Privacy Policy
This document will be reviewed by our legal advisers and updated before paid services open.
This policy explains how SOFT Cloud (cloud.soft.cc, operated by SOFT Group, “we”) collects, uses and protects your personal data. We handle personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).
What we collect
Account details: email address, password (stored only as a one-way hash), contact name and phone number; for business customers, the company name and registration number.
Verification documents: the company registration or identity document you upload. Files are stored encrypted; only staff responsible for review can open them, must record a reason, and every access is logged.
Transaction records: top-up orders, balance changes, invoices and refunds. Card details are handled by our payment providers; we never receive or store card numbers.
Usage and security records: sign-in times, source IP addresses, failed sign-ins and two-factor events, used to prevent account takeover and abuse.
How we use it
To open and maintain your account and cloud resources; to bill you, issue statements and process refunds;
To verify identity, prevent fraud and abuse, and meet legal obligations;
To send service notices such as email verification, password reset, charge reminders and planned maintenance. We do not send marketing email unless you separately agree.
Where it is stored
Account data and your cloud resources are stored in our facility in Kuala Lumpur, Malaysia.
Who we share it with
Payment providers: only what is needed to complete a payment you make.
Our network protection and content delivery provider (Cloudflare): website traffic passes through it for protection against attacks, and it processes access information such as your IP address.
Authorities where required by law. We do not sell or rent your personal data.
How long we keep it
Sign-in records: 30 days. Email verification and password-reset link records: 30 days. Sent-email records: 90 days.
Accounts whose email is not verified within 14 days are deleted; rejected verification documents are deleted after 90 days.
Account, transaction and billing records are kept as long as the law requires for financial records.
Cookies
We only use cookies needed for the site to work: your sign-in session, the two-factor step, a token that prevents forged requests, and your language choice. We do not use advertising or tracking cookies.
Your rights
You may access and correct the personal data we hold about you, withdraw consent, or ask us to delete it (except records we must keep by law).
Email [email protected]. To protect your account we may need to verify your identity first.
Security
Passwords are stored only as hashes; verification documents and contact details are encrypted; staff access to personal data requires a recorded reason and is logged; money-related operations require two staff members; all connections are encrypted in transit.
Changes
If we make significant changes, we will update this page and notify you by email.