Incorporate a Sdn Bhd in ChatGPT, Claude or Grok

Privacy Policy

Last updated: 27 October 2026

Baca dalam Bahasa Malaysia. The English and Bahasa Malaysia versions say the same thing.

The short version

  • Who we are. Foundingbird Sdn Bhd (201901035214), part of the Corpseq group, is the data controller for this policy.
  • What we collect. What you type into our forms, what you give us to run your company secretarial work, and, in the app, ID photos, a selfie video and your signature for identity checks and approvals.
  • Why. To answer you, to do the work you hired us for, and to meet our duties under the Companies Act 2016 and anti-money laundering laws.
  • Who sees it. Our team, the authorities we file with (such as SSM and LHDN), your auditors and tax agents when you ask us to, and the service providers listed below.
  • We don't sell your data.
  • How long. Company records for at least seven years, because the law requires it. Enquiries from people who don't become clients, about 12 months.
  • Your rights. You can ask to see, correct, move or limit your data, withdraw consent, or delete your account. Email hello@foundingbird.com.

This policy is written under Malaysia's Personal Data Protection Act 2010 (PDPA), as amended in 2024. It covers three places: our marketing website, our client portal at portal.foundingbird.com, and our mobile app.

1. Who we are

Foundingbird Sdn Bhd (registration no. 201901035214) is a Malaysian company secretarial firm and part of the Corpseq group (Governance Labs). "We" and "us" in this policy mean Foundingbird.

Address: 7-2 Plaza Danau 2, Jalan 2/109f, Taman Danau Desa, 58100 Kuala Lumpur, Malaysia
Email: hello@foundingbird.com

2. Our marketing website

This is foundingbird.com: the pages you read before you become a client.

What you give us. When you fill in a form (for example to see pricing, get a guide or apply as a referral partner), we collect your name, email, WhatsApp number and anything else you type, such as your company name or notes. Form submissions go to our team's chat tool, Lark, so we can reply. Partner applications are also stored in our website database.

WhatsApp. When you tap a WhatsApp button, we record which button you tapped, the page, the time, your IP address, your approximate location (country, region and city, worked out from your IP), your browser and the page you came from. We use this to see which pages bring in enquiries. The chat itself then happens on WhatsApp, which is run by Meta under its own privacy policy.

Analytics and ads. We use:

  • Umami, an analytics tool we host ourselves at umami.foundingbird.com. It counts visits and clicks without advertising cookies.
  • Google Tag Manager, Google Analytics and Google Ads. These tell us how people find and use the site and whether our ads work. Google may set cookies and receive your IP address and device details.

Cookies and your browser's storage. Besides Google's cookies, the site stores a few small items in your browser: your cookie choice, your language, whether you've already filled in a pricing or guide form (so we don't ask again), whether you closed a pop-up, and, if you arrived through a referral link or an ad, the referral code and campaign tags for up to 90 days.

Your choice. Visitors from the EU, EEA and UK see a consent banner, and Google's analytics and ad cookies stay off until they accept. Elsewhere, including Malaysia, they're on by default. You can turn them off at any time by blocking or clearing cookies in your browser, or by using Google's ad settings and the Google Analytics opt-out add-on.

3. Our client portal

The portal at portal.foundingbird.com is where you and your fellow directors and shareholders run your company with us.

What we collect. To do company secretarial work and meet the law, we need:

  • your name, ID card or passport number, nationality, race, date of birth, gender, residential and service addresses, email and phone number. SSM's forms and the statutory registers ask for these;
  • your company's details, shareholdings and beneficial owners;
  • documents you upload, resolutions you approve and signatures you give;
  • billing details and payment history;
  • sign-in details: your email, passkeys, the devices you're signed in on, and a record of what was done in your account and when.

Where it comes from. Mostly from you. Also from your fellow directors or shareholders, from your company's earlier secretary or accountant, and from public records such as SSM's.

Identity checks. Anti-money laundering law requires us to check who you are before we act for you and to screen against sanctions lists. You'll be asked for photos of your ID and a short selfie video. See Identity checks and biometric data.

Payments. Card payments go through Stripe. We don't see or store your full card number.

4. Our mobile app

The Foundingbird app gives you the portal on your phone. It collects the same information as the portal, plus:

  • Camera and microphone. Only when you use them: to photograph your ID, documents, signature or company logo, and to record the short selfie video for your identity check.
  • Photos. Only the photos and files you choose to upload.
  • Location. Only once, when you approve an annual return, as evidence of where you approved it. You can say no and still approve.
  • Calendar. Only if you ask us to add your compliance deadlines to it. The app can add events but can't read your calendar.
  • Notifications. A device token from Apple, so we can send you reminders and updates. You can turn notifications off in your phone's settings.
  • Face ID. If you turn on the app lock, Face ID runs on your phone. We never receive your face data.

The app doesn't track you across other companies' apps or websites, and it has no advertising.

5. Identity checks and biometric data

Your selfie video, the face match against your ID photo, and the scan of your ID are biometric and other sensitive personal data under the PDPA. We only process them with your explicit consent.

The check is run by ComplyCube, our identity verification provider. We also use AI tools, including third-party AI providers, to help our team review the documents you upload and to help deliver our services. They process your information only on our behalf (see section 9).

If you don't want to do the check, we can't take you on as a client. AML law doesn't let us act for someone we haven't verified.

6. Why we use your data

We use your personal data to:

  • reply to your enquiries and send you the information you asked for;
  • set up and run your company secretarial services, and prepare and file documents with SSM, LHDN and other authorities;
  • verify your identity and screen against sanctions lists, as anti-money laundering law requires;
  • keep your company's statutory registers and records;
  • bill you and take payment;
  • keep the portal and app secure and fix problems;
  • improve our website and measure our ads;
  • send you updates about our services, if you agreed.

7. Do you have to give us your data?

Not on the website: everything there is optional, but we can't reply without a way to reach you.

To become a client, yes. The Companies Act 2016 and anti-money laundering law require the details marked as required in the portal and app. If you don't give them, we can't provide our services or file for your company.

8. Sensitive data

Some of what we hold is sensitive personal data under the PDPA: biometric data from identity checks, and in some cases information about criminal offences that comes up in sanctions screening. We only process it with your explicit consent, or where the law allows it, for example to meet our legal duties.

We ask for race because SSM's forms ask for it. We don't use it for anything else.

9. Who we share your data with

We share only what each party needs:

  • Government bodies: the Companies Commission of Malaysia (SSM), the Inland Revenue Board (LHDN) and other authorities when the law requires it or you ask us to file with them.
  • Professionals you work with: your auditors and tax agents, when you give them access.
  • Our group: other Corpseq group companies that provide the platform and support our work.
  • Service providers who process data for us:
    • ComplyCube (identity checks)
    • OpenSanctions (sanctions screening)
    • Stripe (payments)
    • AI providers, such as Anthropic and xAI (AI tools that help deliver our services)
    • Postmark (email delivery)
    • Cloudflare (website hosting and file storage)
    • Lark (our team's chat and notifications)
    • our own error-monitoring service, which may see your IP address and account details when something breaks
    • Google (Analytics, Ads and Tag Manager on the website)
    • Meta (when you message us on WhatsApp)
    • Apple (app notifications)

We don't sell your personal data.

10. Sending data outside Malaysia

Some of these providers store or process data outside Malaysia, for example in the United States or Europe. Under section 129 of the PDPA, we only send data abroad where the country has laws substantially similar to the PDPA or gives an equal level of protection, or where another ground in that section applies, such as your consent or the need to perform our contract with you.

11. How we keep it safe

We use encryption in transit, access controls, sign-in protections such as passkeys, and activity logs. Only team members who need your data for their work can see it. We require our service providers to protect it too.

If a data breach happens, we'll notify the Personal Data Protection Commissioner as soon as practicable, and within 72 hours. If it's likely to cause you significant harm, we'll tell you without unnecessary delay, and within 7 days of notifying the Commissioner.

12. How long we keep it

  • Company records, such as registers, filings, resolutions and accounting records: at least seven years, as the Companies Act 2016 requires.
  • Identity check and anti-money laundering records: at least seven years after our business relationship ends, as AML rules for company secretaries require.
  • Enquiries from people who don't become clients: about 12 months after our last contact with you.

After that we delete or anonymise the data.

13. Deleting your account

You can ask us to delete your account at any time:

  • In the app: go to Profile and tap Delete account.
  • In the portal: go to your profile and use Delete account.
  • By email: write to hello@foundingbird.com from the email address on your account.

Our team then deletes your login and personal details, and you won't be able to sign in again. We stop contacting you.

The law requires us to keep some records about your companies, such as the registers of directors and shareholders and our identity check records, for the periods in section 12. We keep those, and we'll tell you what we kept.

14. Your rights

Under the PDPA you can:

  • access the personal data we hold about you and get a copy;
  • correct it if it's wrong, incomplete or out of date. You can update most details yourself in the portal or app;
  • withdraw consent, for example to marketing or to biometric checks. This won't affect what we've already done. If you withdraw consent we need to provide our services, we may have to stop providing them;
  • limit how we process your data, including asking us to stop direct marketing or processing that's likely to cause you damage or distress;
  • move your data: ask us to send it to another data controller.

To use any of these rights, email hello@foundingbird.com. We'll reply within the time the PDPA allows. We may charge the fee the law permits for a copy of your data. If you're unhappy with how we handled your request, you can complain to the Personal Data Protection Department.

15. Children

Our services are for adults running companies. We don't knowingly collect data from children under 18. If you think a child has given us their data, tell us and we'll delete it.

16. Changes to this policy

We'll update this page when our services or the law change, and change the date at the top.

17. Contact us

Questions about this policy or your data:

Foundingbird Sdn Bhd
7-2 Plaza Danau 2, Jalan 2/109f, Taman Danau Desa, 58100 Kuala Lumpur, Malaysia
hello@foundingbird.com