Privacy Policy

Last updated: 26 October 2026 (night)

This is the English version of our Privacy Policy, provided as required by section 7(3) of the Personal Data Protection Act 2010. The Malay version is available at Dasar Privasi (Bahasa Melayu). If there is any conflict or inconsistency between the two versions, the Malay version prevails.

This Privacy Policy explains how ADMIN SISTEMGURU.MY (SSM-registered business No. 202303325253 / CT0130955-T, Kajang, Selangor), the operator of SistemGuru.My, collects, uses, stores and protects personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and its amendments.

This Policy covers two groups: teachers who register an account, and pupils whose data is entered by teachers or who use the Pupil Portal.

1. Teacher Information We Collect

Account information: username (which may be your e-mail address) and password (stored in encrypted / hashed form, which cannot be read by anyone, including us).
Profile & setup: full name, school name, state, school level and type, prayer time zone, photo/logo, timetable, school calendar, records of your own absences (with reasons), settings (including RPT distribution settings) and your chosen prompts, and unsaved lesson plan (RPH) drafts (so they can be resumed on another device; deleted once the RPH is saved).
Calendar subscription link (Google Calendar): if you press Google Calendar in the School Calendar, we generate a secret link unique to you. The iCalendar feed at that link contains only your own calendar — session dates, school week numbers, holidays and events — without names, e-mail addresses or pupil data. We record when the link was last read. Anyone who has the link can view that calendar; press regenerate link to cancel the old link immediately. The app does not request access to your Google Calendar. The link is deleted together with your account.
Work documents: yearly plans (RPT), lesson plans (RPH), notes, exercises, questions, test specification tables (JSU), analyses, intervention plans, action research and other documents you create.
Google information (if you sign in with Google or connect Drive): your Google name and e-mail address, and access tokens to save files to your Google Drive.
Subscriptions & transactions: plan, expiry date, trial status, and payment records (amount, ToyyibPay bill code and transaction reference, status). The phone number you enter at payment is sent directly to ToyyibPay and remembered in your browser only — we do not store it on our server. We never receive your card number or banking details.
Shop purchases: products purchased, amount, payment reference and number of downloads.
Support: your posts, comments, likes, shares and reports. Bug reports also automatically record the device and browser type to help us fix problems.
Technical & usage data: login sessions for each device (including browser/user agent information and time last used), monthly AI usage counts (numbers only, not prompt content), monthly Bank retrieval counts, and internal usage statistics (e.g. pages and tools opened, documents downloaded, visit sources such as social media links, device and browser type). These statistics are collected by our own system using a random browser identifier (not your name, e-mail or IP address — IP addresses are not stored) and are used only to improve the site. AI generation results are stored temporarily on the server so they can be delivered to your browser, and are discarded after about a day. In addition, we use Meta Pixel to measure the effectiveness of our ads on Facebook, Instagram and Threads, only after you consent (see Sections 4, 6 and 6A).
Competition judges & second assessors (Tools, no account): teachers may invite judges to assess through a QR link and an 8-digit PIN. Judges do not register an account and we do not collect judges' names, e-mail addresses or phone numbers — only the label set by the teacher (e.g. "Judge 1"), scores and short notes the judge enters. The PIN is stored in encrypted form and judge sessions end with the event period (at most 12 hours per session). For the teacher's audit, each login, failed attempt, save, submission and reopening is recorded together with the time and a hash of the IP address — not a readable IP address. Judges see participant labels (e.g. "Participant 01"); participant names are shown to judges only if the teacher chooses so for that event. Logs and scores are deleted when the teacher deletes the event or their account.
Teacher Innovation applications (no account): the form at /inovasi/mohon.html collects your name, e-mail, phone number (optional), school, state, subject, details of your innovation idea, package choice, your consent and your name typed as a signature, as well as a hash of your IP address to prevent spam. This information is used only to assess the application, prepare a quotation and contact you, and is not shared with other parties. Your name, school and photo are displayed on the Teacher Innovation page only with your permission. The Hosting Transfer form is paid directly: the phone number is mandatory on that form, and your name, e-mail, phone number and payment amount are sent to ToyyibPay to generate a bill; the status and bill code are stored with the application.
Hosted Teacher Innovations (e.g. UTQH TURBO at /inovasi/utqh-turbo/): each visit records the time, the page or topic opened, the device type (phone/tablet/computer) and browser type, and a daily hash of the IP address and browser to count unique users and prevent spam. The actual IP address is not stored. These statistics can be viewed only by the teacher who built that innovation (with an admin code) for school reports and action research. Pupil progress records (topics completed, Acceleration Plan) are stored on the pupil's device only.
Usage statistics for Teacher Innovations & Your Games (since 11 October 2026): each time an innovation page at /inovasi/<name>/ is opened, we record the innovation name, date and time, whether it was opened in the SistemGuru.My app, the device type (phone/tablet/computer) and a daily hash of the IP address and browser (to count unique visitors and prevent spam). The actual IP address is not stored and the hash changes every day, so visitors cannot be tracked across days. These statistics, together with pupil score records already stored by that innovation's game/quiz (name, class and school typed by the pupil, score, XP, level), are displayed only to the teacher who built that innovation in their SistemGuru.My account (Teacher › Your Innovations / Your Games) and to site administrators, for school reports, action research and improving the innovation. Ownership is assigned by the administrator and checked on the server each time data is requested.
P AI-KBAT (/inovasi/p-ai-kbat/): question text is sent to our AI provider to draft an answer; question images (if scanned) are sent to the AI provider to read the text, or read directly in your browser, and are not stored. Student names and answer history are stored on your device only. The server stores only a hash of the IP address for 3 days for usage limits.
Agent English (/inovasi/agent-english/): the device camera is used (after the browser asks for permission) to detect hand movements. Camera images are processed in your browser only by the MediaPipe model and are not sent to our server or any other party, and are not recorded or stored. Model files are downloaded from CDNs (jsDelivr and Google) when a mission starts. Game scores are not stored.
Arena Hikmah (/inovasi/arena-hikmah/): the device camera is used (after the browser asks for permission) to detect the hand movements of squad representatives. Camera images are processed in your browser only by the MediaPipe model and are not sent to our server or any other party, and are not recorded or stored. Model files are downloaded from CDNs (jsDelivr and Google) when the camera is activated. Squad names and scores are for the current session only and are not stored.
Wira Tasawwur (/inovasi/wira-tasawwur/): at registration, the name, nickname, class, school (optional), form, character gender and avatar are stored on our server together with Battlefield Challenge scores, XP, stars, answering time, character equipment, platoon (names of members typed) and KBAT (higher-order thinking) practice answers, so that progress can be resumed on another device with a recovery code (stored as a hash only) and reviewed by the teacher who built that innovation (with an admin code, including CSV export). The public Top 10 ranking shows only the nickname, class, rank, XP, stars and time. The server stores a daily hash of the IP address and browser for rate limiting; the actual IP address is not stored. Pupils may reset their own progress and the teacher may delete records at any time.
MADVENTURE (/inovasi/madventure/): when a pupil completes the Final Challenge, the name and class typed by the pupil, score, percentage, total XP, answering time and date are stored on our server for review by the teacher who built that innovation (with an admin code, including CSV export) and for the public Top 5 ranking (name, class, XP, percentage and time only). The server stores a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. Mission XP and missions explored are stored on the pupil's device only. The teacher may delete records at any time.
Operasi Sayap Iman (/inovasi/sayap-iman/): each time a pupil completes a mission or opens the Operation Report, the name and class typed by the pupil, round serial number, score, percentage, grade, number correct/not yet correct/unanswered, XP, rank, number of missions completed, badges, scores by category and play time are stored on our server for review by the teacher who built that innovation only (with an admin code, including CSV export); there is no public board. The server stores a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. Answers and game progress remain in the pupil's device browser. The teacher may delete records at any time.
Operasi Terjun Iman (/inovasi/terjun-iman/): each time a pupil completes a mission or opens the Operation Report, the name and class typed by the pupil, round serial number, score, percentage, grade, number correct/not yet correct/unanswered, XP, rank, number of missions completed, badges, scores by category (Facts, KBKK, KBAT) and play time are stored on our server for review by the teacher who built that innovation only (with an admin code, including CSV export); there is no public board. The server stores a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. Answers and game progress remain in the pupil's device browser. The teacher may delete records at any time.
Gempur Tasawwur (/inovasi/gempur-tasawwur/): for the leaderboard, the nickname and class (optional) typed by the pupil, points, rank, active days, date last played and the stars and best score for each mission are stored on our server together with a random device identifier (without full name or e-mail). Nickname, class and points are shown to other players on the leaderboard; the teacher who built the innovation can view and delete records with an admin code (including CSV export). In multiplayer rooms, nickname, rank, position and current score are shared with players in the same room and automatically deleted within 2 minutes of leaving. The server stores a daily hash of the IP address for rate limiting; the actual IP address is not stored.
Operasi Detektif Lughah (/inovasi/detektif-lughah/): when a pupil starts playing, solves a case, passes the Knowledge Clinic or a case is frozen, the name, class and school typed by the pupil, chosen detective, IQ, XP, list of cases solved and frozen, clinics passed, and the date and verification code of the Certificate of Achievement are stored on our server (without e-mail). This data is not shown to other players; only the teacher who built the innovation (logged in to a registered account or with an admin code) can view, export (CSV) and delete it. Game progress is also stored in the pupil's own browser. The server stores a daily hash of the IP address for rate limiting; the actual IP address is not stored.
Pokok Islam (/inovasi/pokok-islam/): when a pupil reaches the RM500 target, the name, class and school typed by the pupil, amount of game money, number of days, mode (Solo or Challenge) and date are stored on our server for the public Top 5 scoreboard (name, class, school, money and days only) and for review by the teacher who built that innovation (with an admin code, including CSV export). The server stores a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. Game state (money, days, garden) is in the browser only, and the last name, class and school are remembered on the pupil's device for easier re-entry. The teacher may delete records at any time.
Misi Iman (/inovasi/misi-iman/): when the Mission Report is displayed, the full name and class typed by the pupil, score, percentage, points, title, number of badges, time taken, correct/wrong answers for each question and date are stored on our server for review by the teacher who built that innovation only (with an admin code, including CSV export). The server stores a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. The last name and class are remembered on the pupil's device for easier re-entry. The teacher may delete records at any time.
Misi Menakluki Gunung Kinabalu (/inovasi/misi-kinabalu/): each time a pupil presses Check Answer, the answer text together with the question is sent to our AI provider for checking, and the answer, score and AI feedback are stored on the server together with a random device session identifier (without name). When the mission ends, the name and class typed by the pupil, first-attempt score, best score, rank, answering duration and score for each question are stored as a score record for the teacher who built the innovation (protected by an admin code, exportable to CSV and deletable by the teacher). Progress and answers are also stored on the pupil's device (localStorage). IP addresses are not stored; only a daily hash for rate limiting.
Pokok Al-Quran SPM 2026 (/inovasi/pokok-alquran-spm/): each time a pupil completes a level, the name, class and school typed by the pupil, total XP, coins, best score for each level, number of rounds and correct answers and the date are stored on our server for the public player ranking (name, class, coins, XP and level only) and for review by the teacher who built that innovation (with an admin code, including CSV export). The server stores a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. Game progress (XP, coins, level scores) is also stored on the pupil's device so it can be resumed, and the last name, class and school are remembered for easier re-entry. The teacher may delete records at any time.
LEXI27: Budget 2027 Lexicon Challenge (/inovasi/lexi27/): when a player completes 20 questions, the name, state and age category typed by the player, score, number correct and wrong, time, rank and certificate number are stored on our server for the leaderboard and for review by the teacher who built that innovation (with an admin code, including CSV export). The public leaderboard shows name, state, rank, score and time only; the age category is not shown. The PDF certificate is generated in the player's browser. The server stores a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. The teacher may delete records or close the leaderboard at any time.
Skor A+ Respon Terhad (/inovasi/skor-a-respon-terhad/): practice progress (XP, badges, mastered points, Fact Cards) is stored on the student's device only. When a student completes Pecutan 40 or the Year-End Paper, the name, school and class typed by the student, marks, percentage, grade, percentage by chapter, time and certificate number are stored on our server for the leaderboard and for review by the teacher who built the innovation (account sign-in or admin code, including CSV export). The public leaderboard shows the first name and the initial of the second name, class (class and school boards only), percentage, grade and time. The PDF certificate is generated in the student's browser. The server keeps a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. The teacher can delete records at any time.
Misi Detektif Bahasa Arab SPM (/inovasi/detektif-arab-spm/): each time a pupil registers, checks an answer or uses a hint, the name of the pupil or group, class, school and chosen detective character, XP, coins, accuracy, worlds completed, hint usage and answer log (card, choice, correct or wrong) are stored on the server for the scoreboard and for review by the teacher who built it (with an admin code). The public scoreboard shows name, class, school, character, XP, coins, accuracy, worlds and badges. IP addresses are not stored.
Misi Armada Iman (/inovasi/armada-iman/): when a pupil completes a mission, the name, class and school (if filled in) typed by the pupil, achievement code, answers to each question, score, level, badges, time taken and date are stored on our server for the public leaderboard (name, score and level only) and for review by the teacher who built that innovation (with an admin code, including CSV export). The server stores a daily hash of the IP address and browser to limit repeated submissions; the actual IP address is not stored. Mission progress and audio/animation settings are stored on the pupil's device so they can be resumed. The digital certificate is generated in the browser. The teacher may delete records at any time.
Cabaran Spartan Bahasa Arab SPM (/inovasi/spartan-arab-spm/): when a pupil reaches the Results screen after 50 questions, the full name and class typed by the pupil, score, answers to each question and play duration are stored on the server for review by the teacher who built it (with an admin code). There is no public scoreboard. The last name and class are also remembered on the pupil's device. IP addresses are not stored.
Interactive Notes (/nota-interaktif/, no account): unit progress, answers and scores are stored in your browser only (localStorage) and are not sent to our server; typed reflection answers are not sent anywhere. When you generate a Certificate of Appreciation, we store the certificate code, note name, date, name initials only (e.g. "N. A. binti A.") and a hash of the full name for QR verification at /sah.html — not the full name. Request counts per IP address (in hashed form) are used to limit repeated certificate generation.
Security & abuse-prevention data: failed login attempts (username attempted, IP address and time), new account registrations (IP address and time) and failed password attempts when deleting an account are recorded to limit repeated attempts. These records are purged periodically after about a day, and failed logins for a username are cleared as soon as a login succeeds.

2. Pupil Data

Pupil data is entered by teachers, not collected directly by us. Pupils do not register accounts and we do not collect pupils' e-mail addresses or phone numbers.

Pupil list: name, nickname or short name (optional; generated from the name when left blank), gender (optional) and class. We do not collect or store pupils' identity card numbers. Pupil Portal PINs are stored in encrypted form. Pupils removed from the list or marked inactive (transferred/left, with the reason & date chosen by the teacher) are not deleted — their attendance and assessment records remain until the teacher's account is deleted, and the teacher may reactivate them.
Teaching & assessment records: attendance for each period (Present, Absent or Left Early, and the reason), Mastery Level (TP), Overall TP and classroom-based assessment (PBD) level, SPPB reporting information you fill in (pupil effort, teacher comments and suggested interventions), exercise answers and scores, test scores for each question (Exam), status and evidence notes, intervention notes, analyses and action research, and Class Aquarium records (good deeds, problems and short notes recorded by the teacher). In the Pupil Portal, fish size, level and number of wounds are shown to pupils of the same class; teacher notes are never shown to pupils. At school (River) and Malaysia (Ocean) level only the nickname + initial (or “Murid SG-xxxx” if the pupil chose to hide their name), fish size and school are shown; wounds are only shown as class or school totals without pupil names. The same Ocean and River views can be watched publicly at /akuarium/; a Class Aquarium can only be watched publicly through a random share link generated by the teacher (the teacher can regenerate or close it at any time), with nicknames only and no per-pupil wounds. Pearl rewards and fish accessories are stored with these records. All are deleted when the pupil or the teacher account is deleted.
Pupil Portal: pupils log in with a class code, full name and PIN. They see only the notes and exercises published for their class, submit answers, and see their own records: attendance recorded by the teacher, Mastery Level (TP) recorded by the teacher or calculated from exercises (including the Overall TP set by the teacher), and scores of submitted exercises. Pupils cannot see other pupils' records, the teacher's observation notes, the teacher's SPPB comments, or pupil level labels. Sessions end after 12 hours. To prevent PIN guessing, failed attempts are counted in a 15-minute window for each pupil (10 times), each IP address and each class; when the limit is reached, login is blocked for 15 minutes. These counters are stored as hashes — pupil names and IP addresses are not stored in readable form.
Interactive Notes sync & Cards/Certificates (11 Oct 2026): to keep progress consistent across devices, we store a copy of note progress (units completed, stars, estimated TP, accuracy and current step) linked to a teacher account, a Pupil Portal account, or a random device identifier (for users without an account). Studying Interactive Notes requires logging in to an account or the Pupil Portal; guests may view pages, unit lists and rankings. Each Congratulations Card, Mastery Card and Certificate of Appreciation generated is registered with a serial number, verification code, TP, date and the full name typed by the user (shown on the card so that teachers can identify the pupil; only the account owner can view the list). The public page /sah.html shows only initials and verifies the full name via a hash, and it is shown on the "Your Cards & Certificates" page and their count in the Ranking. Guest device records are moved to the account when the user logs in. Account data is deleted with the account.
Profiles, Chat & Notifications in Games (since 13 October 2026): logged-in players may display a public profile to other players (first name and initial of the second name, profile picture, and optionally school name, state and motto — school and state are not shown unless the player turns them on in My Profile). Chat messages in each game (text, emoji and SistemGuru.My game links) are stored on our server together with the user ID and time, and can be seen by other players of the same game. Messages are filtered automatically (links, e-mail addresses, phone numbers and profanity are rejected); messages reported by three players are hidden, and reports are kept for review. "Ranking overtaken" notifications are generated from ranking scores and shown only to the player concerned. Do not share personal information in Chat.
XP & Champions Board (Pupil Portal): when a pupil logged in to the portal completes an Interactive Notes unit or plays Games from the Explore menu, we store total XP (overall, weekly, monthly and daily), number of units, Mastery Cards and notes completed, day streak, and the last note or game opened. The Champions Board (Class, School, State and Malaysia) can only be seen by pupils logged in to the portal and shows first name and initial only (e.g. "Aisyah A."), school name and state (from the teacher's profile), and class on the Class and School boards. Full names, identity card numbers and photos are not shown. Pupils may choose Hide name to be shown as "Murid SG-xxxx". For each Interactive Notes unit completed through the portal, we also store the estimated TP, stars, first-attempt accuracy and accuracy for each cognitive level; these details are shown only to that pupil's own teacher as suggested PBD evidence, and TP is recorded only if the teacher confirms it. Note and game progress in the browser is separated by pupil because school devices are shared. This data is deleted with the teacher's account.
Pupil work (images, PDFs, audio, video) uploaded as evidence is not stored on our server — it is sent directly to the teacher's Google Drive. We store only its link.
Voice recordings (Tools): teachers may record audio (e.g. dictation read by the teacher or a speaker) through the device microphone, only after the browser asks for permission. Recordings are stored in that device's browser only or, if the teacher chooses, sent directly to the teacher's Google Drive (Pro plan). Recordings are not stored on our server; we store only the Drive file identifier so that subsequent submissions update the same file. Recordings in the browser are deleted when the teacher logs out. Teachers are responsible for obtaining the speaker's permission in line with school policy.
Certificates & verification QR (Tools, Ultra plan): the recipient's name is printed on the certificate in the teacher's browser. If the teacher turns on QR verification, we store the serial number, event name, school, date, recipient's initials only (e.g. "A. bin A.") and a hash of the name — not the full name. Anyone scanning the QR sees these details and those initials; a full name typed for verification is compared with the hash and is not stored or recorded.
Letters & parent messages (Tools): WhatsApp message text is generated in the browser and opened through a WhatsApp link without a phone number — the teacher chooses the recipient in WhatsApp themselves. We do not store parents' phone numbers. Letters and pupil lists containing pupil names are saved to the teacher's Google Drive as PDFs (with no copy on our server).
Quick pupil records (Tools): literacy records (reading & Jawi screening), Quran & worship practical records, and fitness/BMI data (SEGAK) are sensitive data: stored for the owning teacher only, not shown in the Pupil Portal, with no document copy on the server, and deletable per pupil. Pupils' voice recordings are stored directly in the teacher's Google Drive; file names do not contain full names. Essay text pasted for AI suggestions is not stored and names are replaced with labels before being sent. For each record, we store only the minimum fields needed (mark, score or band, session date and the teacher's short note) in the teacher's account; PDF reports are generated in the teacher's browser and saved only to the teacher's Google Drive.
Projects & coursework (Tools): teachers record pupil progress by phase, criterion scores and guidance logs. If the teacher opens the project in the Pupil Portal, pupils can see the phase and status of their own project only, write short logs (1000-character limit; pupils are reminded not to write personal information) and, if the teacher subscribes to the Pro plan, upload evidence (images or PDFs, up to 8 MB). Evidence files are sent directly to the teacher's Google Drive and are not stored on our server; we store only their links in the project log. Teacher notes are shown to pupils only if the teacher chooses to show them.
Class Share Code (Tools): a class teacher or head of subject panel may create a code so that other teachers send scores, TP or summaries to them. Senders must tick consent before each submission, can see their list of submissions and can withdraw submissions at any time. Codes expire according to the period chosen (7 to 60 days); submissions are deleted automatically after 365 days or when the code owner deletes them. Checking a code does not reveal pupil data. Panel summaries (practicals and essay moderation) are sent without pupil names. Every create, check, send, withdraw, use and delete action is recorded in an audit log without pupil data.
Conduct & Behaviour Records (Tools): incident notes, positive behaviour and ABC Mode for pupils in your class (minimum fields; no identity card numbers and no diagnoses). Only the account owner can see them; they can be deleted at any time and are deleted automatically 1 year after the pupil is marked as having left. Notes sent to AI (optional) have names masked.
Inclusive Material Adapter (Tools): accommodations and adapted versions of material for pupils you select (account owner only). Pupil Portal assignments targeted at selected pupils use the existing class code and PIN.
Counselling Session Log (Tools) — CONFIDENTIAL: records are encrypted in your browser with your passphrase; the server stores only the encrypted text and cannot read it. If both the passphrase and the recovery key are lost, the records cannot be recovered. No AI and no automatic sending to Google Drive; only anonymous statistics can be exported.
IEP (RPI) Builder, Preschool Anecdotal Notes, Art Portfolio and Vocational Competency Tracker (Tools): observation notes and pupil progress records (minimum fields; account owner only; deletable). Pupils' work is stored only in the teacher's Google Drive, and the gallery does not show faces.
CEFR Level Tracker (Tools): pupils' CEFR profiles (account owner only; deletable). Panel packs, the KOMSAS bank and the proverb bank contain no pupil data.
Pupil submissions through the Portal for new Tools: exercise answers, program code and Code Lab pass/fail results, reflections, rhythm taps and interest inventories are submitted using the existing class code and PIN, and are deleted together with the exercise or the teacher's account.
Sports Tournament Manager (Tools): participant names and event results. Result recorders use a temporary tokenised link (expiring in 48 hours) without an account; tokens are stored in hashed form only.
Laboratory Inventory & Safety (Tools): incident records are kept without pupil names and without medical details.
Islamic Studies Tools (Tools): Hijri calendar, zakat and inheritance (faraid) calculations are performed in the browser. Quranic verses and hadith are displayed verbatim from a closed corpus (not AI-generated). Prayer/spiritual programme attendance shared with coordinators is only in the form of aggregated summaries without pupil names through a tokenised link that expires in 60 days.
Camera, screen & media files (Tools): some Tools (e.g. Screen & Camera Recorder, QR Code Scanner, Camera Answer Marker, Signature to PNG, Face Blur, Video Compressor, Audio Cut & Merge) use the device camera, microphone or screen sharing only after the browser asks for your permission, and process video, audio and images in that device's browser only. Media files, camera images and screen recordings are not uploaded to our server; results are downloaded directly to your device. Salary, allowance and date figures in the Teacher Finance calculators are also calculated in the browser and only the options/rates you adjust are remembered in that browser. Teachers are responsible for obtaining permission before recording or sharing pupils' images in line with school policy and the PDPA.
Classroom Tools: the Class Noise Meter uses the microphone only to measure sound levels live — sound is not recorded or stored. The Document Camera displays the camera on screen and captured images remain in the browser until you download them. Question sets, name lists and Hall Pass logs are stored in that device's browser only. Pupil play links (Word Guess, Escape Room, QR Treasure Hunt) carry the game content inside the link itself and are not sent to our server; do not put pupils' personal information into shared games.
Assessment Tools: scores, answers and pupil names pasted into analysis tools (e.g. Score Statistics & Distribution, Test Reliability, Objective Answer Copying Detector, Correction Sheet) are processed in your browser and are not sent to our server. Class Answer Cards use the camera only to read the cards held up by pupils; images are not stored. Self-Check Quizzes carry the questions inside the link, and the pupil's score code is shown on the pupil's phone only until handed to the teacher.
Tools without login: pupil names pasted into Tools by users who are not logged in are stored only in that device's browser and are not sent to our server. For logged-in users, Tools drafts in the browser are tagged with the owner's account and deleted on logout or when the account is deleted.
Shared class list (Tools): the "Use class list" button reads your account's Pupil List (existing) or the list stored in this device's browser. Names pasted into Tools are saved to the Pupil List on our server only if you log in and press Save in the confirmation dialog; new names are added without removing existing pupils. Without that confirmation, the list stays in the browser only.

For pupil data, teachers and their schools decide what data is entered and what it is used for. We process that data on behalf of teachers, solely to provide the Service, and do not use it for any other purpose. Parents or guardians who wish to access, correct or delete their child's data should contact the teacher or school concerned; we will help the teacher fulfil such requests.

2A. Children's Data & the Role of Teachers/Schools

Users under 18: pupils and players under 18 years of age may use the Pupil Portal, Interactive Notes, Games, teacher innovations or any feature that processes their personal data only with the consent of a parent or guardian, or under the supervision of a teacher or school as part of a learning activity. A parent or guardian who creates or permits an account for their child is responsible for the use of that account.
Teachers/schools as data controllers: for pupil data entered by teachers (e.g. pupil lists, attendance, PBD, Tools records, Pupil Portal submissions), the teacher and their school are the data controller — they decide what data is collected and why, and are responsible for obtaining any required permission. SistemGuru.My acts as a data processor that processes that data on the teacher's instructions, solely to provide the Service.
Minimal data: we do not ask for pupils' identity card numbers, e-mail addresses or phone numbers, and features that send text to AI replace pupil names with labels before sending (see Sections 4 and 4A).
If you are a parent or guardian and believe your child's data is being processed without consent, contact the teacher or school concerned, or contact us (Section 11); we will review and, where appropriate, delete that data.

3. Purposes of Collection

To provide, maintain and improve the Service;
To generate and prepare documents automatically — your profile, school, timetable, calendar and RPT are used as the basis for RPH, notes, exercises, PBD, JSU, Exam, analyses, interventions, action research and other modules;
To provide the Pupil Portal and record attendance and assessment on behalf of teachers;
To provide the Shared Banks (see Section 5);
To process subscription and Shop payments, and to manage plan access, trials, device limits and fair-use AI limits;
To save files to your Google Drive with your permission;
To operate Support, account security and abuse prevention;
To comply with legal obligations.

4. Disclosure to Third Parties

We DO NOT sell personal data. Data is shared only with service providers needed to operate the Platform:

Hostinger — the server and database provider where the Platform is hosted.
AI providers — when you use AI features, instructions and related data are sent to an AI model provider for generation. The current provider is DeepSeek; we may also use Anthropic (Claude), OpenAI or Google (Gemini). What is sent is curriculum content (subject, content and learning standards), lesson information and text you write. For Analysis, Intervention and Action Research, the Platform does not send pupil names — pupils are referred to by pseudonyms (e.g. "Pupil A") with summary statistics. Avoid typing pupil names in free-text fields that are sent to AI. In Tools, pupil names are replaced with labels (e.g. "Pupil A"), and identity card numbers and phone numbers are removed before sending; the Counselling Session Log, Quran/hadith text and Misconceptions do not send pupil data to AI. The Photograph timetable feature sends the timetable image you choose through OpenRouter to an AI model (e.g. Google Gemini) to be read; the image is not stored on our server, and only the timetable rows you check and save are recorded. The Upload RPT File feature sends the content of the RPT file you choose (Word text, or an image of each PDF page/image) in the same way; the file is not stored, and only the RPT you check and save is recorded.
ToyyibPay — payment gateway: name, e-mail, phone number and payment amount to generate a bill.
Google — Sign in with Google, Google Drive and Google Sheets, when you choose to use them. We use the limited drive.file scope: the Platform can only access files it created itself in your Drive, not any other files.
Cloudflare (Turnstile) — when anti-spam verification is enabled on the Register form (username & password), your browser loads the Cloudflare Turnstile widget, and Cloudflare processes your IP address and browser/device signals to detect bots. We send the verification token and your IP address to Cloudflare for verification. Cloudflare acts as a processor on our behalf.
Meta Platforms (Facebook, Instagram, Threads) — we advertise the Platform on Meta apps. Meta Pixel is loaded only after you consent through the cookie banner (Section 6A). When loaded, the Meta Pixel on our pages for teachers (not loaded in the Pupil Portal, pupil games or innovation pages used by pupils) sends Meta the pages visited, tools opened, account registrations, innovation applications (package type only) and payments (amount and product name), together with the IP address, browser information and Meta cookies (_fbp, _fbc). Our server also sends the same registration and payment events directly to Meta (Conversions API) together with a hashed account identifier. We do not send names, e-mail addresses, phone numbers or any pupil data to Meta. The purpose is only to measure ads and to show our ads to interested teachers. Meta processes this data under its own Privacy Policy. You can refuse it — see Sections 6 and 6A.
JAKIM (e-solat.gov.my) — only your prayer time zone code is sent to obtain prayer times.
Font and web library providers (Google Fonts, cdnjs, jsDelivr) — your browser downloads fonts and scripts from them, so they may receive your IP address as with any website.
Authorities — when required by law.

4A. Transfers of Data Outside Malaysia

In line with section 129 of the PDPA (as amended), we inform you that the following providers may process personal data on servers outside Malaysia:

DeepSeek (China) — the current AI model provider for AI features;
OpenRouter (United States) — an AI model router that forwards requests to models such as Google Gemini and other models (e.g. the Photograph timetable and Upload RPT File features and other AI features that use it);
Anthropic (Claude), OpenAI and Google (Gemini) (United States) — AI model providers we may use;
Google (United States and other locations) — Sign in with Google, Google Drive/Sheets, Google Fonts and MediaPipe model files;
Cloudflare (United States and global network) — Turnstile anti-spam;
Meta Platforms (United States and other locations) — Meta Pixel and Conversions API (only after consent);
cdnjs (Cloudflare) and jsDelivr (global network) — delivery of web libraries;
Hostinger — server provider; Hostinger International Ltd. servers in the Southeast Asia region, delivered through Hostinger's CDN with a node in Kuala Lumpur.

Basis for transfer: these transfers are made because they are necessary to perform the service you have requested (e.g. when you press an AI button, sign in with Google or save to Drive), or on the basis of your consent (e.g. Meta Pixel).

Safeguards:

only the minimum data needed for the task is sent;
pupil names are not sent to AI providers — pupils are referred to by labels (e.g. "Pupil A"), and identity card numbers and phone numbers are removed;
images and files sent for AI to read are not stored on our server;
to the extent stated in the relevant provider's API terms, data sent through the API is not used to train their models; we do not control providers' internal practices and rely on the terms they publish;
connections are made over HTTPS.

5. Shared Banks

RPH Bank: for Pro/Ultra accounts, complete RPHs you save (including those you write yourself) may be used by other Pro/Ultra teachers for the same lesson. Your name and identity are not shown to them. Your entries are deleted when your account is deleted.
Notes Bank & Question Bank: AI-generated content, and notes and exercises you write yourself only if you choose "Share to Bank". Other teachers who take it may submit an improved version. Content is not shown with your name. We record the original contributor's account and the last account that improved each row (not shown to other teachers) to detect abuse and return AI quota to contributors.
Bank version archive: each time Notes Bank or Question Bank content is replaced, the old version is copied to an archive together with the account ID of the old version's author and the account ID that replaced it, so that the administrator can restore content in case of abuse.
Therefore, do not include pupils' personal information in RPHs, notes or exercises.

5A. Sharing With School Administrators (Administrator Portal — optional)

If you join a school using a School Code and consent, that school's administrators (Head Teacher/Principal, Senior Assistant, Head of Subject Panel) can view your timetable, RPT and RPH, your weekly RPH compliance status and the date of your last account activity, for the purpose of reviewing teaching plans.
When an administrator reviews your RPH, a copy of that week's RPH is stored with the status ("Approved" / "Needs revision"), comments, and the reviewer's name and role, as a review record.
You may withdraw consent or leave the school at any time under Guru › Sekolah. Administrators then can no longer view your data; past review records remain as school records.
Positions (MySG): the positions you enter (e.g. Head of Subject Panel, Class Teacher) and related subjects are stored to determine your Administrator Portal modules. Administrative/management positions are confirmed by your school's Head Teacher/Principal or Senior Assistant (Administration).
Relief duty, lesson observation & SGM 2.0 competency: administrators may record relief schedules, and lesson observation scores and comments; you can view your own observation records. Your SGM 2.0 competency self-assessment is visible to administrators only as a school average, not as individual scores.
School timetable, PD records & My Class: administrators may store the school timetable (teacher names, classes, subjects, times) and publish it to teachers; the published timetable is used for daily relief. School in-service training (LDP) sessions record participants and hours; your self-recorded training stays private. Class teachers may view an attendance summary of their class recorded by subject teachers who have consented to sharing.
Examinations & role records: exam marks you submit are visible to administrators, the Exam Secretary, Senior Subject Teachers/Heads of Subject Panel (related subjects) and Year Coordinators (related year). Role records (discipline cases, textbook loans, hostel, special-needs pupils, enrolment, ICT reports and others) are visible only to the related roles; teachers who submit a report see their own reports. Guidance & Counselling logs are kept confidential to that teacher only. Pupil health records are visible only to administrators, the Senior Assistant (Student Affairs) and health staff; school finance records only to the Head Teacher/Principal and the Administrative Assistant (Finance). Pupil data is entered by the school as data controller; SistemGuru.My processes it on the school's behalf.

6. Data Storage & Security

Data is stored in a database on Hostinger servers. Passwords and pupil PINs are stored in encrypted form; connections to the Platform use HTTPS.
Document copies for Google Drive: when you save a module document to Drive or (Ultra) turn on scheduled delivery, the latest copy of that document (which may contain pupil names and assessment records) is stored on our server so it can be sent and updated in your Drive. This copy is deleted with your account.
Profile photos/logos are stored on our server and can be accessed through their link so they can be displayed in RPHs and printouts.
Your browser stores the login token (up to 30 days) as well as drafts and settings in localStorage; the Pupil Portal uses sessionStorage, which is cleared when the tab is closed. Random statistics identifiers (sg_vid in localStorage, sg_sid in sessionStorage) are not cookies and can be removed by clearing site data in the browser. Advertising cookies: after you consent (Section 6A), Meta Pixel sets the _fbp cookie (and _fbc if you came from an ad) to measure our ads — click here to refuse Meta Pixel in this browser. Otherwise, our own cookie is only the sg_oauth security cookie (HttpOnly, valid for up to 30 minutes), set only during the Sign in with Google flow (including DELIMa) or when connecting Google Drive, to ensure the flow is completed by the same browser that started it; it is removed as soon as the flow completes. Log out on public or shared computers.
Although we take reasonable security measures, no system is 100% secure. See Section 6B for what we do if a data breach occurs.

6A. Cookies & Tracking Technologies

Meta Pixel (_fbp, _fbc) — Meta advertising cookies. They are active only after you consent through the cookie banner, and are never loaded in the Pupil Portal, game pages or innovation pages used by pupils. Without consent, the Meta script is not loaded and these cookies are not set.
Google Sign-In & Google Drive — when you choose Sign in with Google or connect Drive, Google may set cookies on Google domains under Google's policies; our sg_oauth cookie (HttpOnly, up to 30 minutes) is used to secure that flow (Section 6).
Cloudflare Turnstile — on the Register form, the Turnstile widget processes browser/device signals and the IP address to detect bots; it is necessary for security.
CDNs (Google Fonts, cdnjs, jsDelivr) — load fonts and libraries; the providers may receive your IP address, but we do not use them for tracking.
Our browser storage — login token, drafts, settings and random statistics identifiers (sg_vid, sg_sid) in localStorage/sessionStorage (Section 6); these are not advertising cookies.

Withdrawing consent: you may withdraw your Meta Pixel consent at any time by using the "click here to refuse Meta Pixel" link in Section 6 (the _fbp/_fbc cookies are deleted and the script is no longer loaded in that browser), or by clearing site data in your browser settings. Withdrawal does not affect processing carried out before it.

6B. Data Breach Notification

In line with section 12A of the PDPA (as amended), if we discover a personal data breach, we will:

notify the Personal Data Protection Commissioner as soon as practicable, within the period and in the manner prescribed by law;
notify affected users without unnecessary delay where the breach is likely to cause significant harm, together with steps they can take to protect themselves;
take immediate steps to contain the breach, investigate its cause and prevent it from recurring;
for pupil data, notify the teacher or school concerned (as the data controller) so they can take appropriate action.

7. Retention Period & Account Deletion

Data is kept as long as your account is active. You may delete your account at any time through the Account page; for accounts with a password, the current password is required. 30-day recovery period: after you confirm deletion, the account is deactivated immediately and you are signed out of all devices, but the data is kept for 30 days. If you sign in again (password or Google) within that period, the deletion is cancelled and the account and all its data are restored. During those 30 days the account cannot be used and your classes' Pupil Portal cannot be accessed. After 30 days, the account and all the data below are permanently deleted automatically and cannot be recovered. Deletion runs as a single transaction — either all the data below is removed, or none is and you can try again. Deletion is permanent and removes:

account, profile, photo/logo, login sessions, Google tokens and unfinished Google login flows;
timetable, calendar, absence records, RPT, RPH and your RPH Bank entries;
all pupil data (pupil list, attendance, PBD, exercise answers, evidence, interventions, action research, class tags) as well as notes, exercises, questions and other module documents, including Tools document drafts (Minutes Taker, OPR, Brainstorm Minutes) and document copies for Google Drive;
your Support posts, comments, likes, shares and reports (including other people's comments and likes on your posts);
AI usage counts, temporary AI results and AI generation sessions, Bank retrieval counts and logs, and your module interest votes;
the certificate verification register (serial numbers, initials and hashes of recipients' names) — QR codes on certificates already printed can no longer be verified;
records of new Tools saved in your account: Conduct & Behaviour Records, inclusive adapted materials, Counselling Session Log (encrypted text), CEFR Tracker, IEP Builder, preschool anecdotes, art portfolio, vocational competencies, sports tournaments, Code Lab questions and submissions, Tools Portal assignments, Islamic aggregate summaries and simulation suggestions;
Quick Recorder Tools records (record sets and each pupil record: practicals, worship practicals, Jawi & reading screening, oral, SEGAK/BMI, Quran and essay marking);
project logs and evidence (links), competition events, judges, judge sessions, scores and your judge audit logs;
Class Share Codes you created together with all submissions and their audit logs, as well as submissions you sent to other teachers;
records of password attempts when deleting the account;
unpaid or failed bills, and your access to My Purchases in the Shop.

What remains after deletion:

Financial records — successful subscription payments and Shop purchases (amount, date, bill code) are kept without name, e-mail or account details (only the transaction reference number, which contains the old account's internal number, for audit purposes) for up to 7 years to meet tax obligations, then deleted. These records do not contain names, e-mail addresses or phone numbers;
content in the Notes Bank & Question Bank (AI content and content you shared or improved), without your name — references to your account as contributor or improver are set to empty (NULL);
the Notes Bank & Question Bank version archive, which continues to store the account IDs (numbers only, without names or e-mail addresses) of the old version's author and the replacing account, so that evidence of abuse and copies for restoring other teachers' content are not lost;
login and registration attempt records (including IP addresses) until they are purged periodically after about a day;
aggregated usage statistics (e.g. modules opened), which are no longer linked to you;
files in your Google Drive — they belong to you and we do not delete them. You may revoke the Platform's access in your Google account settings (Security › Third-party apps);
transaction records kept by ToyyibPay under their own policy.

Backups: the database and uploaded files are backed up daily to the SistemGuru.My administrator's Google Drive account in encrypted (AES-256) form; login tokens are not backed up. Backups are kept for at most about 5 weeks (7 daily + 4 weekly) and then removed, so deleted data may remain in backups until that period ends. Backups are used only to restore the service after a failure, not for any other purpose.

7A. Retention of Logs & Temporary Data

Technical, security and statistics records are deleted automatically every day (around 03:30 Malaysia time) after the periods below. Your account data (timetable, lesson plans, yearly plans, calendar, pupils, attendance, PBD) is not removed while your account is active, and financial records (invoices, orders, payments) are kept for up to 7 years as described in Section 7.

1–3 days: login/registration/code attempts (including IP) and Pupil Portal rate limits (1–2 days); hashed IP usage limits for P AI-KBAT, Tajwid Pintar and Misi Kinabalu (3 days); temporary AI sessions and results (1 day); expired Pupil Portal and judge sessions (1 day after expiry); PvP rooms, PvP emotes and game raid sessions (1 day); game notifications (2 days).
7–30 days: AI import counters (7 days); Meta ad measurement data (7 days); reference cache (30 days).
Device login tokens: removed after 60 days without use or 180 days after creation (whichever comes first).
90–180 days: game Chat messages (90 days; reported messages and their reports 180 days); Bina Tamadun raid logs (90 days).
12–13 months: Class Share Code audit logs (365 days); site usage statistics, landing page events, monthly AI and Bank usage counters, ranking adjustment logs and weekly/monthly game ranking scores (13 months; all-time game scores are kept while the account is active).
24 months: Teacher Innovation visit statistics (for school reports and action research by the innovator) and administrator action audit logs.

8. Your Rights (PDPA)

You have the right to access and correct your personal data (most of which can be done directly in the Platform), request a copy or deletion of data, withdraw consent, and limit processing. Withdrawing consent for data needed for the Service may mean we cannot continue to provide it to you. We will respond to requests within a reasonable time and as required by law.

Right of access & correction (section 30 of the PDPA) — view and correct your data (mostly directly in the Platform), or download a full copy using Muat turun data saya (Download my data) on the Account page;
Right to deletion — delete your account and data (Section 7);
Right to withdraw consent and limit processing (including Meta Pixel — Section 6A);
Right to data portability (section 43A of the PDPA) — you may ask for your personal data to be transmitted to you, or to another data controller you name, in a commonly used and machine-readable format, subject to technical feasibility. How to request: tap Muat turun data saya (Download my data) on the Account page › Account security to instantly download a copy of your account data (profile, timetable & lesson plans, yearly plans, calendar, absences, pupils, attendance, PBD, invoices, orders and payments) in JSON format (limit 3 times a day; passwords and tokens are not included); use the download/export buttons in each module (PDF, Word, Excel, CSV) and save to your Google Drive; or e-mail an export request to the address in Section 11 from your account e-mail, and we will prepare an export of your account data in a machine-readable format (e.g. CSV or JSON).

For pupil data, requests should be made through the teacher or school concerned (Section 2A).

9. Consent

By registering and using the Platform, you consent to the processing of data as described in this Policy. By entering pupil data, you confirm that you do so in your capacity as a teacher and with your school's permission.

10. Changes to This Policy

This Policy may be updated from time to time. The date of the last update is shown at the top of this page, and significant changes will be notified in the Platform.

11. Data Protection Officer & Contact

In line with section 12B of the PDPA (as amended), we have appointed a Data Protection Officer (DPO):

Officer: The owner of ADMIN SISTEMGURU.MY (sole proprietor) acts as the Data Protection Officer
E-mail: admin@sistemguru.my (subject: "Data Protection")
Postal address: ADMIN SISTEMGURU.MY, Kajang, Selangor (full registered address as recorded with SSM No. 202303325253; provided on request by e-mail)

For privacy questions, complaints, data requests or data breach reports, e-mail admin@sistemguru.my. If you are not satisfied with our response, you may complain to the Personal Data Protection Department of Malaysia.

↑ Back to top