Privacy Policy — Breed Pro

Effective date: 18 September 2026 · Version: 1.0

This Privacy Policy explains how NEO INNOVATIONS ("we", "us") collects, uses, discloses, and protects personal data when you use Breed Pro (the "Service"). We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA). By using the Service you acknowledge this Policy.

1. Who is responsible for your data

• For your account and billing data, we are the data controller.
• For the records you enter about your rabbitry — including any personal data of third parties such as buyers — you are the data controller and we act as your data processor, handling that data on your instructions to run the Service. You are responsible for collecting that third-party data lawfully and with consent (the Service provides a consent field for buyers).

2. What personal data we collect

• Account data: name, email address, password (stored hashed by our auth provider), role, language and display preferences.
• Organisation data: rabbitry name, settings, staff user accounts and seats.
• Records you enter ("Customer Data"): animal and pedigree records, breeding, litters, grading, health/medical notes, cage history, photos, transactions, and buyer details you choose to record (name, contact, preferred language, consent flag, notes).
• Payment data: processed by Stripe. We do not store full card numbers; we hold limited billing information and subscription status.
• Technical & usage data: log data, device/browser information, IP address, and actions taken, used for security, rate-limiting, and operating the Service.
• Cookies/local storage: essential cookies for sign-in sessions and preferences (theme, language). We use no analytics, advertising or tracking cookies, and we do not track you across other websites.

3. How we use personal data

To: create and manage your account; provide, maintain, and secure the Service; process subscriptions and payments; provide support; send service-related communications; enforce our Terms; comply with law; and operate AI-assisted features you use. We use your data only for these purposes or as you otherwise consent.

4. AI-assisted features

When you use AI features (e.g. breeding advisor, pedigree scanner), the relevant inputs (such as the animal/pedigree data or an uploaded pedigree photo) are sent to Anthropic to generate the response. That data is processed to produce your result and is subject to Anthropic's data-handling terms for business/API use; neither we nor Anthropic use it to train models. AI features are optional — an Organisation administrator can turn them off, and if they are off nothing is sent to Anthropic.

5. Who we share data with (processors / subprocessors)

We share personal data with service providers strictly to operate the Service:

We do not sell personal data, and we do not share it with anyone for advertising. We may disclose data if required by law or to protect rights, safety, or the security of the Service.

6. Cross-border transfer

Your data is primarily hosted in Singapore. Some processors (e.g. Stripe, the AI provider) may process data outside Malaysia, including outside the region. Where the PDPA requires, we rely on your consent and take reasonable steps so your data is protected consistently with this Policy.

7. Retention

We keep personal data for as long as your account is active and as needed to provide the Service.

• Customer Data: retained for 30 days after account closure so you can export it, then deleted or anonymised.
• Billing and tax records: retained for 7 years, as Malaysian tax law requires.
• Security and rate-limiting logs: retained for up to 90 days.
• Backups: deletions propagate as backups age out, within 30 days of deletion.

8. Security

We use technical and organisational measures including encryption in transit, database row-level access isolation between Organisations, access controls, and periodic security review. No system is perfectly secure, and we cannot guarantee absolute security; you also play a role by protecting your credentials and devices.

9. If there is a data breach

The Personal Data Protection (Amendment) Act 2024 made breach notification mandatory from 1 June 2025, and it applies whatever our size. If a breach occurs:

• we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it;
• where the breach is likely to cause significant harm, we will notify affected individuals within 7 days;
• we keep a breach register for at least 2 years, recording what happened, what data was involved, and what we did about it.

If you are an Organisation and the breach concerns Customer Data for which you are the controller, we will tell you promptly and give you what you need to make your own notifications.

10. Data Protection Officer

The 2024 Amendment requires a Data Protection Officer where an organisation processes the personal data of 20,000 or more individuals, or the sensitive personal data of 10,000 or more, or carries out regular and systematic monitoring. We are below all of those thresholds and have not appointed a DPO. Privacy questions go to the contact in §14, and we will reassess if we cross a threshold.

11. Your rights under the PDPA

Subject to the PDPA and its exceptions, you may: request access to your personal data; request correction of inaccurate data; withdraw consent (which may mean we can no longer provide the Service); and limit certain processing. To exercise these, contact us (§14). For Customer Data where we act as your processor, your buyers/third parties should direct requests to you as the responsible party.

12. Children

The Service is for business/hobby use by adults and is not intended for anyone under 18. We do not knowingly collect data from children.

13. Changes

We may update this Policy; we will post the new version with an updated effective date and, for material changes, provide reasonable notice.

14. Contact

Privacy questions or PDPA requests: support@breedpro.com, NEO INNOVATIONS, Petaling Jaya, Selangor, Malaysia.