Privacy Policy

S.C.R.I.P.T. AI — operated by Jonyehsi Studio (script-ai.co)

Last updated: 21 September 2026

1. Introduction

Jonyehsi Studio ("we", "us", "our") operates S.C.R.I.P.T. AI at script-ai.co (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices you have. It is written to comply with Malaysia's Personal Data Protection Act 2010 (PDPA).

2. What We Collect

Account and business information:

• Your name, email address, and contact details used to create and manage your account.
• Business profile information you enter into "Company Brain", including business name, industry, location, contact details, products/services, and business hours.
• Photographs you upload ("Uploaded Photos"), which may include images of people (e.g. yourself, staff, or customers), products, premises, or logos.

Content and usage data:

• Content you generate or save through the Service, including research, plans, images, video prompts, captions, and calendar entries.
• Basic usage data such as which features you use and how often, for the purpose of improving the Service and enforcing plan usage limits.

Payment information:

• Subscription and billing details. Payments are currently processed manually; if we introduce an automated third-party payment processor in future, this Policy will be updated to name it before it is used.

Facebook Page data (only if you connect a Facebook Page):

• If you use the "Connect Facebook Page" feature, we access — via Facebook Login and the Facebook Graph API — the list of Facebook Pages you manage, so you can choose which one to connect; a long-lived Page access token, stored securely on our servers, used only to publish content to that Page when you explicitly click Publish; and basic Page information (name and ID) shown back to you to confirm which Page is connected.
• We do not access your personal Facebook profile, friends list, or any Facebook content unrelated to publishing to your connected Page.
• You can disconnect your Facebook Page at any time from Account settings within the Service, which revokes our ability to publish on your behalf. You can also revoke access directly from your own Facebook Settings → Business Integrations.

3. How We Use Your Data

• To provide, operate, and maintain the Service, including generating the AI content you request.
• To publish content to your connected Facebook Page, only when you explicitly request it.
• To process your subscription and billing.
• To communicate with you about your account, updates to the Service, or these policies.
• To improve the Service, including understanding which features are used and diagnosing technical issues.
• To comply with legal obligations, and to detect, prevent, or address fraud, abuse, or violations of our Terms of Service.

We do not sell your personal data to third parties.

4. Sharing With Third Parties

To provide the Service, we share certain data with the following categories of third parties, solely for the purpose of delivering the specific feature you use:

• AI providers (including Anthropic and Google, for the underlying models used for text, image, and prompt generation) — your business information, prompts, and Uploaded Photos may be sent to these providers as needed to generate your requested content, subject to their own data handling and retention policies.
• Meta/Facebook — if you connect a Facebook Page, we send content and captions to Facebook's Graph API to publish on your behalf, at your explicit request.
• Cloud infrastructure and hosting providers (including Cloudflare, Modal, and Supabase) — used to run and host the Service and store your data securely.

We do not control how third-party AI providers or platforms you independently choose to use (e.g. Google Flow, Kling, Seedance/Dreamina) handle any prompt text or content you copy and submit to them directly — please review those platforms' own privacy policies before using them.

We may also disclose data if required by law, legal process, or to protect the rights, property, or safety of Jonyehsi Studio, our users, or others.

5. Data Storage and Security

• Some data (such as uploaded reference photos actively being used in your current session) is kept temporarily in your browser's local storage for performance, and is not always sent to our servers.
• Your saved content (Company Brain, calendar, gallery, history) and your Facebook Page connection are stored using a combination of browser-based storage and our backend database (Supabase), to allow you to access it across sessions.
• We take reasonable technical and organizational measures to protect your data, but no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your account and business data for as long as your account is active, and for a reasonable period afterward as needed to comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your data as described in Section 7.

7. Your Rights Under the PDPA

Subject to the PDPA and any applicable exceptions, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Withdraw consent to our processing of your personal data (which may limit or end your ability to use the Service).
• Request deletion of your account and associated personal data, subject to any data we are legally required to retain.

To exercise these rights, contact us at [email protected].

8. Photos of Other People

If you upload a photo that includes another person (e.g. staff, a customer, or a family member), you confirm that you have that person's consent to upload their image and have it processed by our AI tools and third-party AI providers as described in this Policy. You are responsible for obtaining and being able to demonstrate that consent.

9. Children's Privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from children. If you believe a child's personal data has been provided to us, please contact us so we can delete it.

10. Cookies and Similar Technologies

The Service uses only essential session/login cookies (via our authentication provider, Supabase) needed to keep you signed in. We do not currently use third-party advertising or analytics cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email where appropriate. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

For any questions about this Privacy Policy or how your data is handled, contact us at [email protected].