Privacy Policy

Last updated: 25 July 2026

WebX builds and hosts websites for Malaysian businesses. To do that, we handle some of your personal data. This policy explains what we collect, why, how long we keep it, and what your rights are under Malaysia's Personal Data Protection Act 2010 (PDPA).

We have tried to write this in plain language. If anything is unclear, email us at michael@webx.my.

1. Who we are

WebX is operated by Pixl Digital (002880290-P), a business registered in Malaysia. For anything in this policy, contact:

• Email: michael@webx.my

Pixl Digital is the data user (the party responsible for your personal data) under the PDPA.

2. What this policy covers

• The WebX website (webx.my) and its pages.
• The WebX customer app, where you sign in, fill in your website details, and request changes.
• Websites we build and host for customers, but only the parts we run: hosting and visitor statistics. The content on a customer's website belongs to that customer (see section 10).

3. What we collect, and when

When you create an account. Your name and email address. If you sign in with Google, we receive your basic Google profile (name, email, profile photo). If you use an email sign-in link, we only need your email. We never store passwords. There are none.

When you fill in your website details. Information about your business: what it does, your contact details, opening hours, the pages you want, and any text you write. Also the files you upload: logo, photos, and similar. If you use the "take the content from my existing website" option, we collect the publicly available content from the website address you give us.

When you pay. Payments are handled by payment providers such as Stripe. Your card number goes to them, not to us. We never see or store full card numbers. We keep the order records: what you bought, when, for how much, and the payment status.

When you contact us or request changes. The messages and change requests you send us, so we can act on them and keep a history for your site.

Visitors to customer websites. Websites we host use a self-hosted, cookieless analytics tool (Umami) running on our own server. It counts visits and page views in aggregate. It sets no cookies and builds no visitor profiles, which is why customer sites carry no cookie consent banner. There is nothing to consent to. Site owners see these statistics in their dashboard and renewal emails.

Visitors to webx.my. Our own website uses the same cookieless analytics. No cookies, no tracking, no consent banner needed. The customer app uses a session cookie to keep you signed in. That is its only job.

4. What we use your data for

• Building your website. Your business details, text, and photos are what the site is made from.
• Hosting and maintaining your website, and carrying out the changes you request.
• Generating your site. WebX sites are built by an automated AI pipeline with layered quality checks. Your website details and photos are processed by our AI provider (Anthropic) as part of the build.
• Billing: charging for your subscription and add-ons, sending receipts, and reminding you before renewal.
• Service emails: sign-in links, "your site is live" notices, change confirmations, renewal and expiry notices.
• Marketing emails, only if you agreed (see section 5).
• Keeping the service safe: preventing abuse, screening uploads, and keeping records where the law requires.

We do not sell your personal data. We do not share it with anyone except the service providers in section 7, and only so they can do their jobs for us.

5. Consent and marketing

Most of the processing above is needed to deliver what you bought. We cannot build and host your website without your business details.

Marketing is different. At signup there is a marketing consent checkbox. Tick it and we may send you news and offers. Leave it unticked and we won't. You can opt out at any time: every marketing email has an unsubscribe link, or just email michael@webx.my. Opting out never affects your service or the emails needed to run it (receipts, renewal notices, and the like).

6. How long we keep your data

We keep uploaded files only as long as we need them to do the work. In your dashboard, you can see every file we currently hold, its automatic deletion date, and a delete-now button.

Note the distinction: your original uploads are deleted within days, but the processed images used on your live site are part of your website's data and stay for as long as your site does.

7. Where your data goes

We use a small number of service providers. Some of them process data outside Malaysia:

• Cloudflare, hosts and delivers websites (hosting, CDN, security).
• Anthropic, the AI that generates your website from your details and photos.
• Stripe, card payments. Stripe holds your card details; we never do.
• Google, sign-in with Google, if you choose it.

Each provider only receives what it needs for its role, under its own security and privacy commitments. By using WebX, you consent to this transfer and processing outside Malaysia where it is needed to deliver the service.

8. Your rights under the PDPA

You have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or out of date.
• Withdraw consent to processing, including marketing consent, at any time.
• Limit processing of your data as the PDPA provides.

To exercise any of these, email michael@webx.my from the email address on your account, and tell us what you want done. We will respond within the timeframes the PDPA sets. If you withdraw consent for data we need to run your website, we may not be able to keep providing the service. We will tell you before anything is affected.

Much of this you can do yourself: your website details are editable in your account, and the file dashboard lets you delete uploaded files instantly.

9. Security

• No passwords exist on WebX. Sign-in is by Google or a one-time email link, so there is no password to steal.
• Connections to our sites and app are encrypted (HTTPS).
• Uploaded files are checked and re-encoded before use, and identifying metadata (such as photo EXIF data) is stripped.
• Access to customer data is restricted, and the systems that hold it are hardened and backed up.
• We keep files only as long as needed. The shortest retention is the best protection.

No system is perfectly secure, but we keep the amount of data we hold small and its lifespan short.

10. Data on customer websites

Customer websites display information the customer chose to publish: their business name, phone number, address, and similar. The customer is responsible for what they publish. WebX's role is hosting it and providing the cookieless visitor statistics described in section 3. Customer sites carry no forms, so they collect no visitor data themselves.

11. Changes to this policy

If we change this policy, the new version appears on this page with a new "last updated" date. If a change meaningfully affects how we handle your data, we will tell you by email first.

12. Contact

Questions, requests, or complaints about your personal data:

Pixl Digital (002880290-P) Email: michael@webx.my WhatsApp: Message us on WhatsApp

For formal PDPA requests (access, correction, withdrawal), please use email from the address on your account, so we can verify it is really you.

If you are not satisfied with our response, you may complain to the Personal Data Protection Department (JPDP) of Malaysia.