How project information is handled.

Service operator: TechWide Marketing Sdn Bhd Supported mode: ChatGPT Work Effective date: [TO CONFIRM — not effective while this document is a review draft]

1. Scope and contact

This policy describes the proposed privacy notice for Myvi Scene Chat, a free plugin for preparing Myvi product-sales prompts and storyboards in ChatGPT Work.

TechWide Marketing Sdn Bhd is the service operator identified for this draft. Its formal privacy role, registered address and company registration information, where required, must be confirmed before publication.

Privacy contact: nineless.my@gmail.com. Registered address / business details: [TO CONFIRM].

2. Information processed for the workflow

Depending on the features used and which transfers succeed, the service processes:

• Account-related identifiers: an authenticated user identifier supplied through the host integration, used to scope access to project records and files.
• Reference content: Product, Avatar / presenter and Banner images, filenames, file references and available image download URLs. Images may contain personal information, including a person's face or other visible details.
• Product-source information: a Shopee URL supplied by the user, readable listing evidence, product/variant information, product-image references and extraction status or failure reasons.
• Project information: product analysis, supplied facts and assumptions, confirmation state, video/design settings, naming choices, prompts, CUT plans, generated-photo references, annotations, revisions and export information.
• Stored media and files: reference images, generated CUT images or exported files when the relevant storage/export operation succeeds. Some images or files may instead remain available only through the ChatGPT host or the user's downloaded copy.
• Support content: information a user chooses to send to nineless.my@gmail.com. Mailbox access arrangements and support-message retention rules are not yet confirmed.

TO CONFIRM: production infrastructure logs, including whether IP addresses, user-agent details or request metadata are retained; any analytics, cookies, monitoring tools or other data collection outside the reviewed application code. The current code review is not proof that hosting providers keep no logs.

3. Why information is processed

The implemented workflow uses project information to:

• Identify the intended product and preserve the supplied reference identities.
• Request and retain analysis/settings confirmations.
• Prepare prompts, generate and arrange CUTs, and build storyboard outputs.
• Save project progress, annotations and revisions, and support reopening/recovery where the required files remain available.
• Scope stored project access to the authenticated account and check revisions and image references.

Publisher-selected operating policy — verification pending

The publisher has delegated the preparation of the following policy for the public service. These choices are recorded for review; they do not certify that production practices, access permissions or provider settings have been audited or changed.

• Permitted operator uses: carrying out the user-requested product analysis, generation and revision tasks; saving and reopening that project; responding to support/privacy requests; and necessary security, abuse prevention and legal compliance.
• TechWide will not sell or rent user content or reuse it for its own advertising, marketing or AI-model training. Generating marketing content that the user requests remains an intended service function. Any proposed additional use would require a separately disclosed purpose and any permission required before that use begins.
• Intended human access is limited to authorised TechWide personnel who need the information for a specific support, security or privacy task. Routine browsing of customer projects for unrelated purposes is not permitted. The personnel roster, least-privilege controls and actual access arrangements must be checked before publication.
• Access by another user is not permitted. Technical service providers may process information as needed to provide their part of the service, subject to their own applicable arrangements. Existing project-scoped application controls do not prove every operational account is correctly restricted.

This operator policy does not replace or make promises about OpenAI, hosting, email or other providers' independent processing or model-training settings. Those arrangements must be verified separately. Applicable legal bases, privacy roles, notices and consents must be resolved for the actual public operation before this draft becomes effective.

4. Services involved and disclosures

The current workflow relies on:

• OpenAI / ChatGPT: the conversation environment, connected-tool interaction, generation capabilities and host file features. OpenAI's processing is governed separately by its applicable terms, privacy notices and user settings.
• Application hosting and object storage: the current Sites-based implementation uses a Cloudflare Worker and an R2 storage binding for account/project-scoped records and successfully saved images/exports. The final provider inventory, contractual roles, processing countries, backups and operational access arrangements require confirmation.
• Shopee and relevant image hosts: when the user provides a listing link, the workflow requests the listing and product-image resources. Those hosts can receive the requested URL and ordinary connection information associated with the request. The reviewed listing-read path does not upload the user's Avatar or Banner to Shopee.
• Support email: the designated contact is a Gmail address, nineless.my@gmail.com. Support messages would be processed through that mailbox and its email provider. Mailbox access, provider arrangements and message retention still require operational verification.

TO VERIFY BEFORE PUBLICATION: the complete provider list, authorised personnel, processing locations, international transfers/safeguards, legal disclosures and implementation of the operator policy above. The selected no-sale/no-operator-training policy is not evidence of historical practice or of providers' independent settings. This draft does not claim that no personal data is collected, that no provider receives it, or that no provider may use it under its own terms.

5. Storage and access

The application scopes stored project keys and file access by authenticated account and project. It maintains project state and can preserve image copies to help reopen storyboards. These controls reduce unintended cross-account access; this draft does not promise absolute security or permanent file availability.

The standalone HTML editor may store a local editing/annotation draft in browser storage. A downloaded HTML storyboard can embed photographs and annotations. Anyone to whom you provide that file may be able to view the included content.

TO CONFIRM: staff access controls, encryption and backup arrangements, storage locations, security incident procedures, and any additional safeguards required for public operation.

6. Retention

The publisher has selected the following plan for implementation and verification:

• Each product project would have its own inactivity period. Preparing another product would not overwrite the earlier project or reset its retention period.
• Project records, confirmed settings, prompts, annotations, saved Product / Avatar / Banner images, saved CUT images and associated HTML / PNG exports would be retained together for 180 days after the last qualifying user activity.
• The proposed qualifying activities are a user deliberately reopening, editing or downloading that project. Automatic preview loads would not count as user activity. The activity tracking and retention reset are not implemented or verified.
• After 180 days without qualifying activity, the project would enter a 30-day grace period, intended to allow downloading or continued use before scheduled cleanup. A qualifying use during that period would restart the 180-day period. Grace-period notices and cleanup are not currently active.
• Following the grace period without further qualifying activity, the project and its associated stored files would be scheduled for deletion. This is a future plan, not a statement that existing records are being deleted on that schedule.

Reopening requires actual project and image files to have been saved successfully. Keeping a temporary host URL or file descriptor alone does not guarantee that an image remains available. Durable storage, recovery, activity tracking, grace-period behaviour and complete project cleanup must be implemented and verified before these periods are presented as an operational commitment.

The reviewed code assigns an expiry time to certain confirmation/request records. An expired confirmation is not evidence that the associated project, image or stored object has been deleted. A production storage-lifecycle policy has not been verified for this draft.

TO CONFIRM: the implementation and activation date; treatment of existing projects; precise notice and deletion scheduling; retention for request records, failed/unreferenced temporary files, logs, backups and support correspondence; and any applicable exceptions. No 7-day temporary-file period, 14-day deletion deadline or 30-day backup deadline has been adopted by this draft.

7. User requests and deletion

Designated deletion-request contact: nineless.my@gmail.com. This is the publisher-selected contact for the proposed deletion process; it does not establish that a deletion workflow or response deadline is already implemented.

The proposed process is for a user to email the contact above, identify the relevant project where possible, and request deletion. The operator would verify the requester's authority before deleting that project's backend records and associated stored images/exports. Users should not send passwords, sign-in codes or unrelated personal information.

IMPLEMENTATION PENDING / TO CONFIRM: how identity and project ownership will be verified; who can process a request; acknowledgement and completion times; how related records, images and exports will be located and deleted; backups; exceptions; and confirmation of completion. No deletion turnaround time is promised in this draft.

The reviewed plugin does not expose a general user-facing project-deletion tool. A deletion-request procedure must therefore be confirmed operationally rather than described as an existing button.

Clearing a browser's local draft storage does not establish deletion of backend records. Deleting a chat or disconnecting the plugin should not be assumed to delete separately stored project records. Independently downloaded or shared copies, and information controlled separately by ChatGPT/OpenAI, are outside this plugin operator's direct deletion control.

8. Content involving other people

Provide only images and information that you are authorised to use. Obtain any necessary permission from people shown in presenter/reference images. Avoid uploading sensitive or unrelated personal information, credentials or payment information.

Selected eligibility rule for the public service: account users must be at least 18 and have authority to use the submitted content. For the initial public release, do not intentionally submit identifiable images of anyone under 18. The handling of inadvertently received minors' information and any applicable consent or restriction still require verification. This is an operator policy choice, not a claim that the current plugin technically verifies ages or permissions.

9. Updates

Selected publication approach: show the effective date and any material policy changes on the public product/policy pages, and provide any additional notice or consent process required for the change. No retroactive expansion of content use is authorised by this draft. IMPLEMENTATION PENDING: the pages, notification process and effective date are not yet established. This review draft has no current effective date.