Privacy Policy

1. Introduction

SPM Online (“we”, “our”, or “us”) operates the website https://spmonline.com.my and its companion mobile application (collectively, the “Service”). This Privacy Policy explains how we collect, use, and safeguard personal information when you use our Service. By using the Service, you agree to the terms described here.

2. Information We Collect

a. Information you provide

• Name and email address when you register an account
• Password (stored as a one-way bcrypt hash — we never see your plaintext password)
• Payment information processed securely via Stripe (we do not store card details)
• Answers, scores, and progress data from practice exams you complete

b. Information collected automatically

• Device identifiers and operating system version (mobile app only, for crash reporting)
• Log data such as IP address, browser type, and pages visited
• Session tokens stored securely on your device

3. How We Use Your Information

• To create and manage your account
• To provide access to exam content and track your learning progress
• To process subscription payments and issue receipts
• To send important service notifications (e.g., subscription renewal reminders)
• To improve the platform and diagnose technical issues
• To comply with legal obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Data Sharing

We share your data only with the following service providers, strictly to operate the Service:

• Stripe — payment processing (subject to Stripe's own privacy policy)
• Resend — transactional email delivery
• Hosting provider — server infrastructure for spmonline.com.my

All providers are contractually bound to process your data only as instructed by us and in accordance with applicable data protection law.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal data is permanently removed within 30 days, except where retention is required by law (e.g., financial records). Exam results may be anonymised and retained for aggregate analytics.

6. Cookies

The website uses strictly necessary cookies to maintain your login session (NextAuth session cookie). No third-party advertising or tracking cookies are set. The mobile app uses device-local secure storage instead of cookies.

7. Children's Privacy

SPM Online is intended for students aged 13 and above (Malaysian Form 1–5 students). We do not knowingly collect personal data from children under 13. If you believe a child under 13 has registered, please contact us and we will delete the account promptly.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data via your profile settings
• Delete your account (in-app under Profile → Delete Account)
• Object to or restrict processing in certain circumstances

To exercise any right, email us at info@spmonline.com.my.

9. Security

We use industry-standard security measures including HTTPS, bcrypt password hashing, and short-lived JWT tokens with rotation. No method of transmission over the internet is 100% secure; we strive to protect your data but cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email of material changes. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us: