Privacy policy
Last updated 15 Oct 2026
Who we are
STEM Exam Builder (stemexambuilder.com) is run by Kayangan Didik Trading, Malaysia, business registration number (SSM) 003486174-M, trading as Mersenne Mathematics Academy, 14-1, Jalan 1/149D, Bandar Baru Sri Petaling, 57000 Kuala Lumpur, Malaysia. We handle personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA). This notice is also available in Bahasa Malaysia: Dasar privasi.
What we store
- Your email address and name. If you sign in with Google, we get them from Google; otherwise you type them in.
- The time you ticked “I am 18 or older, or I have my parent’s or guardian’s permission, and I agree to my data being kept outside Malaysia”. We do not ask for your date of birth.
- Your school, if you choose to add it.
- The papers you save and your favourites, with their folders and notes.
- Records of your payments. Payments are processed by Stripe: your card details go to Stripe and are never stored on our servers.
- If you earn referral payouts: who holds the payout account, you or a parent or guardian. Referrers under 18 are paid only to a parent’s or guardian’s account, so we keep that flag with your payout details. The bank details themselves are held by Stripe.
- If you connect an AI app (such as ChatGPT or Claude): which app you connected and when, so you can see and remove it.
- The IP address of each request, in our server logs. We keep these logs for 30 days to protect the service (for example against abuse and scraping), then delete them.
Why we store it
To run your account, keep your papers and favourites, provide the plan you pay for, pay referral earnings, and answer your messages.
What you must give us
An email address and the tick at sign-up are needed to make an account; without them we cannot open one. Your name and school are up to you.
Who we share it with
Only the services that run the site for us, and only what each one needs:
- Supabase (sign-in and database, in Singapore).
- Fly.io (our server, in Singapore).
- Cloudflare (delivers the site worldwide and forwards mail sent to our support address).
- Stripe (payments and referral payouts; it keeps data in the United States and other countries).
- Resend (sends sign-in and account emails, from Japan).
- Google, only if you choose to sign in with Google (in the United States and other countries).
- Google (Gmail), which receives the mail you send to our support address (in the United States and other countries).
So your data is kept outside Malaysia: in Singapore, Japan, the United States and other countries. We use these services because we cannot run the service you signed up for without them, and each one protects the data under its own terms. You agree to your data being kept outside Malaysia with the tick when you sign up.
Cookies and storage on your device
We use cookies only to keep you signed in. There are no advertising or tracking cookies. The site also keeps a few things in your browser’s local storage: your sign-in session, your sign-up tick until it is saved, the referral code you arrived with, the favourites you pick before you sign up (they move into your account when you do), and whether you have seen the tour. You can clear them in your browser at any time.
We count visits with Cloudflare Web Analytics, which sets no cookie and collects no personal data.
Your data, your choice
You can ask to see or correct your data, ask for a copy of it to take elsewhere, or ask us to delete your account and its data. We delete it within 30 days of your request, except records of your payments, which we keep for 7 years. A parent or guardian can make these requests for a child under 18. Write to support@stemexambuilder.com from the email address on your account.
If something goes wrong
If your data is exposed in a way that could seriously harm you, we tell you without delay, and we report it to the Personal Data Protection Commissioner as the law requires.