This Privacy Policy (“Policy”) explains how LEXUP, a platform owned and operated by YV Management Sdn Bhd (202201031032 (1476729-T)) (“Company”, “we”, “us”, or “our”), collects, uses, discloses, and safeguards personal data when you use our transcription, translation, and related services (the “Services”). It is intended to describe our practices under Malaysia’s Personal Data Protection Act 2010 (PDPA). Where we rely on consent, you may withdraw it subject to applicable law and contractual restrictions; we may also process data where necessary to perform a contract, comply with law, or pursue legitimate operational interests permitted by law.
1. Information We Collect
In the course of providing the Services, we may collect the following categories of personal data:
Account and Identity Data: Name, email address, phone number, company name, and billing address.
Payment and Billing Data: Transaction status, amount, order reference, billing/contact details, and payment method metadata. DOKU receives the payment and contact data entered at its hosted checkout. LEXUP does not receive or store card numbers or card security codes.
Source Content Data: Audio files, video files, text documents, and any personal information inherently spoken, depicted, or written within the Source Content you upload for processing.
Technical and Usage Data: IP addresses, browser types, device identifiers, log data, and cookies gathered automatically when you interact with our platform.
2. Purpose of Data Processing
We process your personal data strictly for the following commercial purposes:
To fulfil our contractual obligations, including automated Services and separately contracted, human-delivered Manual Services.
To process payments and issue invoicing.
To communicate with you regarding order status, technical issues, or customer support.
To comply with applicable legal, regulatory, or accounting requirements.
For security, fraud prevention, service reliability, and support.
To improve the platform using operational or de-identified telemetry. LEXUP does not use Customer Content to train models or for LEXUP’s internal product or model improvement. Our paid API providers’ terms state that API content is not used to train their models.
3. Disclosure and Sharing of Personal Data
We do not sell your personal data. We disclose information only as needed for the purposes above, including to:
Automated Service Providers: Cloud hosting, storage, AI processing, email delivery, monitoring, and other vendors supporting the automated Services.
DOKU: Our hosted payment processor, which receives payment and contact data. LEXUP receives payment confirmation and limited billing/transaction details, but no card details.
Authorised Access: The automated pipeline has no routine human review. Limited authorised LEXUP staff may access Customer Content only when reasonably necessary for customer-requested support, security or fraud investigation, legal compliance, or a specific quality hold. Separately contracted Manual Services are performed by human specialists subject to confidentiality obligations.
Anti-Bot Protection: We use Cloudflare Turnstile, an invisible background check, to protect our upload, conversion, and payment features from automated abuse. It runs without puzzles or tracking cookies and processes limited browser and network signals solely to distinguish genuine visitors from bots; your files and documents are never shared with Cloudflare. Details of the limited data Cloudflare processes on our behalf are set out in the Cloudflare Turnstile Privacy Policy.
Legal Authorities: Government bodies, law enforcement, or regulatory agencies when required by Malaysian law, court order, or subpoena to protect the rights, property, or safety of the Company or others.
4. Data Security
We implement commercially reasonable administrative, technical, and physical security measures to protect your personal data and Source Content against unauthorized access, alteration, disclosure, or destruction. However, no data transmission over the internet or electronic storage system is completely secure; therefore, we cannot guarantee absolute security and you upload Source Content at your own risk.
5. Data Retention
For automated Services, uploaded files and generated Outputs are permanently deleted from our servers and cloud storage within 24 hours of the order. They are not archived as a substitute for deletion. Separately, we retain limited order, billing, transaction, consent, security, support, and legal records for the periods reasonably necessary for accounting, fraud prevention, dispute handling, enforcement, and applicable legal obligations. Those records do not include the deleted files or Outputs unless preservation is required by law or you separately provide material to support a dispute or support request.
6. International Data Transfers
Your personal data and Source Content may be transferred to, and maintained on, servers or databases located outside of Malaysia (such as global cloud infrastructure). By using the Services, you explicitly consent to the cross-border transfer of your data, provided that the Company ensures the receiving jurisdiction offers a standard of protection comparable to the PDPA.
7. Your Rights Under the PDPA
Subject to applicable Malaysian law, you possess the right to:
Request access to the personal data we hold about you.
Request correction of inaccurate, incomplete, or outdated personal data.
Withdraw your consent to our processing of your personal data (subject to contractual or legal restrictions), noting that withdrawal may prevent us from providing the Services.
8. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
YV Management Sdn Bhd (202201031032 (1476729-T)) (LEXUP)
Operating/contact address: Room 32, WORQ TTDI, Lot3A-01A, Level 3A, Glo Damansara Shopping Mall, 699, Jln Damansara, Taman Tun Dr Ismail, 60000 Kuala Lumpur
