Privacy Notice
Version 2026.10 · Last updated 14 October 2026
The short version
- Only a parent or guardian aged 18 or over can create a murid-murid account. A parent creates each child's profile and gives consent for that child first.
- We collect what we need to run practice, mark answers, show parents their child's progress and keep children safe.
- Other students can see only a child's display name, avatar, XP and rank among friends, and the results of challenges they played together.
- We do not sell personal data. The app has no advertising identifiers, no advertising tools and no cross-app tracking. Usage analytics in the app are switched off.
- Our main database is in Singapore, run by Google Cloud.
- Our editors use artificial intelligence to draft practice questions, and a human editor reviews every one. Today, no student's data, name or answers are sent to any AI provider.
- You can ask to see, correct, download or delete your data at any time.
The rest of this notice gives the full details.
1. Who we are
This Privacy Notice explains how We Lead Sdn Bhd ("we", "us") collects, uses, shares and protects personal data. We follow Malaysia's Personal Data Protection Act 2010, as amended in 2024 (the "PDPA").
It covers:
- the murid-murid web app at https://app.murid-murid.com;
- our iOS and Android apps, when they are released;
- our website murid-murid.com, our waitlist and our advertising pages (see section 15);
- messages you send to our support team.
| Company | We Lead Sdn Bhd, a company registered in Malaysia |
| Company registration number | 202501054044 (1655450-H) |
| Registered address | H-7-1, Desa Kepong, Jalan Rimbunan Teratai 1, Pekan Kepong, 52100 Kuala Lumpur |
| hello@murid-murid.com | |
| Phone and WhatsApp | +60 16-318 6410 |
| Data Protection Officer | Our Data Protection Officer, at hello@murid-murid.com |
2. Languages
This notice is published in English, Bahasa Malaysia and Chinese. If the versions say different things, the reading that is most favourable to you applies.
Today only the English version is available. The Bahasa Malaysia and Chinese versions will follow.
3. Who can use murid-murid, and consent for children
- murid-murid is offered to people who live in Malaysia. The web app can be opened from elsewhere, but we do not direct it there.
- Only a parent or legal guardian aged 18 or over can create an account. At sign-up they tick a statement confirming this.
- A child cannot sign up alone. Malaysian law requires a parent's or guardian's consent to process the personal data of anyone under 18. A parent creates each child's profile and gives consent for that child on a consent screen before the profile exists. We record that consent with the version of the policy and the time our server received it.
- Children normally use murid-murid in a session that a parent opens on a device (a "child session"). In a child session, a child cannot make purchases, delete an account or open the parent dashboard.
- A parent may later give a child their own email login. After that, only the child, or our administrators, can delete that child's account.
4. What we collect, and why
4.1 Parents and guardians
| What we collect | Why we use it |
|---|---|
| Email address | To sign you in, send account emails (such as email confirmation and family invitations) and reply to you. |
| Display name | To show your name in the app and to address you. |
| Phone number (required at sign-up) | So our customer-success team can contact you about your child's learning, and for support. We do not verify it, and we never use it for marketing. |
| Sign-in provider identifiers (Google or Apple) | To let you sign in with Google or Apple. |
| Language and timezone | To show the app in your language and show times correctly. |
| Notification preferences | To send only the notifications you have chosen. |
| Family and child links | To know which children you look after and which other guardians are linked to them. |
| Push-notification token (parents only) | To send notifications to your device. |
| Device model, operating system and app version, in crash reports | To find and fix crashes. |
| Support messages you send us, including photos, voice notes and files, and a note of calls on WhatsApp | To answer you, solve the problem and follow up. We keep WhatsApp conversations in our own support system (see section 15). |
Your email address and phone number are required to create an account. If you do not give them, we cannot create the account.
4.2 Children
Profile
| What we collect | Why we use it |
|---|---|
| Display name (a nickname is fine; we do not need a child's legal name) | To show in the app and to friends. |
| Date of birth | To work out the child's age and suggest the right school year. We are changing this: we will keep only the month and year. |
| School year or level | To show the right lessons. |
| School (optional, chosen from a list or typed) | To record the child's school on their profile and, when the school leaderboard launches, to rank the child among students at the same school (see section 5). Other students cannot see it today. We are changing this: a school name typed in by a student is added to a shared school list together with the account ID that added it; we are removing that link. |
| Avatar choice | To show the avatar the child picked, in the app and to friends. Avatars are chosen from a set; the app does not ask for a photo. |
| Language | To show the app in the child's language. |
Learning
| What we collect | Why we use it |
|---|---|
| Lessons started and finished, the answers chosen and whether they were right, time spent, and skip-exam attempts | To run lessons and skip exams, mark answers, choose the next practice, and show the parent how the child is doing. |
| XP, Stars, crowns, streaks and daily goals | To reward practice and show progress. |
| Energy (the free plan's activity budget, which refills on a schedule) | To run the free plan. |
Friends and challenges
| What we collect | Why we use it |
|---|---|
| Friend code, friends list, friend requests and blocked users | To let a child connect only with friends added by code or QR code, and to block someone. |
| Challenge results | To run head-to-head challenges and show the results to the players. |
| "Online now" and "last seen" | To show who is available to play. We are changing this: today any signed-in user can read a student's online status. We are restricting it to the student's friends and current challenge opponents. |
Other
| What we collect | Why we use it |
|---|---|
| Question reports the child sends us (free text, up to 500 characters) | To fix mistakes in our questions. We are changing this: today our content editors can read these reports. We are restricting who can read them. |
| The parent's consent record for the child | To prove that a parent gave consent. |
| Crash reports from the child's device (crash trace, device model, operating system and app version, and a random per-install identifier) | To find and fix crashes. Nothing that identifies the child is attached. |
4.3 What we do not collect or do
- We do not sell personal data.
- The app has no advertising identifiers and no advertising tools, and we do not track you across other apps or websites.
- The app's usage analytics are switched off, and no usage-analytics events are collected. We are changing this: we are removing the analytics library from the app.
- We do not send marketing messages to app accounts. The weekly progress report email is off by default.
- We do not need a child's legal name, home address, identity card number or photo, and the app does not ask for them.
5. Who can see what
| Who | What they can see |
|---|---|
| Other students who are your child's friends | Display name, avatar, XP total and rank on leaderboards among friends. |
| Students who played a challenge with your child | The results of the challenges they played together. |
| Any signed-in user, today | Whether a student is online now and when they were last seen. We are changing this so that only friends and current challenge opponents can see it. |
| Parents and guardians linked to the child | The child's profile and learning progress. |
| Our customer-success team | The parent's name and phone number, and a summary of the child's learning. |
| Our content editors | Question reports. We are changing this to restrict who can read them. |
No other user can see a child's email, school or date of birth. We are changing this: a school leaderboard is planned. When it launches, students at the same school will see each other's display name, avatar and XP on it, and we will update this notice first.
6. How we use personal data, and on what basis
We use personal data to:
- create and run accounts and child profiles;
- run lessons, skip exams, rewards, friends and challenges;
- show parents their child's progress;
- contact parents about their child's learning and give support (see section 7);
- send service emails, such as email confirmation, family invitations and, only if you switch it on, the weekly progress report;
- keep murid-murid safe, look into misuse and suspend accounts that break our Terms;
- find and fix crashes and other problems;
- keep proof of consent and meet our other legal duties.
We process personal data with your consent, given at sign-up and for each child, and where it is needed to provide the service you asked for or to meet a legal duty.
7. When our team contacts you (not marketing)
Our customer-success team may contact a parent by WhatsApp, email or phone about:
- the child's progress;
- the child not using the app for a while;
- misuse of the app.
When they do, they see the parent's name and phone number and a summary of the child's learning. These messages are about your child's learning. They are not marketing, and we do not send marketing messages.
You can switch off this kind of contact in the app's settings. We are changing this: that setting is being added. Until it is available, email hello@murid-murid.com and we will stop. You can always reach our support team yourself.
8. Who we share data with
We share personal data only with the service providers below, and only for the purposes shown.
| Provider | What they do for us | What data | Where |
|---|---|---|---|
| Google Firebase and Google Cloud | Database, sign-in, file storage, server functions and push notifications | Account, profile and learning data | Singapore (asia-southeast1). One account-creation function runs in the United States. We are changing this: it is moving to Singapore. |
| Firebase Crashlytics (Google) | Crash reports from the app | Crash trace, device model, operating system and app version, a random per-install identifier; the parent's account ID on a parent's device; nothing identifying on a child's device | Google's servers, outside Malaysia. Kept for 90 days by Google. |
| Google Fonts | Supplies the fonts the app shows | The device's IP address, sent to Google when the app starts | Google's servers, outside Malaysia. We are changing this: the fonts will be built into the app, so nothing is sent. |
| Resend | Sends our emails to parents | Email address and the email's content (weekly progress report if switched on, family invitations, email confirmation) | Outside Malaysia: in the United States. |
| Netlify | Hosts the web app and our admin console | Technical data such as your IP address when you load the web app | Outside Malaysia. |
| Vercel and Neon | Host our website and our waitlist database | See section 15 | Outside Malaysia. |
| Microsoft Clarity | Measures how our advertising pages are used (those pages only) | See section 15 | Outside Malaysia. |
| WhatsApp (Meta) | Carries messages and calls when you contact us on WhatsApp | Your phone number, name and messages, and anything you send us | Meta's servers, and our own systems (see section 15), some outside Malaysia. |
We may also disclose personal data when Malaysian law requires it, for example to a court or a regulator.
Coming soon: subscriptions
When this feature is available (when the Pro plan goes on sale):
| Provider | What they do for us | What data |
|---|---|---|
| Apple App Store and Google Play | Take payments in our iOS and Android apps, bill renewals and handle refunds under their own terms | Your payment details stay with the store. We never see your card details. |
| RevenueCat Web Billing, with Stripe as the payment processor | Take payments on the web app, bill renewals, and run the page where you change or cancel a web subscription | Your name, email address and payment details, entered on their checkout page. We never see your full card details. Outside Malaysia: Stripe processes payment data in the United States and other countries where it operates. |
| RevenueCat | Keeps track of subscription status | Subscription status, linked to the parent's account ID. Outside Malaysia: in the United States. |
9. Transfers outside Malaysia
Our main database and servers are in Singapore. Some providers listed in section 8 process data in other countries, including the United States. This means your personal data is transferred outside Malaysia.
We rely on contractual protections with these providers and on the consent you give at sign-up.
10. Artificial intelligence
Our editors use artificial intelligence to draft practice questions. We use Google Vertex AI (Gemini), Anthropic Claude and OpenAI models for this. Every AI-drafted question is reviewed by a human editor before any student sees it.
No student data, name or answer is sent to any AI provider today.
Coming soon: AI study coach
We are planning an "AI study coach": a voice conversation feature, built with OpenAI (GPT-Live), that would help a child with their practice. It is not available yet. When this feature is available, it will work as follows, and it will need a separate consent from a parent for each child before it can be used.
- What it would send to OpenAI: the child's display name, school year and language, the child's speech, what the child taps, and photos of homework the child takes.
- What we would keep: transcripts as text for 90 days and homework photos for 30 days.
- Conditions before launch: zero data retention agreed with OpenAI; data kept in Singapore; a separate parent consent for each child; and only pseudonymous identifiers used.
- What parents see: a summary of each session. A parent can ask for the full transcript, which we release after a safeguarding check.
We will update this notice before the feature launches.
11. How long we keep data
The full list is in our Data Retention Schedule. In summary:
| Data | How long |
|---|---|
| Active accounts | While the account is active. |
| Inactive accounts | Deleted after 24 months without a sign-in, with a warning email at 22 months. We are changing this: this rule is being introduced. |
| Deleted accounts | The sign-in is deleted at once; the account's data is permanently erased 30 days later. A deletion cannot be undone. |
| Learning sessions, challenge results and skip-exam attempts | Anonymised when the account is erased. We are changing this: today some of these are kept. |
| Minimal consent record (hashed identifiers, policy version, time and method; no names) | 6 years, as legal proof of consent. |
| Backups | 30 days. |
| Copies of the database taken before a release | 90 days. We are changing this: this limit is being introduced. |
| Server logs | 30 days. |
| Crash reports (Crashlytics) | 90 days, at Google. |
| Website forms and advertising-page visit data | As long as we need them for the purposes in section 15, then deleted or anonymised. |
| Support chats (including WhatsApp) and emails | As long as we need them to help you, then deleted. You can ask us to delete them sooner. |
12. How we protect data
- Data is encrypted in transit and at rest.
- Our staff get access based on their role.
- Security rules, checked for every account, allow each account to reach only the data it is meant to see.
- Administrator access is limited to named staff, each with a specific role.
If something goes wrong
If we confirm a personal data breach, we will notify the Personal Data Protection Commissioner within 72 hours. If the breach is likely to cause you harm, we will also tell you within 7 days.
13. Your rights
Under the PDPA you can:
- see the personal data we hold about you or your child (access);
- correct data that is wrong or incomplete;
- delete your account and your children's data;
- take your data with you: ask us to send it to you or to another organisation, as the law allows (data portability);
- withdraw your consent, for example by deleting a child's profile;
- stop direct marketing at any time;
- switch off proactive contact from our customer-success team (see section 7).
A parent or guardian exercises these rights for a child.
How to ask: use the app's settings where the option exists, or email hello@murid-murid.com from your registered email address. We will check that the request comes from you. We answer requests to see or correct data within 21 days, as the PDPA requires. Deletion requests sent by email are processed within 30 days.
To delete an account, see our Deleting Your Account guide.
14. Complaints
Please contact us first, at hello@murid-murid.com or on WhatsApp at +60 16-318 6410, so we can try to put things right.
You may also complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP).
15. Our website, waitlist and advertising pages
This section covers murid-murid.com, our waitlist and our campaign landing pages (the pages you reach by clicking one of our advertisements). It replaces the website privacy notice dated 12 October 2026.
What we collect
When you join the waitlist, we collect:
- your name;
- your phone number and email address;
- your child's schooling level (for example, Standard 5 or Form 1);
- an optional referral code.
When you fill in the form on one of our campaign landing pages, we collect:
- your name;
- your phone number and email address;
- which campaign and advertisement brought you to us, read from the link you clicked.
When you message or call us on WhatsApp, we keep a copy of the conversation, including any photos, voice notes and files you send and a note of calls, in our own support system. This lets our team see earlier conversations and follow up with you. If you also filled in one of our forms with the same phone number, we keep the two together.
Browsing the website does not require an account. The marketing pages, the waitlist pages and the FAQ carry no analytics of any kind: visiting them records nothing about you.
Our quiz and past-paper pages
Two of our campaign pages are for students: a short quiz (/lp/robloxgift), which our team also runs on our own phones at schools, and a page of past-year exam papers (/lp/murid-murid-lite).
A parent or guardian agrees first. Before we save anything a student types, a parent or guardian must confirm that they are the student's parent or legal guardian, aged 18 or over, and that they agree to what this section describes. If they do not agree, nothing the student typed is saved. We record when the parent agreed, the words they agreed to and the language of the page. When our team runs the quiz at a school, a parent's agreement is collected in person before the student plays.
On these pages the student enters their name, their school's state, their school, their class and a parent's WhatsApp number; on the past-paper page, also the subject. The student then answers the questions. We record the answers and when each was given, the scores, on the quiz a learning-style result, the language used, and which advertisement or link brought the student to the page.
We use the parent's WhatsApp number to send the results to the parent and to tell them about murid-murid. On the quiz, we use the school and class to compare a student's score with other students at the same school and class, and we show the student only how many they did better than, never anyone's name. The parent can ask us to stop contacting them, or to delete the student's details, at any time by replying or by emailing hello@murid-murid.com.
Measuring our advertising pages
Our campaign landing pages are measured, and this happens whether or not you fill in the form, and whether or not you ever tell us your name. We explain it here in full because it is the one place on our website where we record something about a visit rather than about a form you sent.
When you open one of those pages, we record:
- when you arrived, how far down the page you scrolled, when you switched away to another tab or app and when you came back, whether you started typing in the form, and whether you sent it;
- which advertisement brought you, read from the link you clicked, and the address of the page you came from;
- your IP address, and the country, state and approximate city our hosting provider works out from it;
- the make of browser and device you are using, as your browser reports it.
To recognise one visit as a single visit, and to tell a returning visitor from a new one, we store two random identifiers in your browser. One lasts only until you close the tab. The other has no expiry of its own and stays until you clear your browser's site data, so that if you come back to the same advertisement in the following days we can see it was a second visit rather than a second person. Neither contains your name or anything about you, and neither is shared with anyone. Clearing your browser's site data removes both, and private or incognito browsing stops the longer one being kept at all.
We use all of this for one purpose: to learn which advertisements bring families to us and where the page loses people, so that we spend our advertising budget well and make the page better. We do not use it to build a profile of you, to follow you to other websites, or to decide anything about you personally.
These pages also use Microsoft Clarity, which records how the page is used and masks the contents of form fields. The rest of the website carries no third-party analytics, and we do not run third-party advertising trackers anywhere.
Why we collect it
- to contact you about early access, launch updates and founding perks;
- to understand demand by schooling level, so we prioritise the right content;
- to send a student's quiz or past-paper results, and information about murid-murid, to the parent's WhatsApp number given on those pages, with the parent's agreement;
- to credit referrals where a referral code is given;
- to reply to you, including on WhatsApp where you have asked us to, and to see earlier conversations when you contact us again;
- to understand which advertisements bring families to us, so we spend our advertising budget where it helps.
You can ask us to stop contacting you about early access and launch updates at any time.
What we do not do
- We do not sell your personal data.
- We do not share it with third parties for their own marketing.
- The waitlist and campaign forms are meant for parents. Apart from the quiz and past-paper pages described above, where a parent or guardian agrees first, we do not knowingly collect data directly from children on our website.
- We do not follow you across other websites, and we place no advertising cookies.
- We do not use the measurements above to make any decision about you as an individual.
Storage and how long we keep it
Waitlist and campaign form submissions, WhatsApp conversations and visit measurements are sent securely and stored in access-controlled systems.
We keep form submissions and visit measurements only for as long as we need them for the purposes above. After that we delete them or remove anything that identifies you. We keep WhatsApp conversations as long as we need them to help you, then delete them. You can ask us to delete any of it sooner at any time.
Our website and its database are run for us by service providers outside Malaysia (Vercel and Neon), so this data is stored on servers abroad under contractual protections.
Your rights for website data
You may ask for access to, correction of, or deletion of your website data at any time, including the visit measurements described above, even if you never sent a form. Email hello@murid-murid.com. This data is kept separately from murid-murid app accounts, so deleting an app account does not delete it; ask us for both if you want both removed.
16. Changes to this notice
Every version of this notice shows its version number and date at the top. Each version is kept at its own web address on murid-murid.com, for example murid-murid.com/en/legal/privacy/v/2026.10.
Before a material change, we will tell you in the app and by email at least 14 days before it takes effect.
17. Contact us
- Company: We Lead Sdn Bhd (registration number 202501054044 (1655450-H))
- Address: H-7-1, Desa Kepong, Jalan Rimbunan Teratai 1, Pekan Kepong, 52100 Kuala Lumpur
- Data Protection Officer: hello@murid-murid.com
- Email: hello@murid-murid.com
- Phone and WhatsApp: +60 16-318 6410