ScribeWealth — Privacy Notice

To provide you with our service, ScribeWealth ("we", "us") will collect your personal data. We value your trust and are committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 ("PDPA"). This Privacy Notice explains:

• Why we need your personal data and how we collect it;
• How we use your personal data;
• The parties we disclose your personal data to; and
• The choices we offer, including how to access, correct and delete your personal data.

For the purpose of this Privacy Notice, please note that:

• "ScribeWealth" refers to the portfolio-analysis service made available at scribewealth.com (the "Service"). The Service is not yet operated through a registered company; this notice will be updated with our company details once incorporation is complete.
• The Service is intended for investment advisers and other professional users aged 18 and over. It is not directed at children.
• "Personal data" refers to any information that relates directly or indirectly to you. In our case this is principally your email address, the security records generated when you use the Service, and any personal data contained in the holdings files you choose to upload.
• If you upload a file relating to a client of yours, you remain responsible for having the right and any necessary consent to do so. We ask that you identify a portfolio by initials or by a reference rather than by name, so that the identity of your client never needs to enter the Service at all.

By providing your personal data to us, you consent to our processing of your personal data in accordance with this Privacy Notice.

1. Why we need your personal data and how we collect it

In order for us to open and operate an account for you and to provide you with our service, we may need to collect, use, disclose and store the following personal data about you:

• Your email address, and a password which we store only in hashed form — we never hold the password itself;
• Records generated by your use of the Service, including your IP address, your browser identification, and security events such as logins, failed logins and password resets;
• The contents of any investment-holdings file you upload. These are processed only to produce your report and are not retained on our servers once the analysis is complete.

We obtain this information in two ways: directly from you, when you register, upload a file or write to us; and automatically, when you use the Service, through our server records and a single essential cookie that keeps you signed in. We do not use advertising or third-party tracking cookies.

We do not use third-party content delivery networks, web fonts or analytics on this site. Fonts, stylesheets and scripts are served from our own domain, so opening a ScribeWealth page does not disclose your IP address to any other company.

We do not intentionally collect sensitive personal data, and we do not ask you for identification numbers, dates of birth or financial account numbers.

2. How we use your personal data

We may use your personal data for one or more of the following purposes:

• To establish and verify your account, and to keep it secure;
• To provide the analysis, reports and AI-assisted commentary you request;
• To send you service messages, such as email verification, password resets and notices about changes to your account;
• To protect the Service against misuse, to investigate suspected security incidents, and to maintain a security audit record;
• To respond to your enquiries and complaints;
• To improve the accuracy and reliability of the Service, using information that has been aggregated or anonymised so that it does not identify you;
• To meet any obligation imposed on us by law, regulation or an order of court.

We will ask for your consent before using your personal data for a purpose other than those set out in this Privacy Notice. We do not sell your personal data, and we do not use it to send you marketing without your consent.

3. Disclosure of your personal data

As part of providing and operating the Service, we may disclose your personal data, to the extent necessary, to the following parties:

• Service providers, agents or contractors appointed by us to provide services to us, whether inside or outside Malaysia, subject to appropriate security controls over your personal data. These are listed in full below;
• Law enforcement agencies and regulatory bodies, where we are obliged or permitted to do so by law or by an order of court;
• Our professional advisers, where necessary and under a duty of confidentiality;
• Any third party as a result of an acquisition or sale of the business, in which case your personal data would remain subject to a notice of this kind.

We will otherwise treat your personal data as private and confidential and will not disclose it to any other party. We believe you are entitled to know exactly who processes your data, so the full list is published here rather than described in general terms:

Service provider	Purpose	Location
Heroku / Salesforce (incl. Heroku Postgres)	Application hosting and database	United States
Resend	Transactional email	United States
Sentry	Error monitoring (no portfolio data or personal data sent)	United States
Anthropic; OpenAI	AI analysis and chat. Holdings data is sent to generate your report; their API terms exclude using it to train their models.	United States
Financial Modeling Prep; Yahoo Finance	Market and fund data. These receive only ticker symbols — never your name, email or client identifiers.	United States

Because of the providers above, your personal data is transferred to and processed outside Malaysia, principally in the United States. We rely on our contractual arrangements with those providers to secure a comparable standard of protection.

4. Security of your personal data

We place great importance on the security of your personal data. We protect it using encrypted transport (HTTPS), strong password hashing (Argon2id), access controls, rate limiting on sensitive operations, and audit logging. No system is perfectly secure, but we review these measures as the Service changes and work to protect your personal data against loss, misuse and unauthorised access.

5. Retention of personal data

We retain your account data for as long as your account remains open. Files you upload are not retained once the analysis is complete. Security audit records are retained for 12 months and are then deleted automatically. When you delete your account, your account data is erased and any audit records still within the retention period are stripped of anything that identifies you.

6. Access, correction and withdrawal of consent

You have the right to request access to the personal data we hold about you, and to receive a copy of it. You have the right to correct personal data that is inaccurate, incomplete or out of date. You also have the right to withdraw your consent to our processing of your personal data; because the Service cannot operate without processing it, withdrawing consent means closing your account.

You can exercise access, portability and deletion yourself, immediately, from the Account & Data page. You may also write to us at privacy@scribewealth.com. If you believe the personal data we hold about you is inaccurate, incomplete, misleading or outdated, please contact us at that address. You may also lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi).

7. Updates to this Privacy Notice

This Privacy Notice may be revised from time to time. The revised notice will be posted on this page and the date above will change with it. Please review it periodically to stay informed of how we protect your personal data. We will tell registered users about material changes.

Questions about this notice or about your personal data: privacy@scribewealth.com.