Privacy
Privacy notice
This notice describes how we handle names, emails, household notes, and recordings when you use this website or commission an engagement study. It should be read with the cookies page.
The data controller is Mirror Canvas Point, Suite 1501 1502 15Th Floor Wisma Hang Sam Jalan Hang Lekir,Kuala Lumpur,Wilayah Persekutuan,50000,Malaysia, email info@mirrorcanvaspoint.digital, telephone +60320783915. We handle personal data in line with the Personal Data Protection Act 2010 of Malaysia and, where a household or client is in another country, with the restrictions described under international transfers.
What we collect
From the briefing form: name, email, the study you selected, mirror or companion-app name, a hoped-for week, and your message. From email or phone: whatever you choose to send. From a commissioned study: names and contact details of your staff; household first names or role names, session notes, stills, and recordings only with documented agreement. From the website: technical logs our host may keep (IP address, browser type, pages requested) and, if you accept cookies, a small analytics cookie described on the cookies page.
Why we use it
To reply to briefing requests, to run and write studies, to invoice, to keep a record of consents, and to operate this website. We do not sell personal data. We do not use household recordings to train general models or to advertise.
Legal basis (where that language is useful)
For clients: performance of the study contract and our legitimate need to keep work files and accounts. For households: consent, recorded in writing before a session. For the website: legitimate operation of the host, and consent for non-essential cookies.
Retention
Briefing-form messages are kept for twenty-four months after the last reply, then deleted unless they became part of a paid file. Paid study files, including briefs and consent sheets, are kept for seven years for accounting and dispute purposes, then destroyed or anonymised. Household stills are deleted within twelve months after the walkthrough unless a longer period is written into the study plan with the household’s agreement. Server logs follow our host’s default, typically under ninety days.
Who we share with
Aisha Rahman, Daniel Tan, and Mei Ling Cho on the relevant study; our accountant; our email and hosting providers acting on our instructions; and Malaysian authorities if the law requires. We do not send household recordings to your whole company without a named recipient list you supply.
International transfers
Our office and primary files are in Malaysia. Email or hosting may process data on servers outside Malaysia. Where that happens, we use providers who contract to protect the data and we avoid placing identifiable household video on public cloud folders. If you are a client outside Malaysia, you instruct us to receive your staff data in Kuala Lumpur.
Your rights
You may ask for access to personal data we hold about you, correction of inaccuracies, and, where the PDPA or your consent allows, withdrawal of consent or deletion. Household participants may withdraw from a live study; notes already written may be kept in anonymised form if removal would make the brief misleading, which we will explain. To exercise rights, write to info@mirrorcanvaspoint.digital. We will respond within twenty-one days where the PDPA so requires, or sooner when we can. You may complain to the Malaysian Personal Data Protection Commissioner.
Children
We do not study children and we do not knowingly collect their data through this website. If a recording you send includes a child, we will stop and ask you to remove it.
Changes
We will update this page when our practice changes. The date of the current text is 18 August 2026.