What we collect, and what we don't.

CERAP (cerap.ai) is operated by Samajaya Marketing Sdn Bhd, a company registered in Malaysia. We are the data controller for your personal data under the Personal Data Protection Act 2010 (PDPA).

We collect the minimum needed to run the service. Specifically:

• Account data — if you sign up, we collect your email address and any name you choose. Authentication is handled by Supabase; your password is never stored in plain text.
• Saves and follows — if you save a Story or follow a politician, we store that association so we can show it back to you across devices.
• Contact submissions — messages you send via the contact form, including the email you provide.
• Analytics — anonymised page views and Core Web Vitals (page load performance) via Vercel Analytics and Speed Insights. These do not identify you personally and no cookies are set for this purpose.

We do not collect browsing history from other sites, we do not fingerprint devices, and we do not sell any of your data.

We process your personal data under the following legal grounds: performance of a contract (running your account and its features), your consent (analytics, marketing communications you opt into), and legitimate interests (measuring aggregate performance, preventing abuse). You may withdraw consent for consent-based processing at any time.

We use a small number of trusted service providers to run CERAP. Each processes personal data only on our instructions:

• Supabase — accounts + authentication.
• Sanity — content management (does not receive your personal data).
• Vercel — hosting, Analytics, and Speed Insights.
• Sentry — error monitoring. If an error occurs while you are using the site, technical details are captured to help us fix it. Session replays are sampled at 10% of error events and mask no sensitive fields.
• Anthropic — the AI drafting model used by our editorial team. Only editorial content is processed by Anthropic; your personal data is not sent to Anthropic.

We keep account data for as long as your account exists. If you delete your account, we remove your personal data within 30 days, except where retention is required for legal, tax, or audit purposes. Contact submissions are retained for two years so we can respond to follow-ups, then deleted.

Under the Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate personal data.
• Withdraw consent for consent-based processing, or object to legitimate-interest processing.
• Request deletion of your account and associated personal data.

To exercise any of these rights, please contact us and select "Data request" as the subject. We will respond within 21 days.

CERAP uses minimal cookies: a session cookie for account authentication (only if you sign in), and preference cookies for language selection. We do not use advertising or tracking cookies. Vercel Analytics is cookieless.

Some of our processors (Vercel, Supabase, Sentry, Anthropic) host or process data in servers outside Malaysia, including the United States. When we transfer personal data internationally, we rely on the processor's standard data protection agreements and, where applicable, the safeguards required under PDPA.

CERAP is intended for readers aged 16 and above. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy; the "Last updated" date at the top will reflect any change. Substantive changes will be highlighted for a reasonable period. For any privacy question — including access and deletion requests — please contact the editorial team. Our Terms of Service cover the broader use of the service.