which we receive from Stripe. Stripe also tells us the country that issued a card, because the RM price depends on it (see Payments). We never see your card number.
• DuitNow QR orders and receipts. If you pay for a pass or a plan month by DuitNow QR, the order, the receipt you upload, the bank transaction ID if we ask you to type it, and the details read from the receipt. See DuitNow QR receipts below.
• Messages to support. If you email or message us, we keep the conversation so we can answer you and sort out the issue.

Giving your email address and choosing a password are required to have an account. Without them we cannot provide the service. Tips and offers by email are optional. The exception is an account opened with a personal invite link, or from a DuitNow QR order page: it has no email address or password. To pay by DuitNow QR, uploading the receipt is required. Without it we cannot confirm the payment, and no words are added. What you write into your texts is your choice.

3. Job records: your texts and results

• Where. In a store only the owner of HalusAI can access.
• Why. To run the service, to handle support (for example, to look into a result you report) and to improve HalusAI.
• For how long. 365 days from each run. Then they are deleted automatically.
• Where you are told. The page that takes your text says so too.

If you delete your account

• A plan, if you have one, is cancelled first. Your account details (email address, hashed password, sessions and word balances) are removed.
• The texts and results you sent are kept, without any link to you, until their 365 days end. Then they are deleted automatically.
• Payment and accounting records are kept for 7 years, as Malaysian law requires.

A text can still contain personal details you wrote into it, such as a name or a student number, even after it is no longer linked to your account. Do not paste personal data you don't want kept.

4. DuitNow QR receipts

While that option is shown, passes, and one month of a plan, can be paid by DuitNow QR in the app. To confirm the payment, you upload a screenshot of the receipt in the app (or on the order page, for an order made before 7 November 2026).

• What a receipt shows. The screenshot usually shows the payer's name, bank, transaction reference, date, time and amount, and it may show part of an account number. That is personal data.
• What you may cover. You may cover anything we don't need, such as your balance, as long as the amount, date, time, reference and recipient stay readable.
• Why. To confirm the payment, to prevent a receipt being reused and other fraud, and to keep accounting records.
• Who sees it. An AI service provider reads the screenshot for us, through OpenRouter, so the payment can be checked automatically. It receives the image only, never your name, email or order, and processes it under its own terms. The owner of HalusAI sees it when a check needs a person. It is stored on our server in Singapore and is never sent by email or chat. When a receipt is uploaded, the owner gets a Telegram alert with only the order's reference code, the pass or plan, the amount, whether it was approved automatically, whether the buyer is new or already had an account, and how many orders are waiting. The alert never contains the receipt, your name or the order page link.
• What we read from it. We keep the details read from the receipt (amount, recipient, date, time, transaction reference) with the order, so the payment can be checked and a receipt cannot be used twice.
• For how long. Receipts of approved payments, including approvals we later cancel, are kept with the payment and accounting records for 7 years, as Malaysian law requires. Receipts of orders that were not approved are deleted 30 days after that decision. After that we keep only a fingerprint of the file (a hash, from which the receipt cannot be rebuilt) and the bank transaction reference, so the same receipt cannot be used again.
• Also on the order. We keep a hashed form of the IP address and device on the order and on each receipt, and delete it after 90 days, as we do for other usage events. The order's record itself (its reference code, pass, amount, status and times) is kept with the payment records.

If you have an order page from before 7 November 2026, keep its link private: it is the key to your order and your pass.

5. How we use your data

• To run the service: rewrite your texts, show you the results, sign you in and keep your word balance.
• To take payments: through Stripe, or by DuitNow QR with a receipt checked automatically, sometimes by our team, and to keep the payment and accounting records the law requires.
• To give support: answer questions, look into problems and handle refunds.
• To prevent abuse: enforce limits, stop account sharing, refuse texts that try to manipulate the system, and stop a payment receipt being reused.
• To improve HalusAI: for example, by studying where rewrites go wrong so the next version does better.
• To email you: codes and links to verify your email when you create an account and to reset your password, a note if someone asks to create an account with your email address when you already have one, a welcome email, and messages about your passes (a receipt, a note when half your words are left, a note about 24 hours before a pass ends, and one when it has ended). We send these to every account. Tips and offers (a few tips after you sign up, and a note after a pass has ended) go only to accounts that ticked "Send me tips and offers by email". The box is unticked until you tick it. Each of these emails has an unsubscribe link that works in one click, and you can switch them off in your account at any time.

We do not sell personal data, and we do not use it for advertising. By creating an account and using HalusAI, you consent to the processing described in this policy. You can withdraw that consent at any time (see your rights).

6. Who receives your data

We share data only with the kinds of providers HalusAI needs in order to work:

• AI model providers, which process your text to produce the rewrites. They act under their own terms, which may include keeping the text for a short period for abuse monitoring. Where we can choose, we do not allow them to use it for training.
• Stripe, our payment processor, which handles payments and card details. Stripe keeps its own records under its own privacy policy.
• An AI service provider (through OpenRouter), which reads DuitNow QR receipt screenshots so payments can be checked automatically. It receives the image only.
• Our bank, which receives DuitNow QR payments and sends their refunds by bank transfer. We do not send it the receipts you upload.
• Telegram, which delivers the owner's alerts about new DuitNow QR receipts. An alert carries only the order's reference code, the pass or plan, the amount, whether it was approved automatically, whether the buyer is new or already had an account, and how many orders are waiting. It never carries the receipt, your name or the order page link.
• Our email provider, which delivers the codes and links to verify your email or reset your password, and the other emails we send you (about your passes, and tips and offers if you agreed).
• Our hosting provider, whose servers in Singapore run HalusAI and store its data.

We may also disclose data to the authorities where the law requires it.

7. Transfers outside Malaysia

Because of the providers above, your data is transferred outside Malaysia: our servers are in Singapore, and the AI model providers, the AI service that reads receipts, Stripe, Telegram and our email provider may process data in other countries. By using HalusAI, you consent to these transfers. We send each provider only what it needs for its part of the service.

8. Cookies and local storage

• Cookies: essential only. A session cookie keeps you signed in, and a short-lived cookie is used while you create an account or reset your password. HalusAI does not work without them.
• Local storage in your browser. It keeps the draft you paste on the home page for up to 1 hour, so it survives the sign-in step: the app takes it when you open it, and an older one is removed the next time you open HalusAI in that browser. It also keeps your preferences. This stays on your device.
• No analytics or advertising cookies. That is why there is no cookie banner.

You can clear cookies and local storage in your browser settings at any time. Clearing cookies signs you out.

9. How long we keep data

10. Your rights

Under the PDPA you can:

• Access the personal data we hold about you.
• Correct data that is wrong or out of date, including your email address.
• Export a copy of your data.
• Delete your account. What is removed and what is kept is set out under job records.
• Withdraw consent to our processing. We then stop processing your data, except the records the law requires us to keep. Without that processing we cannot run the service for you, so withdrawing consent means closing your account.

How: use the Account page, or email support@halus.app from your account's email address so we can confirm the request is yours. An account opened with a personal invite link, or from a DuitNow QR order page, has no email address: for such an account, email us from any address with your DuitNow QR order's reference code. We may ask for your receipt to confirm the request is yours. We answer as soon as we can, within the time the PDPA allows. If you are not satisfied with our answer, you can complain to Malaysia's Personal Data Protection Commissioner.

11. Security

• The site uses an encrypted connection (HTTPS).
• Your password is stored only as a scrypt hash, never in plain text, and is never shown, logged or sent by email. After 10 wrong passwords for one account in 15 minutes, signing in to it pauses for 15 minutes. Use a password you use nowhere else, and keep your email account secure: anyone who can read your email can reset your password. Codes and links to verify your email or reset your password work once, for 15 minutes. An account opened with a personal invite link, or from a DuitNow QR order page, has no email address: its key is that invite link or the order page's link, so keep that link private.
• A shared login's password is known to everyone in its group. Each browser sees only its own texts, but a browser left signed in shows its past texts to the next person, so sign out when you finish on a shared computer.
• Card details go to Stripe. HalusAI never sees card numbers.
• Job records sit in a store only the owner can access. IP addresses are stored only in hashed form.
• DuitNow QR receipts are stored on our server in Singapore, with access for the owner only. They are sent only to the AI service that reads them, never by email or chat.
• Never send card details to us by email or chat. We never ask for an online-banking password, TAC or OTP.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

12. Children

HalusAI is not directed at children under 13, and they should not use it. To pay, you must be 18 or older, or have a parent's or guardian's consent. If you believe a child under 13 has given us personal data, contact us and we will remove the account.

13. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make a significant change to how we use your data, we will tell you by email or on the site before it takes effect.

14. Contact

• Business: Halus App
• Address: Level 4, PAM Centre 99L, Jalan Tandok, Bangsar, 59100 Kuala Lumpur
• Email: support@halus.app
• Phone / WhatsApp: 012-200 5500
• Support hours: Monday to Friday, 10:00-18:00 Malaysia time (GMT+8)