Privacy Policy
Candidate privacy notice prepared for prospective publication on 22 October 2026; this source copy does not establish production publication.
This candidate explains the application data paths and preserves existing privacy-request, deletion and material-notice commitments. Provider locations, specific retention periods and several operational details remain under verification; this is not represented as a complete publication-ready notice.
Who We Are
BursaEdge is a market information and analytical tools platform for Bursa Malaysia, operated by Muhamad Somad Albasit Bin Muhibin. Edge Digital Enterprise is identified as the seller for purchases under this candidate policy; see the seller contact details in the footer. This policy explains how we collect, use, and protect your personal data when you use our platform.
What We Collect
We collect data needed to operate the service and the features you choose to use:
- Account data — email address, account identifier, account name, username and avatar where present, subscription tier, account status, and related account metadata.
- Google sign-in — if you choose Google sign-in, the production identity service uses Google's OAuth2 flow to create or authenticate an account. Its observed mapping stores Google's username in the account username field; no explicit name or avatar mapping is configured. No additional provider-specific scopes were recorded; this does not establish Google's default scopes or every provider-returned or stored field.
- Password — stored as a one-way cryptographic hash; we never store it in plain text and cannot retrieve it.
- Journal data — information you enter into the trading Journal, which may include stock codes, buy/sell transaction details, price, quantity, trade date, notes, screenshots, process outcomes, and related review data.
- Saved screener data — saved scan names, selected scan sources, filter rules, alert preferences, scan history references, and related screening configuration.
- Telegram integration data — if you connect Telegram, we store the Telegram chat identifier required to deliver alerts and may store the Telegram username supplied by Telegram.
- Usage and analytics data — when product analytics is configured, page/feature events may be associated with your account identifier, email address and subscription tier so we can understand usage and troubleshoot the service. These are identifiable events, not anonymous statistics.
- Error-monitoring data — when error monitoring is configured, technical diagnostics may include your account identifier and email address to help diagnose account-specific failures.
- Device metadata — browser type, operating system, screen size, and similar technical information collected for compatibility, analytics, and error-monitoring purposes.
We do not ask you to send full payment-card details, banking passwords or OTPs to BursaEdge. Payment entry is handled by the processor's hosted checkout.
How We Use Your Data
- Deliver and maintain the BursaEdge platform and your account.
- Store and display the Journal, saved scans, screening preferences, and other data you create in the platform.
- Deliver Telegram alerts when you connect Telegram and enable alerts.
- Send transactional emails — account confirmation, invite, password reset, waitlist, billing, and service notices.
- Measure product usage, diagnose bugs, prevent abuse, and improve platform performance.
- Manage customer-initiated purchases, billing records, corrections and refunds when paid billing is available; we do not charge you automatically for renewals.
- Meet our legal and compliance obligations under Malaysian law.
What We Do Not Do
- We do not sell, rent, or trade your personal information to any third party.
- We do not use your data to build advertising profiles or share it with advertising networks.
- We do not send unsolicited marketing without your consent.
Payment Data
When paid checkout is available and you choose to purchase, CHIP processes the payment through its hosted checkout. To create the CHIP payment request, the billing service sends the name and email on your account together with the required phone number you enter. The current account fields include name and email; payment credentials are entered only on the processor-hosted checkout.
- Payment details — are entered on the processor-hosted checkout. BursaEdge's checkout request does not contain a card number, CVV or banking password.
- Billing records — include the account-linked purchase reference, plan, amount, currency, state and relevant timestamps needed to reconcile billing, display owner-only history, administer paid access and correct billing.
- Payment-method references — if a payment processor retains a tokenised reference from an earlier payment, our systems only see that reference, never the underlying card data. We do not use such a reference to charge automatically; each renewal requires a new customer-initiated payment.
See our Refund Policy for the candidate purchase terms. No browser return parameter is used to confirm payment or change access.
Third-Party Services
We use third-party services to operate BursaEdge, including:
- Cloud hosting and database — including the configured Cloudflare and PocketBase services, to host and operate the application and account data.
- Product analytics — the application supports PostHog when configured; signed-in identity events can include account identifier, email and tier.
- Error monitoring — the application supports Sentry when configured; signed-in diagnostics can include account identifier and email.
- Transactional email — the production identity-service SMTP is configured with Resend. Application source also uses Resend for some transactional messages. Configuration does not prove delivery of a particular message or email location/contract terms.
- Google sign-in — when you choose that sign-in option, the OAuth provider and identity service process the authentication exchange.
- Telegram — to link your account to Telegram and deliver alerts when you choose to connect it.
- Payment processing — to process paid subscription payments and customer-initiated renewals when paid billing is available.
These providers process data for the stated service functions. The active provider inventory, processing countries, applicable contracts and transfer measures have not all been verified for this candidate; no particular country, contract or safeguard is claimed here. These facts must be completed before publication.
Data Retention
Your account and user-created data are retained while your account is active and as needed to operate the service. If you request account deletion, we will remove personal data within 30 days, except where retention is required by law, such as financial transaction records. We will explain required retention when responding to your request.
Billing references may be retained to reconcile payments, correct charges and meet legal or accounting duties. The precise category periods and backup-deletion behavior have not been confirmed for this candidate and are publication blockers; this notice does not claim a verified backup purge.
Your Rights and Choices
Under the Personal Data Protection Act 2010, as amended, you may exercise rights concerning your personal data subject to applicable statutory conditions and exceptions. You can:
- Request access to the personal data we hold about you and information about how it is processed.
- Request correction of inaccurate, incomplete, misleading, or out-of-date personal data.
- Withdraw consent to the processing of your personal data by giving us notice in writing, including by email.
- Ask us to stop processing your data for direct marketing, or to prevent processing likely to cause unwarranted damage or distress, where applicable.
- Request data portability to another data controller of your choice, subject to technical feasibility and compatibility of the data format.
- Request account deletion under our service commitment above, subject to legally required retention. This is not a claim of an unrestricted statutory right to erasure.
To exercise a privacy right or change your consent, email hello@bursaedge.com. Tell us which request or processing activity your notice concerns. We may need to verify your identity before providing or changing account data.
We will respond within 14 business days of receiving your request, or sooner where applicable law requires. If information or a lawful exception affects completion, we will explain this and the next steps. These are our service commitments, not a replacement for statutory deadlines or rights. Privacy requests are available regardless of whether your plan includes a paid export feature.
On receiving a withdrawal of consent, we will cease the processing concerned as required by law. Where data is necessary to provide an affected feature, withdrawing consent may mean that we can no longer provide that feature or service; we will explain the consequences. Withdrawing consent to optional marketing does not, by itself, require account termination. Records that we are legally required to retain remain subject to the retention section above.
Pilihan dan hak privasi
Kami memproses maklumat akaun, e-mel dan status pelan untuk mengendalikan akaun; rekod Journal, saringan tersimpan dan Telegram jika anda memilih ciri tersebut; serta data teknikal bagi operasi dan diagnostik. Jika checkout berbayar tersedia dan anda memilih untuk membeli, nama dan e-mel akaun serta nombor telefon wajib yang anda masukkan dihantar kepada CHIP untuk membuat permintaan pembayaran. Rujukan pembelian, pelan, amaun, mata wang, status dan tarikh berkaitan digunakan untuk penyelarasan, sejarah pemilik dan pembetulan bil. Kami tidak mengenakan caj pembaharuan secara automatik.
Rekod akaun boleh merangkumi nama, e-mel, pengecam akaun, nama pengguna, avatar dan pelan. Jika analitik atau pemantauan ralat dikonfigurasi, peristiwa log masuk boleh merangkumi pengecam akaun, e-mel dan pelan. Google OAuth2 diaktifkan; konfigurasi memetakan nama pengguna, tetapi tidak menetapkan pemetaan nama atau avatar secara nyata. Skop lalai dan semua medan yang dikembalikan Google belum disahkan.
Anda boleh meminta akses atau pembetulan, menarik balik persetujuan secara bertulis, meminta penghentian pemasaran langsung yang berkenaan, serta meminta kemudahalihan tertakluk pada syarat undang-undang dan kebolehlaksanaan teknikal. Anda boleh meminta pemadaman akaun; kami mengekalkan komitmen perkhidmatan untuk membuang data peribadi dalam 30 hari kecuali penyimpanan diwajibkan undang-undang.
Hubungi hello@bursaedge.com. Kami menggunakan pengesahan identiti yang berkadar dan memberikan respons dalam 14 hari bekerja, atau lebih awal jika diwajibkan undang-undang. Perubahan material dimaklumkan sekurang-kurangnya 14 hari sebelum berkuat kuasa. Ini ialah komitmen perkhidmatan yang dikekalkan, bukan pengganti tarikh akhir atau hak berkanun.
Negara pemprosesan, kontrak vendor, tempoh penyimpanan terperinci, pengendalian sandaran dan medan profil Google memerlukan pengesahan sebelum notis ini diterbitkan.
Security
No method of transmission or storage is completely secure. This candidate does not claim a security certification, independent audit result or provider-level safeguard that has not been verified. Where applicable law requires breach notification, we will follow the required process.
Changes to This Policy
We may update this policy prospectively. Material changes will be communicated by email or prominent platform notice at least 14 days before they take effect. An updated version and date will be shown. Processing that requires consent will not be authorised only by posting a revised notice.
Contact
BursaEdge
Email: hello@bursaedge.com