Skip to content
BMEN Log in
How it works Voice Price FAQ Log in
BMEN

Privacy policy

This notice is issued under the Personal Data Protection Act 2010 (PDPA, as amended in 2024). Updated: 1 October 2026. (version 2026-10-01.1)

1. Data controller & contact

Your personal data is controlled and processed by Kayz Asia Sdn. Bhd. (201801004379), the operator of Semut Live (semut.live). The Semut Live brand is owned by Khairulzul Enterprise (202403028717); the platform, billing and receipts are operated by Kayz Asia Sdn. Bhd. (201801004379). Registered address: DT2, Jalan Pusat Perniagaan Gangsa 1, Pusat Perniagaan Gangsa, 76100 Durian Tunggal, Melaka. Questions, access, correction, consent withdrawal or deletion requests: admin@semut.live. We respond within 21 days.

2. Data we collect

  • Account: name, email, phone number, password (stored hashed), preferred language, and your Google ID if you sign in with Google.
  • Products: names, prices, descriptions and photos you upload or import from a link.
  • Streaming: RTMP URL and stream key (encrypted), platform, session schedule.
  • Bookings, payments and receipts (via ToyyibPay; we do not store your card or bank login details, except account details you give us for a manual refund — encrypted).
  • Comment reading (optional): IDs and names of your Facebook Page / YouTube channel, access tokens (encrypted), and processed viewer comments (viewer name, text, reply).
  • Quizzes: the winner's public display name and profile photo from the platform may appear on the live video (the seller can turn the photo off). The profile photo is fetched for that session only and is not stored after the session — except inside the session video recording, which is deleted after 14 days.
  • Auto Live (optional): if you turn it on, the extra permissions (Facebook: publish_video, pages_manage_posts; YouTube: youtube.force-ssl) are used only to create, broadcast and end lives on your Page / channel for the sessions you book. We store the live ID, watch link and ingest URL (encrypted) for that session. Our use of YouTube / Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements.
  • Shopee shop (optional): Shopee shop ID and user ID, shop name and region, and access tokens (encrypted). For Live Auto (Shopee): the live session ID, the stream address (encrypted), live viewer comments (username and text), your own shop's live statistics from Shopee, and aggregate orders during the live window (count, value and products — without order numbers). We do NOT request or store buyers' names, addresses, phone numbers or other personal details.
  • Live session recordings: video, audio, overlay and the session timeline (product/segment switches, quiz questions & winners, viewer comments received and host replies). Viewer comments (public platform data) are processed to operate the host and stored with the recording for 14 days.
  • Technical logs: IP address, browser, sign-in times and an audit log of important actions (security and fraud prevention).

3. Sensitive data: face & voice

If you upload a face photo for a custom avatar or a voice recording for a custom voice, this data is treated as sensitive (biometric-like). We process it only with your explicit consent recorded at upload, only to generate your AI host, and keep a digital fingerprint (hash) of the image to detect misuse of other people's faces. You must be that person or have their written permission; photos of children under 18 are prohibited.

The host's voice (including your custom voice) is generated on our own GPU server with the F5 voice model running locally — your voice recordings are not sent to third parties. Custom-avatar face photos are also processed on our servers for the live video; but if you use that avatar for product scenes or backgrounds (suasana), the photo is sent to our AI image provider (OpenRouter) — see section 5.

Avatar appearance description: an avatar photo you upload is sent once to OpenRouter (which uses Google Gemini) to write a short description of how the host looks (for example: headscarf, clothing colours, background). This description is used internally only, to improve video quality, and does not include your name. We keep only that text description — no extra copy of your photo.

You can withdraw consent at any time by deleting the avatar/voice in the dashboard (Host & voice) or by emailing us. The original files are deleted from the website immediately and working copies on the GPU server within 30 days; only the audit log (date and consent declaration) is kept as evidence.

4. How we use it

To run your live sessions, generate scenes and sales scripts, answer viewer comments, process payments and receipts, contact you about bookings, keep accounts secure, and comply with the law. We do not sell your data or use it for third-party advertising.

5. Processors & transfers outside Malaysia

We share the minimum data needed with the processors below. Some are outside Malaysia; we transfer data only for the purposes above and in line with section 129 of the PDPA.

  • ToyyibPay (Malaysia) — FPX/card payment processing: name, email, phone, amount.
  • Billplz (Malaysia) — an alternative payment gateway, used only if we switch payment gateways: the same data as ToyyibPay.
  • DeepSeek (China) — our AI text provider: product text, sales scripts, quiz questions, stories, content checks, the website chatbot, the text transcript of "Learn from past lives" videos (transcribed on our own server), and generating the host's replies to viewer comments — viewer comment text only (no name or ID, max 300 characters). The viewer's name is inserted into the reply on our own server. No face images or voices are sent.
  • OpenRouter (United States), which passes requests to the Qwen (Alibaba) and Google Gemini models — generating product scenes, backgrounds (suasana) and AI-generated avatars, checking background photos, and the avatar appearance description (once per uploaded avatar): product photos, the chosen host picture (including your custom avatar if you pick it), background photos you upload and text descriptions. No viewer data.
  • OpenAI (United States) — a fallback engine for product scenes only (the same pictures as above), when the main provider is unavailable.
  • Google (United States) — Google sign-in and the YouTube API (if you connect a channel).
  • Meta (United States) — the Facebook API (if you connect a Page).
  • Shopee (Singapore) — Shopee Open Platform (if you connect a Shopee shop): creating, starting and ending lives on your shop, adding your products to the live bag, posting the AI disclosure comment, and reading your live comments and statistics.
  • ElevenLabs (United States) — we used it to design the stock host voices (synthetic voices, not real people's voices). None of your or your viewers' data is sent to it; the voice during a live is generated on our own servers.
  • Telegram (United Arab Emirates) — if you connect @SemutLive_Bot: your Telegram chat ID and notifications about your bookings, sessions and products. Our team also receives operations alerts through Telegram that may contain your account email and booking number.
  • Emails are sent from our own mail server (semut.live, Malaysia) — email verification, receipts and booking notifications.
  • Our own servers in Malaysia — the website, database, email and the GPU server that generates the live video and the host's voice (local F5 voice model; video transcription is also done here). Apart from what is listed above, faces, voices and products are not sent to third parties.
  • The streaming platform you choose receives your live video through your stream key.

Requests from authorities: we review the legality of every data request from authorities, challenge unlawful requests, and disclose only the minimum data required by law.

6. Retention

  • Account and bookings: while the account is active; deleted or anonymised within 30 days of a deletion request.
  • Payments, receipts and invoices: 7 years (tax requirement), even if the account is deleted.
  • "Learn from old lives" videos: 7 days. Session recordings and comments & replies: 14 days. Session work files on the GPU server: deleted within 30 days.
  • Live sessions are recorded for quality control and troubleshooting. Recordings (video, audio, overlay & viewer comments received) are kept for 14 days, then deleted automatically. Customers can watch & download their sessions' recordings during that time.
  • Shopee: live viewer comments are kept for 14 days; live statistics and the order estimate are kept with your booking; Shopee tokens are deleted immediately when you press "Disconnect".
  • Custom avatars and voices: until you delete them or close the account.
  • Security and audit logs: up to 2 years.

7. Security & data breaches

Stream keys, tokens and bank details are encrypted; staff access is role-limited and logged. If a data breach may affect you, we will notify the Personal Data Protection Commissioner and you as soon as possible, as required by law.

8. Cookies

We only use necessary cookies (sign-in session, CSRF security, language choice). No advertising or third-party tracking cookies.

YouTube API Services

Semut Live uses YouTube API Services when you connect your YouTube channel (Dashboard → Platform connections). By using our YouTube features you agree to the YouTube Terms of Service and are subject to the Google Privacy Policy:

YouTube data we access

  • Your YouTube channel ID and name (to show the connected channel and broadcast to the right channel).
  • If Live Auto is enabled: the broadcast and stream IDs we create for your sessions, the watch link and the live chat ID.
  • Viewers' live chat messages DURING your sessions only — so the AI host can read and answer viewers' questions.
  • OAuth access tokens (encrypted). We do not access your videos, subscriptions, watch history or any other personal data in your Google account.

How we use, store and share it

  • Used only to run your live sessions: creating / ending broadcasts, and reading live chat during the session so the host can answer.
  • Live chat messages are kept with the session log for 14 days (so you can review the host's answers), then deleted automatically.
  • YouTube data is never sold, never used for advertising, and not shared with third parties other than the processors needed to run the session (our own servers).

How to revoke access

Deletion — When you disconnect, the tokens are deleted immediately together with the stored YouTube data (channel ID, broadcast/stream IDs and live chat messages). If access is revoked in your Google account (the token becomes invalid), all stored YouTube data is deleted within 7 days, in line with the YouTube API Services Developer Policies. You can also request deletion at any time via admin@semut.live.

Cookies — We do not place, access or read cookies on YouTube pages or on your device through YouTube API Services. Our site only uses necessary cookies (see section 8).

Data deletion instructions

  • Disconnect Facebook/YouTube/Shopee: Dashboard → More → Platform connections → Disconnect. Access tokens are deleted immediately. You can also remove the semut.live app in your Facebook settings (Apps and websites) — we receive Meta's data deletion request automatically.
  • Delete your account: Profile → Delete account (type PADAM), or email admin@semut.live from your account's email address.
  • What is deleted and when: platform & Telegram tokens — immediately; session recordings and comment logs — after 14 days (automatic); account data (profile, products, layouts, private avatars/voices, bookings) — within 30 days of the request. Payment records, invoices & receipts are kept 7 years as required by tax law.
  • Every request gets a reference code and a status page.

9. Your rights

You have the right to access, correct and get a copy of your data, withdraw consent, limit processing, and request account deletion. You can update your name, email and phone yourself on the Profile page. For other requests, email admin@semut.live.

You must be 18 or older to open an account.