Privacy Policy

Effective Date: 26 September 2026 | Last Updated: 26 September 2026 | Notice version 2026-09-26

1. Introduction

Pryonex ("we", "us", or "our") operates the website and application at https://pryonex.ai (the "Service"). This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data in compliance with the Malaysian Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024.

By accessing or using our Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use the Service.

2. Data Controller

The data controller responsible for your personal data is:

Pryonex
Email: theebbanraj@pryonex.ai
Website: https://pryonex.ai

3. What Personal Data We Collect

3.1 Data You Provide Directly

• Account Information: Your name, email address, and Google account details when you sign up via Google OAuth.
• Agent Profile Data: Your business information, agency details, and preferences configured in your profile settings.
• Lead Data: Names, phone numbers, email addresses, and other contact details of your insurance leads that you enter into the Service.
• AI Base Context: Background information you provide to personalise AI-generated messages (e.g., your specialisation, communication style).
• Voice Notes (optional): If you choose to record a voice note about a lead, audio is captured only while you are recording. It is sent for transcription and then discarded — Pryonex does not store your audio. You review and edit the resulting text before anything is saved.
• Feedback and Communications: Any messages, feedback, or support requests you send to us.

3.2 Data Collected Automatically

• Usage Data: Pages visited, features used, timestamps, and interaction patterns within the Service.
• Device Data: Browser type, operating system, screen resolution, and device identifiers.
• Log Data: IP addresses, access times, and error logs generated during your use of the Service.

3.3 Data from Third-Party Services

When you sign in using Google OAuth, we receive your Google profile information (name, email, and profile picture) as authorised by your Google account permissions.

3.4 AI Voice Personalization

To make your AI-generated messages sound more like you, Pryonex stores up to 20 recent text entries you write inside the app — specifically, your context-journal notes and the reasons you provide when changing lead status. These entries are used solely to personalize your AI output and are never shared with other agents, used to train external AI models, or processed by third parties. Email addresses and phone numbers are filtered from these entries before storage. You can request deletion of your personalization samples at any time by contacting support.

3.5 Enquiries and Founding Interest (Visitors Without an Account)

You do not need an account to contact Pryonex. When you send an enquiry from the website, or register your interest in the founding release of Pryonex App, what you submit is stored so that a person can read it and reply to you.

• Enquiry: your name, email address, organisation (optional), phone number (optional), the description of the problem you write, the reply language you choose, the page you submitted from, the version of this notice you were shown, and the time of submission.
• Founding interest: your name, email address, phone number (optional), the range of leads you manage (optional), the language you were reading in, the version of this notice you were shown, and the time of submission.
• Attribution code: if you arrived through a link carrying a short campaign code, that code is stored with your submission, but only if it is a code we issued and still use. It is an opaque code that identifies the CHANNEL you arrived through, not you. Only Pryonex holds the mapping from a code to the channel it stands for.
• What is not stored: your IP address is not stored on any enquiry or founding-interest record. It is used only in memory, at the moment of submission, to limit how often one connection may submit.

Purpose. To read your enquiry, decide whether Pryonex can contribute, and reply to you in the language you chose. These records are not used for advertising, are not sold, and are not shared with any other party.

Who reads it. The founder reads submissions in full, one at a time, in the Pryonex administration area. Replying to you is not possible any other way. Access is restricted to the named Pryonex administrator addresses.

Notification.When a submission arrives, a notification is sent to Pryonex, on the founder's own email address and devices. That notification carries no name, no email address, no phone number and none of your enquiry text: it states only that a submission of a given type was received. Submitting does not by itself cause any message to be sent to you.

To ask what is held about you, to correct it, or to have it deleted, write to theebbanraj@pryonex.ai. That is the same address used for every other right described in Section 15.

4. Purpose of Processing

We process your personal data for the following purposes:

• Service Delivery: To provide, maintain, and improve the Pryonex platform, including lead management, AI-powered message generation, follow-up scheduling, and calendar booking features.
• AI Message Generation: To generate personalised follow-up messages for your insurance leads using artificial intelligence. Your lead data and AI base context are processed to produce these messages.
• Account Management: To create and manage your account, authenticate your identity, and provide customer support.
• Analytics and Improvement: To understand how the Service is used and to improve its features, performance, and user experience.
• Communication: To send you service-related notifications, updates, and support responses.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

5. Legal Basis for Processing

Under the PDPA, we process your personal data based on:

• Consent: You provide consent when you create an account and use the Service. You may withdraw consent at any time (see Section 15).
• Consent, for visitors who hold no account: if you send an enquiry or register founding interest, you hold no account and no service agreement exists, so neither of the two bases below describes you. The basis is your consent: you consent when you tick the box and press Send. The version of this notice that was on screen at that moment is recorded with your submission. You may withdraw that consent at any time by writing to theebbanraj@pryonex.ai, and the record will be deleted.
• Contractual Necessity: Processing is necessary to fulfil the service agreement between you and Pryonex.
• Legitimate Interest: Processing is necessary for our legitimate interests in improving the Service, provided these interests do not override your data protection rights.

6. Third-Party Data Sharing and Cross-Border Transfers

We share personal data with the following categories of third-party service providers. Some of these providers are located outside Malaysia, which constitutes cross-border data transfer under Section 129 of the PDPA.

We have conducted a Transfer Impact Assessment (TIA) for cross-border transfers in accordance with the Cross-Border Personal Data Transfer Guidelines. We ensure that all third-party providers maintain appropriate data protection standards equivalent to those required under the PDPA.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

7. AI-Generated Content Disclaimer

Pryonex uses artificial intelligence (specifically, the OpenAI API) to generate suggested follow-up messages for your insurance leads. Important points regarding AI-generated content:

• AI-generated messages are suggestions only — you are responsible for reviewing, editing, and approving all messages before sending them to your leads.
• AI-generated messages do not constitute financial advice, insurance advice, or any form of professional advisory.
• Lead data is sent to OpenAI's API for processing. OpenAI's data usage policy applies. We send the minimum data necessary for message generation.
• If you record a voice note, the audio is sent to OpenAI's transcription API (/v1/audio/transcriptions). Pryonex does not attach the agent's account details or separate lead-record identifiers to the transcription request. The recording may contain information spoken by the agent. OpenAI does not use API inputs or outputs to train its models by default unless the customer explicitly opts in. OpenAI's current published data-controls table lists no abuse-monitoring retention and no application-state retention for the /v1/audio/transcriptions endpoint. Pryonex does not permanently store the audio, and you review and edit the transcript before it is saved.
• We do not store AI-generated content beyond what is needed for the Service's functionality.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

• Account Data: Retained for the duration of your active account plus 30 days after account deletion.
• Lead Data: Retained for as long as your account is active. Archived leads are soft-deleted and permanently purged 90 days after archiving.
• Usage and Log Data: Retained for up to 12 months for analytics and troubleshooting purposes.
• AI Interaction Data: Retained for up to 30 days for service quality monitoring, then deleted.
• Enquiries and Founding Interest, unconverted: Retained for 12 months after your last submission or the last time we worked on your record, then deleted as described in the next item. A repeated submission of an address we already hold does not extend this period. Each record carries a one-way fingerprint of the submission that created it; the fingerprint is kept with the record and erased with it. When a submission also carries a reference from your browser, we keep that reference with a one-way fingerprint for 30 days so that a repeated or conflicting use of it can be recognised, then delete it.
• What deletion means for an enquiry or founding interest: when a record is deleted, whether at your request, by us, or at the end of its retention period, it is taken out of use immediately and any notification about it that has not yet been sent is cancelled. Thirty days later the record, its notification records and its internal history are permanently erased. We keep a separate note that a record with a given internal reference was deleted, with its dates only and never its content, for 90 days after erasure. Our database provider keeps restore copies for a limited period, so an erased record can remain in those copies until they expire. We never restore a copy to bring back an erased record. If we ever have to restore one for another reason, the restored copy is held: nothing in it is changed, contacted or notified until every deletion recorded since the copy was taken has been re-applied and checked. If that record of deletions could not be recovered, the restored enquiry and founding-interest records would stay held. If you register again after deletion, a new record is created from your new submission only; the earlier record stays deleted and is erased on its own schedule.
• Notification Attempt Records: Retained for 30 days after the notification is delivered or given up, then deleted. They record whether a notification to Pryonex was attempted and whether it succeeded, never what it was about.
• Won or Activated Records: When an enquiry becomes an engagement, or a founding-interest record becomes an account, the record is kept as part of that engagement or account for as long as it lasts, and is no longer deleted automatically after 12 months. We review these records at least once a year and delete what is no longer needed.
• Payment Records (future): Retained for 7 years as required by Malaysian tax regulations.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• All data in transit is encrypted using TLS/HTTPS.
• Database access is restricted and protected by authentication credentials.
• Application authentication is managed via secure OAuth 2.0 protocols.
• Agent data is isolated — each agent can only access their own leads and data.
• We conduct regular security reviews and apply security patches promptly.
• Access to production systems is restricted to authorised personnel only.

10. Your Data is Yours Alone

Your client data is isolated at the database level. No other agent — not even other Pryonex users — can see your leads, messages, bookings, or any of your information.

Every query in Pryonex filters by your unique agent ID. This is enforced at the code level across every single feature. It is technically impossible for Agent A to access Agent B's data through the application.

Pryonex administrators do not browse your leads, your messages, your bookings or your client details. Those are isolated per agent as described above, and the administration area reports them only as system health data and aggregated statistics.

Two things are readable individually by the founder, and it would be wrong to describe them as aggregate. Enquiries and founding-interest submissions are read in full, one at a time, in the administration area, because replying to the person who wrote them is not possible otherwise. Audit entries record which administrative action was taken, by whom, on which record, and are readable per record. Access to both is restricted to the named Pryonex administrator addresses.

11. We Never Share Your Data

We will never sell, rent, share, or expose your client data to other agents, insurance companies, or any third party.

Your leads are yours. Your conversations are yours. Your pipeline is yours.

If you leave Pryonex, you can export all your data before deleting your account. Nothing is held hostage.

12. How We Protect Your Data

• All data is transmitted over encrypted connections (HTTPS/TLS).
• Your data is stored in a secured PostgreSQL database hosted in Singapore (AWS ap-southeast-1) — your data stays in the region.
• Agent data isolation is enforced at the application layer on every database query — this is Law 3 of our development constitution, verified by automated tests on every code change.
• In the event of a data breach, exposed records are associated with internal system IDs, not your name or identity. We follow PDPA's 72-hour breach notification requirement.

13. Data Ownership & Export

You own your data. Pryonex is a data processor, not a data owner. We process your data only to provide the service you signed up for.

You can export all your data at any time via Settings (coming soon) or by contacting theebbanraj@pryonex.ai.

You can request deletion of all your data at any time. We will comply within 21 days, which is the same period stated in Section 15 for responding to any request under the PDPA. An earlier version of this notice said 14 days here and 21 days in Section 15; one period now applies to every request.

14. What We Use Data For

We use aggregated, anonymized usage patterns (for example, how often a feature is used across all agents, with no individual shown) to improve the product. These statistics contain no individual names, phone numbers, or client details.

We never access your individual client records for marketing, sales, or any purpose other than providing the Pryonex service to you.

AI message generation sends lead context to OpenAI (US-based) for processing. This is disclosed in the "Cross-Border Transfers" section. OpenAI does not store or train on your data under our API agreement.

15. Your Rights Under the PDPA

Under the Malaysian PDPA, you have the following rights:

• Right of Access: You may request access to the personal data we hold about you.
• Right to Correction: You may request that we correct any inaccurate or incomplete personal data.
• Right to Withdraw Consent: You may withdraw your consent to the processing of your personal data at any time. This may affect your ability to use the Service.
• Right to Prevent Processing: You may request that we stop processing your personal data if such processing causes or is likely to cause substantial damage or distress.
• Right to Prevent Direct Marketing: You may opt out of receiving marketing communications at any time.
• Right to Data Portability: You may request a copy of your personal data in a structured, commonly used format (as introduced by the PDPA Amendment 2024).

To exercise any of these rights, please contact us at theebbanraj@pryonex.ai. We will respond to your request within 21 days as required by the PDPA.

16. Data Breach Notification

In the event of a personal data breach that causes or is likely to cause significant harm, we will:

• Notify the Personal Data Protection Commissioner within 72 hours of becoming aware of the breach.
• Notify affected individuals as soon as practicable with details of the breach and recommended protective measures.
• Maintain a breach register documenting all incidents, their scope, and remedial actions taken.

17. Cookies and Tracking Technologies

Pryonex uses essential cookies necessary for the operation of the Service (e.g., session management, authentication tokens). We do not use third-party advertising or tracking cookies. You may configure your browser to reject cookies, but this may impair the functionality of the Service.

Two mechanisms on the public website are worth naming separately, because they are not cookies and are easy to mistake for them:

• Attribution code. If you arrive through a link carrying a short campaign code, that code is kept in your browser's sessionStorage for the visit and is discarded when you close the tab. It is not a cookie, it is not attached to any other request, and it does not persist across visits.
• Vercel Web Analytics. Page and event counts for the public website are collected without a cookie. The query string is removed before any page address is recorded, so an attribution code is never stored inside a recorded URL. No profile is built and no identifier is stored on your device.

18. Children's Data

The Service is designed for use by insurance agents who are adults. We do not knowingly collect personal data from children under 18 years of age. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service with a new effective date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

20. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Pryonex
Email: theebbanraj@pryonex.ai
Website: https://pryonex.ai