LEGAL // PRIVACY
Privacy Policy
This policy explains how SBCA (“SBCA”, “we”, “us”) collects, uses and protects personal data when you visit this website, apply for incubation, use the AI intake assistant on our team pages or sign up for our newsletter.
1. Who we are
SBCA is a Web3 incubator based in Kuala Lumpur, Malaysia. We are responsible for the personal data collected through this website.
2. What we collect
- Incubation applications: your name, email address, Telegram or X handle, project name, project website, sector, stage, one-line pitch and pitch deck link, plus anything contained in materials you link to.
- AI intake assistant (team pages): the needs you select, your messages to the assistant and its replies, the summary you confirm, and the contact details you leave (name, role, Telegram or X handle, company or project, and links you share). To use the assistant you sign in with Google; we receive only your name, email address and Google account ID, and use that verified email to reply to you.
- Newsletter: your email address.
- Technical data: IP address, browser and device type, pages visited and referring site, collected through our hosting provider’s server logs and our own privacy-friendly website analytics. Our analytics record the page, the referring site, country, device type and the key buttons used. They use no cookies and do not store your IP address; visits are counted with an anonymous code that changes every day, so you cannot be followed from one day to the next.
- Messages: anything you send us directly, for example through X.
We do not ask for sensitive personal data. Please do not include it in your application.
3. How we use it
- To review your application, assess whether your project is a fit for incubation or investment, and get back to you.
- To pass your request from the AI intake assistant to the SBCA team member you contacted (or the right person on the team), prepare a short brief for them, and let them follow up with you. The assistant does not make decisions about you; a person reviews every request.
- To improve the AI intake assistant, using conversations in de-identified form.
- To send you our newsletter. You can unsubscribe at any time using the link in every email.
- To communicate with you about SBCA and our ecosystem when you have asked us to.
- To run, secure and improve this website.
- To meet our legal obligations.
4. Legal basis
We process personal data with your consent (for example when you submit a form or subscribe), for our legitimate interests in evaluating projects and keeping the website secure, and where required by law. Where consent is the basis, you may withdraw it at any time.
5. Who we share it with
We do not sell personal data. We share it only with:
- Service providers that process data on our behalf, such as website hosting, form and database tools, the AI model provider that powers the intake assistant (Cloudflare Workers AI), Google (sign-in for the assistant), Telegram (used to notify our team of new requests), our email newsletter provider and analytics, under appropriate confidentiality terms;
- AAAAI, an SBCA portfolio company that builds the AI intake assistant: each month we share de-identified insights from assistant conversations (with names, email addresses, handles, phone numbers, company and project names and links removed), such as which questions confused visitors, so AAAAI can improve its product. We never share your contact details or your full conversation with AAAAI;
- Professional advisers, such as lawyers and accountants;
- Authorities, where required by law; and
- Partners or co-investors, only with your permission, for example when we introduce your project.
6. International transfers
Some of our service providers may store data outside Malaysia. When this happens, we take reasonable steps to make sure your data receives a comparable level of protection.
7. How long we keep it
We keep application data for as long as we need it to evaluate and follow up on your project, generally up to 24 months after our last contact, unless we start working together. AI assistant conversations and requests are kept on the same basis as applications. Newsletter data is kept until you unsubscribe. Server logs are kept for short periods for security purposes; website analytics are kept for up to 13 months.
8. Security
We use reasonable technical and organisational measures to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Your rights
Subject to applicable law, including Malaysia’s Personal Data Protection Act 2010 and, where it applies, the EU or UK GDPR, you may ask to access, correct or delete your personal data, withdraw consent, or object to or limit how we use it. If you are in the EU or UK, you may also ask for a copy of your data in a portable format and complain to your local data protection authority. To make a request, contact us using the details below. We aim to respond within 21 days.
10. Cookies and local storage
This website does not use advertising cookies. It uses your browser’s local storage only to remember your language choice and whether the intro animation has played. Visitors who sign in to use the AI intake assistant, and SBCA team members who sign in to the team dashboard, receive a strictly necessary session cookie. If we add analytics that use cookies, we will update this policy and ask for your consent where required.
11. Children
This website is not intended for anyone under 18, and we do not knowingly collect their personal data.
12. Other websites
This website links to other sites, including our ecosystem projects and X. Their own privacy policies apply when you visit them.
13. Changes
We may update this policy from time to time. The date at the top shows when it was last changed.
14. Contact
Questions or requests about your personal data: hello@sbca.build, or message @SBCA_Official on X.
This policy is available in English and Chinese. If the two versions differ, the English version applies.