Jump to section
This document is provided in English.
Alchemist Marketing Sdn. Bhd. (Company Registration No. 202101000044 (1400342-A)) ("Company", "we", "us", or "our") operates AI HUB at aimodelhub.ai and console.aimodelhub.ai (the "Site" and "Service").
This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you access or use our Service. This Policy is issued in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.
By accessing, registering, or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, you must not use the Service. Capitalised terms used but not defined in this Privacy Policy have the meanings given to them in our Terms of Service, which also states this Policy's governing law and dispute-resolution mechanism.
Our Role Under the PDPA
1.1 Controller and Processor. Under the Personal Data Protection Act 2010 (PDPA), Company acts as a Data Controller for account, billing and usage data. Where a business customer processes the personal data of its own end users through the Service, as Inputs and Outputs under the Data Processing Agreement, Company acts as a Data Processor for that data.
1.2 Where This Applies, and the Two Processor Exceptions. This Policy applies to the marketing site at aimodelhub.ai and the console at console.aimodelhub.ai. Company is the controller for the data described in this Policy, except in two situations where the roles reverse and Company acts strictly as processor: comments and profile details of people who engage with your social posts (Section 2.9), and the personal data of your own end users that you, as a business customer, process through the Service, including where you build on the Developer API (Terms of Service, Section 4.5, and the Data Processing Agreement).
1.3 Model Training. Company operates no model training of any kind. Nothing submitted, uploaded, generated, or published through AI HUB is used by Company to train anything, on either the BYOK or the managed path. What happens to a request after it reaches a Model Provider is a matter between you and that provider on BYOK, and between the aggregator described in Section 4.1 and that provider on the managed Hub Key path; Company selects aggregators consistent with a no-training-on-API-data posture but is a customer of theirs, not an auditor of their internal practice, and gives no warranty about it.
What Personal Data We Collect
2.1 Account and Billing Data. Email address, username, authentication credentials (a bcrypt hash of your password if you set one), language preference, and account role. No phone number or postal address is collected. Where your account belongs to an organisation, Company additionally holds that organisation's name, contact email address, and plan, and for each invitation the invited email address, a one-way hash of the invitation token, and the times at which the invitation was issued, accepted, or cancelled.
2.2 Google Sign-In. If you sign in with Google, the sign-in happens on Google's own servers and Google returns four fields: name, email address, Google account ID, and profile picture URL. Nothing else, and never your Google password.
2.3 Keys and Tokens. Model Provider keys are stored encrypted at rest; only the last four characters are kept in clear text to display a masked tail such as sk-…4f2a. The full key is never displayed back to you, never sent to your browser, and never written to logs. Developer API keys are shown once at creation; Company thereafter stores only a one-way SHA-256 hash and a masked tail, so the plaintext can be neither displayed nor recovered. Social connection tokens are stored encrypted, including a refresh token where the platform supports one; Company records the expiry, refreshes automatically where possible, and prompts reconnection rather than acting on a stale token. Section 5 lists the scopes requested per platform.
2.4 Content You Create and Upload. Prompts, model responses, generated images/audio/video, product photographs and cast images uploaded to Ad Studio (Section 2.5), documents uploaded for retrieval, presentation decks together with any document a deck is generated from, long-form video scripts and the individual clips and takes generated for them, the description of your brand you save to Brand DNA, composed posts, and per-call metadata (provider, model, token counts, cost, latency, success). Performance and insights data for content you publish (likes, comments, shares, saves, reach, impressions, profile visits, video views, average watch time, and account-level figures such as follower count) is collected to the extent each platform exposes it. Company stores the styles you save, including their words, input names, settings and up to three kept images, as content you create. If you upload a document to a brand, Company keeps the original file in addition to the extracted text and the numeric representation described in Section 2.15.
2.5 Cast Photographs. We do not run facial recognition or attempt to identify individuals, and we compute and store no biometric template. A photograph placed in an Ad Studio cast slot is stored under a directory scoped to your account; on generation it is sent to the image Model that composes the advertisement frame, reached through the aggregators named in Section 4.1, and the composed frame, not the original photograph, is what reaches the video Model that animates it. An uploaded photograph that no generated item, saved run, or generation job still refers to is deleted automatically seven (7) days after it was uploaded; one that is still referenced is kept until you delete the item referring to it, or until you ask Company to remove it at [email protected]. The Service does not knowingly process personal data of anyone under eighteen (18).
2.6 Billing and Wallet Data. A prepaid US-dollar balance and a ledger of every top-up, per-call charge, and Hermes plan fee. Payment details are entered on Stripe's own encrypted form and go straight to Stripe; Company never sees or stores a full card number, CVV, bank login, or Alipay credential. For a saved card, Company retains only what Stripe returns for display: brand, last four digits, expiry month and year, and a Stripe payment-method reference.
2.7 Technical Data. IP address and browser user agent on your active session, used to keep you signed in and to detect abuse; the IP address and user agent of each acceptance record described in Section 2.8; and IP addresses used transiently to enforce rate limits. IP addresses are not attached to your usage history, your prompts, or your activity log, and no third-party analytics or advertising tracker runs on the console.
2.8 Records of Your Agreement. When you accept the Terms of Service and this Policy, Company writes a record containing your user ID, the action you were taking, the moment of acceptance in Coordinated Universal Time, the version of each document as it then stood, a SHA-256 digest of the exact text of those versions, the display language, and the IP address and browser user agent the acceptance came from. These records are retained for as long as the account exists and afterwards for as long as a claim relating to the agreement could still be brought. They are not combined with your usage data, not used to profile you, and not shared.
2.9 Comments and Third-Party Data. When engagement on a published post is read back, Company also reads and stores the public comments and replies on it: the commenter's display name, platform account ID, profile picture URL, comment text, like count, timestamp, and the raw platform response. Those commenters are not Company's customers; for that data, you are the controller and Company is the processor, per Section 1.2. Comments and metrics are deleted when you delete the post they belong to; disconnecting a social account does not delete them, because disconnection stops further access but does not erase publishing history. If a commenter asks to be removed, delete the comment on the platform and the post from AI HUB, or email [email protected] to have the stored copy purged.
2.10 Hermes Managed Agents. Provisioning a Hermes agent causes Company to process: the agent's instructions, AI provider, Model, and enabled tools or skills ("configuration"); the token or session data required to send and receive on a connected messaging channel, encrypted at rest ("channel credentials"); and the messages the agent exchanges, the tasks it performs, and operational metrics used to meter your wallet ("runtime data"). Each agent's data, including its conversation history and any files it handles, is deleted when you delete the agent.
2.11 The Public Playground. Company does not store a Playground prompt or its reply; it stores one metered usage row per call against an internal demo account, containing no prompt text and nothing that identifies you. Your IP address is used only to enforce the request limits stated in the Terms of Service and lives in a short-lived rate-limit cache, not a database table. Because there is no account, there is no way for Company to act on an access or deletion request about a Playground prompt.
2.12 Security Measures. Provider API keys, social platform tokens, and Hermes channel credentials are encrypted at rest, decrypted in memory only for the duration of a request you initiated, and never returned to your browser beyond a masked tail. Developer API keys are stored as a one-way SHA-256 hash only, and account passwords as bcrypt hashes. Hermes agents run in isolated per-customer containers with default-deny network egress, described fully in Terms of Service Section 7.2. Payments are handled entirely by Stripe, a PCI-DSS-compliant gateway; card, bank, and Alipay details never reach Company's servers. Two things Company wants you to know rather than have you assume: two-factor authentication is not yet offered on password-based accounts, and media URLs described in Section 6 are unauthenticated by design and should be treated as secrets. Report a vulnerability in good faith to [email protected].
2.13 Public Name and Community. Company assigns every account a public name ("handle") when the account is created, and shows it only once that account publishes a style. If you publish a style to Community, Company shows your handle to each user of the Service, together with the published style's name, tagline, words, cover image and kept images. Company does not show your real name, email address or account identifier. Company also records your agreement to publish, as Section 2.8 describes, together with the version of the style you agreed to share; the result of the automated check on each version, being a pass or a refusal and its reason; and counts of the people who used and copied your style, which only you can see. The automated check sends the style's words and pictures to a Model through the aggregators named in Section 4, in the same way as any other request. The check reports whether a person appears in a kept image; under Section 2.5, Company runs no facial recognition and does not identify that person.
2.14 Reports. When you report a style, Company stores your account identifier, the style and version you reported, the reason you chose, any details you wrote, and when and how Company resolved the report. Company tells the creator of a hidden style the reason for hiding it and does not tell the creator who reported it. Company keeps the reports on a style after its creator unpublishes it, so that unpublishing and republishing a style does not clear its reports.
2.15 Brand Knowledge Documents. If you upload a document to a brand so that Chat can answer questions grounded in it, Company stores the original file, the text extracted from it, and a numeric representation of that text ("embedding") used to find the relevant part of the document when you ask a question. The text is sent to an AI embedding provider to produce the embedding, in the same way as any other request described in Section 4. Consistent with Section 1.3, none of this file, text, or embedding is used to train any model. The file, the extracted text, and the embeddings are not reviewed by Company except where you request support involving the document or where the law requires it. Company keeps the file, the extracted text, and the embeddings until you delete the document, delete the brand it belongs to, or close your account, at which point all three are deleted together.
How We Use Your Data
We use your personal data for providing and operating the Service, processing payments, authenticating your identity, responding to your inquiries, and complying with legal obligations. We do not sell your personal data or use your Inputs or Outputs to train our own models, consistent with Section 1.3.
Data Sharing and Cross-Border Transfers
We share data with third parties only as necessary to provide the Service:
- MyTokenGate and ATP, the inference aggregators behind the managed Hub Key. Every managed prompt, image, audio, or video request reaches its Model through one of them, along with any attached file.
- The Model Providers themselves (OpenAI, Anthropic, Google, DeepSeek, MiniMax, and ByteDance among others, depending on the Model selected) receive the prompt and any attached files.
- ATP also receives the text of documents uploaded for retrieval, in chunks, on the managed path only, and returns a numeric embedding of each chunk. On BYOK, documents go to your own provider for this purpose.
- Stripe processes every payment and receives your name, email address, and the payment details entered on its own form.
- Resend delivers transactional email and receives your email address and the content of each message sent to you.
- Meta (Facebook, Instagram, Threads), TikTok, and Google (sign-in and YouTube) receive the posts, captions, and media published through the Service, plus the OAuth context their APIs require, and return the metrics and comments described in Section 5.
- Hosting, database, and object-storage providers hold data at rest and process it only on Company's instruction.
- Messaging platforms connected to a Hermes agent (which may include WhatsApp, Telegram, Discord, Slack, Matrix, Mattermost, Weixin (WeChat), email, IRC, or ntfy) receive that agent's messages. You supply the credential and choose the destination.
- Google Fonts (Google LLC) receives the IP address and browser details of each visitor whose browser fetches the fonts that the pages of the Service use, as Section 9.4 describes.
You can contact each recipient above about your personal data through Company's privacy contact in Section 12.
Your data may be transferred to recipients located outside Malaysia in compliance with applicable laws; none of the recipients above is located in Malaysia, so using the Service means your Inputs, uploaded files, cast photographs, and published content routinely cross international borders to reach them. Company asks every user for separate consent to that transfer when the account is created or when an updated version of this Policy is accepted, and records that consent. Company does not sell personal data and does not share it with advertisers, data brokers, or analytics networks.
Publicly Addressable Media
Media uploaded or generated through the Service is served from publicly accessible URLs of the form https://…/media/…. This is required for social media platforms: Instagram, Facebook, Threads, and TikTok publish by fetching a URL from their own servers, not by accepting an upload from Company, and a login-protected URL would make publishing impossible. What protects the file is its name: every stored file is given a random forty (40) character filename at the moment of upload or generation, unrelated to its contents, your account, or anything guessable, and the route returns a 404 for any name that does not exist. This is a secret held in a URL, not an access control. You should treat a media URL like a password and not share it with unauthorised persons; you may delete any media file through the console. This applies to generated images, audio and video, uploaded product photographs and cast photographs, social media attached to a post, and documents uploaded for retrieval.
Data Retention
We retain your personal data only as long as necessary for the purposes set out in this Policy, or as required by applicable laws. Certain billing and transaction records may be retained for up to seven (7) years under Malaysian law, specifically Section 82 of the Income Tax Act 1967 and the AMLA 2001.
Automatic Schedules. Six categories of data are purged on a schedule. Everything else is retained until you delete it or Company closes your account under Section 8.
- An uploaded image that no generated item, saved run, or generation job still refers to is deleted seven (7) days after it was uploaded, and a format run that was never saved and cost nothing is deleted one (1) day after it was started.
- A document uploaded for a presentation deck that no deck refers to is deleted seven (7) days after it was uploaded.
- Developer API request records, being the endpoint called, the Model requested, the status, the latency, and the token counts, and never the content of a request or its reply, are deleted after ninety (90) days.
- A stopped Hermes agent has its container and data reclaimed thirty (30) days after being paused, with warning emails at day seven (7) and day twenty-five (25). The configuration record survives, so the agent can be redeployed.
- A closed account is purged on day thirty (30) after the closure request, as Section 8 describes.
- A "Download my data" archive is deleted seven (7) days after it was created.
Community. Company keeps your handle for as long as your account exists, and keeps check results and reports for as long as the style they relate to exists, and afterwards for as long as a claim relating to that style could still be brought, except that the reports and appeals you filed, and the check results of your own styles, are deleted when your account is closed. When your account is closed, your published styles leave Community; copies other users saved before then are their content and stay in their accounts, as Terms of Service Section 6.10 describes.
Brand Knowledge. A document you upload to a brand, its extracted text, and its embeddings are kept until you delete the document, delete the brand, or close your account. Deleting any of the three deletes all three for that document; nothing here is purged on a schedule.
Your Rights
Under the PDPA, you have the right to access and correct your personal data, to withdraw your consent, to prevent processing that is likely to cause you damage or distress, and to prevent processing for the purposes of direct marketing (PDPA sections 42 and 43). You can also have your personal data deleted by closing your account, as described below. To exercise these rights, contact us at [email protected]. We will respond in accordance with applicable law. You may change your handle on your account page once every thirty (30) days. Company retires the handle you leave behind and does not make it available to any other account.
Download your data. You can request a copy of your personal data from the Account page with the "Download my data" button. Company prepares the data as JSON files in a ZIP archive, with stored media listed as links, and emails a link to the address on the account. The link is valid for seven (7) days and works only while the account owner is signed in. One request can be made every twenty-four (24) hours. This function answers a request for access to your personal data. If you ask Company to transmit your personal data directly to another data controller, contact the privacy contact in Section 12, and Company will transmit it where that is technically feasible and the data format is compatible.
Most of this is self-service: disconnect a social account from the Connections tab to revoke its token and delete the stored credential immediately; revoke a BYOK or Developer API key from the console, effective at once; delete a Hermes agent to destroy its container, memory, documents, and channel credentials; and delete conversations, generated media, uploaded documents, and social posts directly. You can also close the account itself from the Account page, by typing the email address of the account to confirm. Closure starts a grace period of thirty (30) days. During that period you can cancel the closure. Console features, Developer API keys, Hub Keys and Hermes agent renewals are paused, and scheduled social posts do not publish. Company emails a reminder before the grace period ends. On day thirty (30) after the closure request, Company deletes your content, uploaded files, connected social accounts, API keys, Hermes agents (under the Hermes rules in Terms of Service Section 7.2), Brand and Company knowledge, the styles of yours that no other user has saved, and the style reports and appeals you filed, and removes your name, email address and other identifying details from the account record, which Company keeps only as the reference for the records retained under Section 7. Your published styles leave Community; copies that other users saved keep working, as Terms of Service Section 6.10 describes. If a deletion step cannot be completed that day, Company retries it daily until it is completed. Wallet ledger entries, top-up records, invoices, receipts, usage records, Hermes refund requests, the Stripe customer reference, and the card brand, last four digits and expiry date kept with the billing records are retained under Section 7 for up to seven (7) years where the law requires it. The acceptance records described in Section 2.8 are retained for the period stated there. None of these records is used for any purpose of Company's after closure. Deleted data may remain in the backups held by Company's hosting provider for a limited period, until those backups are replaced in the ordinary course. Any remaining Credit balance is forfeited on closure under Terms of Service Section 3.3. Organisation and administrative accounts are closed by email to [email protected] from the address on the account. If you are unhappy with how a request was handled, you may complain to the Personal Data Protection Department of Malaysia under the Personal Data Protection Act 2010.
Users in Indonesia
10.1 Applicable Law. If you use the Service from Indonesia, Law No. 27 of 2022 on Personal Data Protection ("UU PDP") also applies to Company's processing of your personal data, alongside the Malaysian PDPA described in this Policy.
10.2 Your Rights. Under UU PDP, you have the right to obtain information about the processing of your personal data, to access it and obtain a copy, to correct it, to have it deleted or destroyed, to withdraw your consent, and to receive your data in a portable format. You can use "Download my data" and the closure process in Section 8 for access, portability and deletion. For any other request, contact the privacy contact in Section 12. A request for access, correction or the withdrawal of consent that is sent to the privacy contact in Section 12 is handled within three times twenty-four (3 x 24) hours of receipt, as UU PDP requires. This is separate from the self-service account closure in Section 8, which deletes data after a 30-day grace period.
10.3 Cross-Border Transfer. Company and the recipients named in Section 4 are located outside Indonesia. Company asks for your consent to the transfer of your personal data to those recipients to provide the Service when you create your account or accept an updated version of this Policy, and records that consent, as UU PDP Articles 22 and 56(4) require. You can withdraw that consent by sending a request to the privacy contact in Section 12, or by closing your account as Section 8 describes. After the consent is withdrawn, Company can no longer provide the Service to you.
Users in Mainland China
11.1 Applicable Law. If you use the Service from mainland China, the Personal Information Protection Law of the People's Republic of China ("PIPL") also applies to Company's processing of your personal information.
11.2 Separate Consent to Cross-Border Transfer. Company processes personal information outside mainland China. If you use the Service from mainland China, the separate consent to that transfer is the consent that Company asks every user for at sign-up, and again when an updated version of this Policy is accepted, as Section 4 describes. The recipients are the providers listed in Section 4, and the purpose is to provide the Service you request. The information involved is described in Section 2. You can withdraw your consent by closing your account, after which Company can no longer provide the Service to you. Withdrawing consent does not affect processing that took place before the withdrawal. Section 4 describes the recipients by category, with the purpose of each transfer and the personal information it involves. A full list of recipients with their contact details is available from the privacy contact in Section 12 on request. You may exercise your rights under PIPL against a recipient through the privacy contact in Section 12.
11.3 Your Rights. Under PIPL, you have the right to know about and decide on the processing of your personal information, to access and obtain a copy of it, to correct or complete it, to have it deleted, and to withdraw your consent. You can use "Download my data" and the closure process in Section 8. For any other request, contact the privacy contact in Section 12.
11.4 Representative in Mainland China. Company will designate a representative in mainland China as PIPL Article 53 requires, and will publish the representative's contact details in this Section.
Contact Us
Privacy contact. Company's privacy contact receives every request and question under this Policy, including access, correction, deletion, withdrawal of consent, and complaints, at [email protected].
For questions regarding this Privacy Policy or your personal data:
Alchemist Marketing Sdn. Bhd. (Company Registration No. 202101000044 (1400342-A))
Block C-38-2 (Second Floor), Zenith Corporate Park,
1, Jalan SS 7/26, SS7, 47301 Petaling Jaya, Selangor, Malaysia.
Email: [email protected]
Want to manage your data? Disconnect accounts, revoke keys and export or delete your information from your account.
Email our privacy teamUpdates to This Policy
We may update this Privacy Policy from time to time. The Effective Date at the top of this page indicates when it was last revised, and Terms of Service Section 12 states how notice of a material change is given. Continued use of the Service after that notice period constitutes acceptance.
Disclaimer
THE SERVICE IS PROVIDED "AS IS". TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WE DISCLAIM ALL WARRANTIES AND LIMIT OUR LIABILITY AS SET FORTH IN OUR TERMS OF SERVICE.
Social Platform Permissions
Social connections use OAuth: you authenticate on the platform's own page, and Company never sees, receives, or stores your username, password, or login credential for it. Permissions requested are limited to what publishing and insights require:
pages_show_list,pages_manage_posts,pages_read_engagement,business_management, andpublic_profile. Company stores the Page ID, name, and the Meta-issued tokens.instagram_business_basic,instagram_business_content_publish, andinstagram_business_manage_insights. Instagram's API offers no delete endpoint, so Company cannot delete an Instagram post on your behalf.threads_basic,threads_content_publish,threads_manage_insights,threads_read_replies, andthreads_delete. Meta has approved all five, so deleting a Threads post through the Service is available to you.user.info.basic,user.info.stats,video.upload,video.publish, andvideo.list. Company stores your TikTok open ID, display name, and the TikTok-issued token, never your TikTok login.youtube.uploadandyoutube.readonlyonly. Company stores your channel ID, title, and the Google-issued tokens.All five platforms are open to every customer. Meta has approved every permission listed above for Facebook Pages, Instagram, and Threads, and TikTok has approved Company's application including direct publication to your account. We read insights only on your own content and the public comments on your own posts, never read private or direct messages, and never use social data for advertising or profiling.