Culminaite Privacy Policy
Last updated: 29 August 2025
Who we are
We're Culminaite ("we", "us")—an AI-powered career advisory platform based in Malaysia and owned by Maximum Potential Ventures (JM1029291-H), who is the acting data user / controller.
Contact for privacy: culminaite@gmail.com
What we collect (and why)
We only collect what we need to run and improve Culminaite's services.
Account info
Name, email, password (hashed), country/region, billing details. This is to create and secure your account.
Content you provide
CVs/resumés, uploads, and chat prompts. This is to generate feedback and learning content.
Device & usage data
IP address, browser/device, pages/features used, approximate location, cookies. This is to keep things working, secure, and useful.
Payments
Processed by our payment partners; we receive transaction IDs and basic billing info (no full card numbers).
Support
Messages, ratings, surveys. This is to help you and improve the product.
Sensitive info (optional)
If you include sensitive data in your CV (e.g., health, political, religious, union, ethnicity), we treat it as sensitive and use it only with your consent or as allowed by law.
How we use your data
Under PDPA's principles (notice & choice, purpose, security, etc.) we use data to:
- Provide the service (accounts, uploads, AI feedback, customer support)
- Improve the product (troubleshooting, stats, new features)
- Keep it safe (fraud prevention, abuse detection, security)
- Communicate (service emails, updates; you can opt out of any future marketing)
- Comply with the law (tax, accounting, lawful requests)
AI processing
To generate feedback, your text may be processed by machine-learning providers acting as our processors. They're bound by contracts to use your data only to provide the service to us.
Our legal grounds
Malaysia (PDPA)
Your consent and processing necessary for the purpose (e.g., to review your CV), plus other PDPA-permitted grounds.
EEA/UK (GDPR)
Contract necessity, legitimate interests (security/analytics with safeguards), and consent (marketing, certain cookies, any sensitive data you choose to provide).
Communication & Marketing
If you have made a purchase from Culminaite, we may occasionally update you on our latest products, news and special offers via e-mail.
All Culminaite users and members have the option to opt-out of receiving marketing communications from us and/or selected third parties. If you do not wish to continue to receive marketing from us and/or selected third parties you should opt-out by clicking on the 'unsubscribe' link in any email communications which we might send you.
Cookies
A cookie is a small information file that is sent to your computer and is stored on your hard drive. If you have registered with us then your computer will store an identifying cookie which will save you time each time you re-visit Culminaite, by remembering your email address for you. You can change the settings on your browser to prevent cookies being stored on your computer without your explicit consent.
Site Statistics
We may disclose aggregate, anonymised statistics about the number of visitors to this Website or number of purchases made as required by our investors. We use an independent measurement and research platform to gather data regarding the visitors to this Website on our behalf using cookies and code which is embedded in the site. Both the cookies and the embedded code provide statistical information about visits to pages on the site, the duration of individual page view, paths taken by visitors through the site, data on visitors' screen settings and other general information. Maximum Potential Ventures uses and stores this type of information, as with that obtained from other cookies used on the site, to help it improve the services to its users. Further information regarding the way in which this information is obtained and used can be obtained by contacting us.
When we share data
We don't sell your personal data.
We share it only with trusted service providers under strict contracts—hosting, storage, email, support, analytics, payment processors, and AI model providers. We may disclose your personal information to any of our group of companies.
We may also disclose your personal information to third parties:
- In the event that Maximum Potential Ventures sells or buys any business or assets
- If Maximum Potential Ventures or substantially all of its assets are acquired by a third party
- If we are under a duty to disclose or share your personal data to comply with any legal obligation
International transfers
Your data may be processed outside Malaysia. We use recognised safeguards (contractual clauses, consent, or necessity to deliver the service). Ask us if you'd like details of current locations.
How long we keep data
Only as long as needed for the purposes above and to meet legal requirements. You can request deletion; we also periodically delete or de-identify inactive data.
Guest users (no account)
If you make purchases as a guest i.e., without creating an account, we handle your files to deliver the service and keep the platform secure.
What we keep (guest orders)
Your uploaded CV/resumé and related files, the related output; order details (email, transaction ID, timestamps); limited device/usage logs (e.g., IP, browser); and our communications.
Why we keep it
To provide support, handle disputes/chargebacks, prevent fraud/abuse, ensure security, maintain backups/business continuity, and comply with accounting/tax and legal-claims obligations. These purposes align with Malaysia's PDPA (processing necessary for the purpose collected) and—where GDPR/UK GDPR applies—contract necessity and/or our legitimate interests, with safeguards.
How long we keep it
- CV files & output: retained for 24 months after delivery for support, disputes and anti-fraud, then deleted or anonymised.
- Order/billing records: retained for 7 years (legal/tax).
- Security/usage logs: 90–180 days (longer if investigating fraud/abuse).
- Backups: items may persist in encrypted backups that roll off on a 30–90-day cycle; they aren't used for any new purpose.
Security
We use reasonable technical and organisational measures—encryption in transit, access controls, least-privilege, logging, backups, and regular patching. No system is perfect, so please keep your password safe.
Your rights
Malaysia (PDPA)
Access, correction, and the right to withdraw consent (which may limit features).
EEA/UK (GDPR)
Access, correction, deletion, restriction, portability, objection, and rights around automated decisions.
To exercise any rights, email culminaite@gmail.com. We'll verify your identity and respond within the timelines set by law.
Children
Our services are for users 18+. If we learn we've collected a child's data without proper consent, we'll delete it.
Third-party links
Our site may contain links to and from the websites of our partner networks, advertisers and other third parties. If you follow a link to any of these websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
Changes to this policy
If we make material changes, we'll post them here and, when required, notify you. The updated policy takes effect when posted (or as the law requires).
Talk to us
Questions or requests?
Maximum Potential Ventures
Jalan BU 11/7, Bandar Utama, 47800 Petaling Jaya
culminaite@gmail.com
If you're in Malaysia and have unresolved concerns, you can contact the Jabatan Perlindungan Data Peribadi (JPDP).