This is the approved English legal document.

Last updated: 4 September 2026

Privacy Policy

This policy explains how Agentic Labs Sdn. Bhd. (“Cerika”, “we”, “us” or “our”) collects, uses, discloses, stores and protects personal data when providing the Cerika website, account services, personalised story journey, Cerika Room, Reader and related products. We act as the data controller for this processing. A parent or legal guardian should read this notice before providing information about a child.

Personal data we collect

Depending on how you use Cerika, we process adult account and contact data; authentication and policy-acknowledgement records; child first name, age band, photo and generated character; selected interests and optional family, pet, toy or other story context; personalised inputs, previews, generated book assets, Room contents and reading progress; order, gift, delivery and payment-status records; service communications; and technical, security and journey data such as backend-issued visitor and session identifiers, device category, timestamps, user-agent information, IP-derived security information and minimised browser-risk signals.

We do not require a child's exact date of birth for the standard journey and do not store full payment-card details. Please do not provide more personal information than the relevant Cerika field requests.

How we collect data

We collect data directly from an adult when they browse, create or access an account, provide child details, upload a photo, personalise or purchase a story, configure a Room, place a gift or physical order, or contact us. We collect technical and journey data automatically when the Service is used. We may receive transaction, delivery or security status from contracted providers and gift information from the purchaser. If you provide data about another person, you confirm that you are authorised to do so.

Why we use data

We use personal data to authenticate users; provide eligible previews; create, review and deliver personalised characters and books; maintain the Cerika Room and reading progress; provide rule-based story recommendations; process and fulfil digital, physical and gift orders; send transactional messages; provide support; protect children and accounts; prevent fraud and entitlement abuse; measure and improve the customer journey; maintain financial and operational records; handle legal claims; and comply with law.

Processing may be necessary to provide the product you request, based on your consent or choices, required by law, or reasonably necessary for security and service operations. Optional interests and child-world context may be skipped, changed or removed. Withdrawing a required consent may prevent us from continuing the affected feature.

Cookies and browser storage

Cerika uses essential cookies and browser storage to maintain sessions, protect rotating refresh tokens, remember appropriate journey state and prevent abuse. Cerika-owned analytics identifiers and events help us understand the customer journey. A derived browser-risk signal may be used as one supplemental security or entitlement signal, but it is not treated as verified identity and cannot by itself merge accounts, purchases or private content. Raw fingerprint components are not retained when a minimised derived signal is sufficient.

Restricting essential browser storage may prevent authentication, checkout or saved-journey features from working. Cerika does not use third-party behavioural advertising cookies and does not sell personal data for targeted advertising.

Children and adult control

Cerika creates a child-facing story experience under adult control; it is not an account service for children to use independently. An adult controls the account, purchases, privacy choices, uploads and Parent Mode. Do not provide a child's information or photo unless you are the child's parent or legal guardian or have their clear authority. If you believe child data was supplied without appropriate authority, contact us so we can verify the request and restrict or remove supported information.

AI processing and recommendations

Approved child photos and permitted context may be supplied to configured AI services to create a character, preview and purchased book within an Admin-approved StoryVersion. Output may undergo automated checks and authorised quality review. Recommendations use rules such as age band, language availability, selected interests, existing ownership and catalogue metadata. They are not used to make legal, employment, credit, health or similarly significant decisions about a child or adult.

Who receives data

We disclose only the data reasonably required to authorised personnel and contracted providers. Current provider categories include Stripe for payment processing, Resend for transactional email, Cloudflare R2 for private object storage, OpenAI for approved text and image processing, hosting and infrastructure providers, and production or delivery partners when a physical order is placed. We may also disclose information to comply with law, protect a child or another person, investigate fraud or security incidents, enforce our terms, or complete a corporate transaction subject to appropriate protections. We do not sell personal data.

International transfers

Some providers may process or store data outside Malaysia. For international transfers, we take reasonable steps to use appropriate providers, contractual measures, access controls and transfer arrangements intended to protect the data consistently with applicable Malaysian requirements.

Security and data incidents

We use measures appropriate to the Service, including access controls, private object storage, short-lived asset links, encryption in transit, hashed passwords and authentication tokens, rate limiting, audit records and provider-secret controls. No online system is completely secure. If a personal-data breach occurs, we will assess and respond to it and notify Malaysia's Personal Data Protection Commissioner and affected individuals when required by applicable law.

Retention

We keep personal data only as long as reasonably needed for its purpose. Account, child-profile, Room and purchased-book data may be kept while the account or product remains active. OTPs and temporary authentication data are short-lived. Order, consent, financial, security, audit and dispute records may be retained longer for legal, accounting, fraud-prevention, recovery or claim-handling purposes. Data that is no longer required is deleted, anonymised or securely disposed of according to applicable procedures and backup cycles.

Your choices and rights

Subject to applicable law and appropriate identity or authority verification, you may ask whether we process your data; request access or correction; withdraw consent; object to or prevent processing likely to cause damage or distress; opt out of direct marketing; request supported deletion, restriction or portability; or raise a concern about automated processing. Parent Mode also provides controls for eligible child interests, profiles, photos, generated assets and sharing preferences.

Some records must be retained for completed transactions, security, fraud prevention, legal compliance, disputes or another person's rights. We will explain any material limitation. To exercise a right or make a complaint, email hello@cerika.my. You may also complain to Malaysia's Personal Data Protection Commissioner.

Changes and contact

We may update this policy as Cerika, our providers or applicable law changes. We will update the effective date and present material new versions for acknowledgement where appropriate.