Privacy
notice.

Destiny is operated by [LEGAL NAME OF OPERATOR], [REGISTRATION NUMBER IF APPLICABLE], at [BUSINESS ADDRESS], Malaysia. We decide how the personal data described here is used, so we are responsible for it under the Personal Data Protection Act 2010. In this notice, “we”, “us” and “our” mean that operator.

For any privacy question or request, email [CONTACT EMAIL] or call [PHONE NUMBER]. You can also reach us on WhatsApp through the Contact link.

This notice covers people who use the Destiny website and create an account, and people who visit a website published with Destiny. It works together with our Terms and Conditions.

A site published with Destiny belongs to the business that made it. That business decides what its site says and receives the messages its visitors send through its forms, so it is responsible for how it uses them. Section 4 explains what Destiny itself does when someone visits one of these sites.

When you sign up

Your full name, email address, phone number and password. Your password is stored only in a scrambled form that cannot be turned back into the password, so nobody at Destiny can read it. We ask whether you are 18 or older and, if not, for a parent or guardian's permission. We use those answers to let you sign up but do not save them. Your account is created only after you enter the code we email you. If you never enter it, your sign-up details are deleted after one day.

Your plan and payments

Your plan, how many websites you have made today (and, on Ultimate, this month with the best model), your PayPal subscription reference, its status and your payment and renewal dates. PayPal collects your card, bank and PayPal account details on its own pages. Destiny never receives them.

What you create

The messages you type or speak to describe a website, the websites Destiny makes for you, every saved version, the text you change yourself, and the name and address you publish a site under. If you share an Ultimate plan, we keep which accounts share it.

Business details

Anything you choose to enter under Business details: business name, address, phone number, email, opening hours, description, WhatsApp number and whether customers can send booking requests. All of these are optional. They are put on your website, so anyone who visits it can see them once it is published.

Uploads

Photos, videos (paid plans) and HTML files you add. They are kept in your upload space (200 MB on Free, 300 MB on paid plans). When it is full, your oldest uploads are removed to make room. Photos you put on a published site get a web address and can be seen by anyone who visits that site.

Speak button

When you use Speak, your recording is sent to OpenAI to be turned into text and is not kept by Destiny afterwards. Only the text is kept, and only if you send it.

Domains

For a domain you connect, we keep the domain and a check code you add to its settings.

Technical information

Your login cookie (see section 8). To stop people from guessing passwords or sending spam, we briefly keep count of attempts from your IP address and email address in our server's working memory. These counts are never saved in our database and are cleared once they are no longer needed or when the server restarts. Like most websites, our server also keeps short technical logs of requests (IP address, page, time and errors) to keep the service secure and working.

What you must give us

Your name, email address, phone number and password are needed to create an account, and payment through PayPal is needed for a paid plan. Without them we cannot give you an account or that plan. Everything else, including business details and uploads, is your choice.

Contact and booking forms

What a visitor types into a site's contact or booking form is emailed to the site's owner through Brevo. Destiny does not save the message in its database. To stop spam, we briefly count how many messages come from the same IP address, in our server's working memory only.

Visitor numbers

We show site owners how many people visited their site each day. To count each person once a day, we turn the visitor's IP address and browser type into a one-way code using a secret that changes every day. The code is kept only in our server's working memory for that day, and the IP address itself is never stored. Only the daily total is saved, for 90 days. Bots, link previews and the owner's own visits are not counted.

No Destiny cookies

Published sites do not get a Destiny cookie, and Destiny adds no tracking or advertising to them.

Other services on a site

Some sites show stock photos stored by Unsplash or Pexels. A visitor's browser loads those photos from their servers, so those services receive the visitor's IP address in the usual way. WhatsApp buttons take visitors to WhatsApp only when they are tapped, and WhatsApp's own privacy notice then applies.

We use your information only to:

• create your account, confirm your email and keep you logged in;
• build, change, save and publish your websites;
• take payments, turn plans on and off and give refunds;
• send you emails you need: sign-up, password reset and payment codes, messages from your site's forms, and invitations to a shared Ultimate plan;
• keep Destiny secure, stop spam and misuse, and fix problems;
• answer you when you contact us; and
• meet our legal duties, such as keeping business records.

We do not sell your data, show you ads, build advertising profiles or use analytics or tracking tools. We will not send you marketing emails unless you agree to them first.

We share only what each service needs to do its job for us:

• OpenAI, which makes and changes websites: your requests, business details and uploads (including still pictures and spoken words from videos) and Speak recordings.
• PayPal, for plan payments and refunds.
• Brevo, which delivers our emails: your email address and the email's content.
• Unsplash and Pexels, which supply stock photos: a few words from your request to search for photos. No personal details are sent.
• Cloudflare's public DNS service, to check a domain you connect: only the domain name.
• [HOSTING PROVIDER], which runs the server that stores Destiny's data.
• Authorities, such as the police or a court, when the law requires it or to protect people from harm.

Each service has its own privacy terms. We stay responsible for choosing them carefully and using them as this notice says.

Some of these services are based in, or process data in, other countries, including the United States and the European Union. Your information may therefore be handled outside Malaysia. We only use services that protect data to a standard at least similar to Malaysian law, and only send them what they need.

A cookie is a small file a website saves in your browser. Destiny uses one cookie, and only on Destiny's own website:

We do not use analytics, advertising, social media or other tracking cookies, and we don't let other companies set cookies through Destiny. Because our only cookie is strictly necessary, we don't show a cookie banner. If you block cookies for Destiny, you won't be able to log in.

When you go to PayPal to pay, PayPal's pages use their own cookies under PayPal's privacy notice. Sites published with Destiny get no Destiny cookie (see section 4).

• Your account, websites, business details and uploads: until you delete them or your account. Uploads may be removed sooner when your upload space is full.
• Unconfirmed sign-ups: one day.
• Email codes: they stop working after 10 minutes.
• Visitor numbers: 90 days, and deleted when a site is taken offline.
• Payment records: PayPal keeps its own records of your payments. We keep what we need for tax and accounting for as long as the law requires.
• Server logs: up to [30] days.
• Backups: deleted information can stay in our backups for up to [30] days until they are replaced.

You can delete your account at any time on your Account page. This stops your PayPal subscription, and deletes your account, your websites and their versions, your business details, your uploads and photos, your published sites (which go offline), your connected domains and your visitor numbers. Anyone sharing your Ultimate plan loses access to it.

Download any website you want to keep before you delete your account, because it cannot be brought back.

Under Malaysian law you can:

• see the personal data we hold about you and get a copy;
• correct anything that is wrong, out of date or incomplete;
• withdraw your consent or ask us to stop or limit how we use your data, although we may then be unable to keep your account open;
• take your websites with you: you can download them at any time, or ask us for your data in a common format; and
• complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) if you are unhappy with how we handled your data.

You can change your business details, websites and password yourself in Destiny. For anything else, email [CONTACT EMAIL] from your account email. We may ask you to confirm who you are, and we will reply within 21 days.

People under 18 can only use Destiny with a parent or guardian's permission, and a parent or guardian must make or approve any payment. A parent or guardian can contact us to see, correct or delete their child's information. If we learn that an account was created without that permission, we may close it and delete its data.

Passwords and email codes are stored only in scrambled form. Destiny uses a secure (https) connection. Our database cannot be reached from the internet, and every request for your websites and details is checked against your account, so other users cannot see them. Payment details stay with PayPal.

No system is perfectly secure. If a data breach is likely to harm you, we will tell you and the Personal Data Protection Commissioner as the law requires, and explain what we are doing about it.

If Destiny starts collecting or using data in a new way, we will update this notice and the date at the top before we do. If the change is important, we will also tell you by email or in Destiny. If the English and Bahasa Melayu versions of this notice differ, the English version applies. If this notice is ever unclear, ask us at [CONTACT EMAIL].