Privacy Policy

Who We Are

O'Zone is operated by OC Global Technology Sdn Bhd (Company Registration No. 202301006962) of Unit 09-04, Level 9, City Plaza, Jalan Tebrau, 80300 Johor Bahru, Johor, Malaysia. In this policy, “we”, “us” and “O'Zone” mean OC Global Technology Sdn Bhd.

We are responsible for the personal data described in this policy, and we process it in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA), as amended.

This policy covers the O'Zone website and service at watchozone.ai, including the waitlist. It applies to each part of the service both during pre-launch and once that part has launched; where something applies only at one of those stages, this policy says so.

For anything in this policy, write to [email protected].

This policy is written to the Malaysian PDPA, which is the law that applies to us. We do not represent that our handling of personal data complies with the data-protection law of any other country. O'Zone can be viewed from outside Malaysia, but it is operated from Malaysia and is not offered as a service governed by another country's data-protection regime.

What We Collect

We collect personal data when you join the waitlist, when you create and use an O'Zone account, and — if you use them — when you buy something, take part in a creator programme, or use our creation tools. What we collect is listed below.

This data comes directly from you and from what your browser sends when you use the site, with three exceptions. If you use social sign-in, the provider you choose supplies the profile details you authorise. If you buy something or take part in a creator programme, our payment, payout and verification providers return a transaction reference and a verification result. And measurement records are generated by our own systems from how the service is used. Like any online service, our servers also keep routine technical logs — such as the IP address and time of a request — which we use for security and troubleshooting.

Supplying personal data is voluntary, but some of it is necessary to provide the service: without an email address we cannot keep your waitlist place or operate your account, and without a birthdate you cannot pass the age gate for mature content. A phone number is optional to hold an account and watch. It is required if you want to create or upload content, and for any creator programme: we verify it by sending a one-time code to it by SMS, and you cannot upload or publish content, or take part in a creator programme, without a verified phone number.

• Waitlist signup: your email address, whether you joined as a creator or a viewer, and your country.
• Waitlist creator details (creators only): first name, a handle, your content focus, your audience size, and a link to an existing channel.
• Waitlist consent record: the date and time you consented, the version of the signup wording you agreed to, and the language you signed up in.
• Waitlist technical data: the IP address and browser (user agent) used to submit the form, plus the referring page and campaign (UTM) parameters, so we can understand where signups come from and protect the form against abuse.
• Account details: your name, email address, a phone number, and whether and when it was verified — optional for watching, required to create or upload content or join a creator programme — a password (stored only as a secure hash — we can never read it), and your preferred language.
• Account security data: if you enable two-factor authentication, its secret and recovery codes; and the IP address and time of your last login.
• Birthdate: only if you choose to set it — once, in your account settings or when the age gate for mature content asks for it. We never ask for a birthdate at signup.
• Avatar: a profile image, only if you sign in through a social provider that supplies one.
• Moderation records: your account status and, where action has been taken against your account, the reason (for example a lock, suspension or ban) and any strikes recorded. If you appeal a suspension, a ban or the removal of an account, we keep what you wrote, the decision and when it was made; for a removed account we also keep the email address the appeal came from, encrypted, so we can reply. If a banned account is deleted, we keep a summary of the ban — the reason, its dates and the strike count — together with a one-way reference to the email address made with a secret key, as described in How Long We Keep It.
• Published content: your videos and their thumbnails, titles and descriptions, your channel name, handle and profile, and the comments you post — visible to other users as your settings allow.
• Account activity: your watch history, the videos you save, the playlists you make, the channels you follow, the accounts you block (the blocked account is not notified), your reactions, and your notification settings (including your browser's push subscription if you turn push notifications on, and a record of any marketing consent you give or withdraw there: when, the version of the wording you agreed to, and the language) — held against your account so the service can work for you, and shown to other users only where your settings make it visible.
• Payment records, if you buy something: what you bought, when, the amount and currency, and the reference our payment provider returns. We do not receive or store your full card number or your banking credentials.
• Creator programme records, if you take part: your eligibility and verification status, the identity and tax details the law requires us to collect, a reference for your payout method, the measured activity your earnings are calculated from, and the amounts and deductions shown on each statement.
• Creation tool records, if you use them: the instructions you submit — your prompt and any media you supply — the results generated from them, and a technical record of each attempt.
• Measurement records: what was watched or shown and for how long, and the technical signals we use to tell genuine activity from invalid or artificial traffic, including the device identifier described in our Cookie Policy.
• Analytics and session-replay records, collected through our analytics providers: which pages and features you used and in what order, and — where session replay is on — how you moved, clicked and scrolled on a page, together with a reconstruction of what the page showed you. We configure the tool to mask text you type and fields carrying personal data, and we do not use these records to work out who you are; even so, a reconstruction of your own pages can include information shown to you there. This is interaction data about how the service is used, not a record of who you are.

How We Use It

Every purpose below is tied to the data listed above. We do not sell personal data. Advertising we sell ourselves is measured on our own first-party signals. We also use, or expect to use, third-party analytics and session-replay tools, and expect to carry advertising supplied through a third-party advertising technology provider: those providers set their own cookies and receive data through them, and what each does with that data is governed by its own terms and policies rather than this one. Our Cookie Policy names them and describes the controls available to you.

• To run the waitlist: keep your place, contact you about launch, and — only with your consent — send you marketing email about O'Zone.
• To operate your account: sign you in, keep your session secure, deliver the features you use, and show the service in your preferred language.
• To keep the platform safe: rate-limit abusive traffic, protect the signup and login flows, investigate abuse, and enforce our Terms of Service.
• To apply the age gate: restrict mature content using the birthdate you set.
• To communicate with you: transactional email such as verification codes, password resets and service notifications.
• To notify you about channels you follow: use the channels you follow and your notification settings to tell you, in the app and — if you allow it — by browser push notification, when one of them publishes a new video. You can turn this off for a single channel on its page, or for every channel in your notification settings.
• To understand signups: attribute waitlist signups to referral sources using the referrer and campaign parameters recorded at signup.
• To take payment and deliver what you paid for: process purchases, issue and track credits or subscriptions, handle refunds, and detect payment fraud and chargeback abuse.
• To verify your phone number: send and check a one-time code by SMS, and use a verified number as a condition of creating or uploading content and as one of the checks for creator-programme eligibility.
• To operate creator programmes: check eligibility, measure qualifying activity, calculate and pay what is due, apply the deductions the law requires, and keep the accounting and tax records we are obliged to keep.
• To run the creation tools: pass your instructions to the model provider that generates the result, apply safety and policy checks to instructions and results, meter usage, and investigate misuse.
• To understand and improve the service: measure how features are used, find where a flow breaks or a page fails, and prioritise what to fix. This uses, or will use, third-party analytics and session-replay tools, which record how you move through a page; we mask what you type and do not use them to work out who you are.
• To serve and measure advertising: choose which advertisements to show and where, limit how often you see the same one, count genuine delivery and reach, exclude invalid or artificial traffic, and report aggregate results to advertisers. For advertising we sell ourselves this uses first-party signals only; where advertising comes through a third-party provider, that provider processes data for the same purposes and, depending on its configuration, to personalise advertising.

Our Legal Basis

For the waitlist, we rely on your consent. You cannot join the waitlist without ticking the consent box, and we record the exact time you consented and the version of the wording you agreed to — so there is never any doubt about what you signed up for.

For accounts, we process personal data because it is necessary to provide the service you asked for, and — for security, abuse prevention and legal compliance — where the PDPA otherwise permits the processing.

Marketing email is always consent-based, whether you consented on the waitlist or in your account's notification settings. Withdrawing that consent stops marketing email; it does not affect the rest of your relationship with O'Zone.

For analytics and advertising, this policy and our Cookie Policy describe the purposes, providers, disclosures and available controls. Those notices do not themselves determine or supply the legal basis for processing. We use analytics, session replay, personalised advertising, provider own-purpose processing and related transfers only as applicable law permits, and obtain consent where applicable law requires it. You can use the browser and provider controls described in the Cookie Policy, and you can object to this processing by writing to us at the address below.

Payments, Earnings & Tax Records

If you buy something on O'Zone, payment is taken by one of the licensed payment providers we use. We receive a record of the transaction and a reference for it; we do not receive or store your full card number or your banking credentials.

If you take part in a creator programme, we have to collect more than running the service alone would need: enough identity information to verify who is being paid, the tax identifiers and declarations the law requires us to hold, and a payout method in your own name. Without them we cannot pay you.

We are required to keep financial, invoicing and tax records for the periods Malaysian law prescribes — longer than we keep ordinary account data. Deleting your account does not delete a record we are obliged to keep; it stops that record being used for anything other than the obligation.

Where the law requires us to withhold, report or file, we do so, and the relevant authority receives what it is entitled to receive.

Creation Tools & Your Instructions

When you use our creation tools, the instructions you submit — your prompt and any media you supply — are sent to the third-party model provider that generates the result. That provider processes them on our behalf under contract, and may do so outside Malaysia. It may also process some of what you send for its own purposes — for example abuse and safety monitoring — under its own terms.

Do not put personal data into an instruction unless you have a lawful basis for it, whether the data is your own or someone else's. Do not submit another person's image or voice without their consent.

We keep instructions, results and the technical record of each attempt so that we can deliver what you asked for, meter and bill usage correctly, apply safety checks, answer complaints and appeals, and investigate misuse. We do not sell them, and we do not use them to build advertising profiles about you.

Instructions and results are screened for safety and policy compliance — automatically, and by our moderation team where a check is triggered.

How Long We Keep It

We keep personal data only for as long as it is needed for the purposes described above, and no longer than the PDPA permits.

We keep waitlist data while the waitlist runs so we can honour your signup. If you never open an account, we delete your waitlist contact details no later than twelve months after O'Zone launches, subject to the limited records described below. If you ask to be removed sooner, we delete those contact details and keep only the minimal suppression entry needed to make sure we do not email you again.

Account data is kept while your account is active. When you ask us to delete your account, we hold it for 30 days and then irreversibly purge its personal data. The 30-day window exists so an accidental or unauthorised deletion can be undone; after it, the data cannot be recovered. During the hold your account is paused: you are signed out everywhere, your channel and videos are hidden, and the account cannot be used for anything except cancelling the deletion, which happens automatically when you sign back in. If, when the 30 days end, any of your content is subject to a preservation requirement or an unresolved complaint, the purge waits: the account stays paused in the same way until that is resolved, and is purged then. Where the law requires specific records to be kept for longer, we keep only those records, and only for as long as the law requires. Where we have suppressed a phone number so it does not receive another one-time code, we keep that suppression entry after the purge too, so we do not send to it again.

Security and abuse logs — sign-in and rate-limiting records such as the IP address and browser used — are deleted after 90 days.

Proof of marketing consent — when it was given, which version of the wording was agreed and in which language, and, for consent given in your account settings, when it was withdrawn — is kept for up to seven years where necessary to demonstrate consent and resolve complaints. For consent given in your account settings, those seven years run from when the consent ends: when you withdraw it, when your account is permanently deleted, or when a date of birth you set shows you are under 18. That proof is held separately from your contact details, which are deleted on the timelines above; it is not a general seven-year retention of your data.

Some records outlast a deletion request, because we are not free to destroy them: financial, invoicing and tax records for the statutory period, and any material we are required to preserve for a legal, regulatory, law-enforcement, copyright, safety or dispute reason, for as long as that requirement lasts. Preserved material is kept for that purpose alone and is not used for anything else.

Creation-tool records — the instructions you submit, the results generated from them and the technical record of each attempt — are kept for the period we publish, and then deleted. We keep them for longer only where a safety, complaint, dispute or legal-preservation reason requires it, and then only for that reason.

If an account is deleted while it is under a ban, we keep an enforcement record: what the ban was for, when it was applied, how many strikes the account had, and when the account was deleted. With it we keep a one-way reference derived from the email address, made with a secret key. We do not keep the address itself, and the reference cannot be turned back into it. It is used for one thing only: to stop the same email address being used to open a new account. When someone tries to sign up or sign in with that address, we email it to explain that the account was removed and how to appeal; that email does not say why the account was banned. If an appeal is upheld, the address can be used to open an account again, and our moderation team can see that the new account followed an enforcement record. Because it can recognise a returning address, we treat it as personal data. We keep it for 365 days (about a year) and then delete it, together with any appeal made against it and the email address that appeal came from. An appeal against the suspension or ban of an existing account is kept with that account and deleted with it.

Who We Share It With

We use a small number of service providers to run O'Zone. Most of them process personal data on our instructions, under contract, and only for the purposes in this policy; the analytics and advertising providers named below also process some data for their own purposes under their own terms. We do not sell personal data to anyone.

• Video infrastructure providers: video upload ingest, transcoding, storage, and delivery of video and thumbnails through a content delivery network.
• Edge and security infrastructure providers: content delivery, edge caching, and protection against attacks and abusive traffic.
• Email delivery providers: transactional email (verification, one-time codes, password resets, notifications) and — with your consent — waitlist and marketing email.
• Social sign-in providers: if you choose to sign in through one, that provider shares the profile details you authorise with us, and it learns that you use O'Zone. You see which provider you are using at the moment you choose it.
• Search providers: host and operate our search index, on our instructions and under contract. The index holds public catalogue information such as video titles and channel names, and your searches reach it from our servers without your account or IP address.
• Authorities and legal process: we disclose personal data where the law requires it, or where disclosure is otherwise permitted under the PDPA.
• Payment providers: to take payment, process refunds, and detect payment fraud. They act as controllers in their own right for the payment itself, under their own terms.
• Payout and verification providers, for creator programmes: to verify identity where the law requires it, and to send money to the payout method you give us.
• SMS providers: to send the one-time code that verifies your phone number.
• AI model providers: where you use the creation tools, the provider that generates your result receives the instructions you submit, on our instructions and under contract. It also processes some of it for its own purposes — such as abuse and safety monitoring — under its own terms.
• Tax and regulatory authorities: where the law requires us to report, withhold or file.
• Analytics and session-replay providers, named in our Cookie Policy: they receive interaction data through their own cookies, and each also processes some of it for its own purposes under its own terms. What each does with it is governed by that provider’s own privacy policy, which the Cookie Policy tells you where to find.
• Advertising technology providers, named in our Cookie Policy: they receive data through their own cookies to select, cap, measure and — depending on the configuration — personalise advertising. They act as controllers in their own right for that processing, under their own terms and policies, and offer their own advertising controls that apply across every site they serve.

Transfers Outside Malaysia

Most of our infrastructure, and most of our service providers, operate outside Malaysia — principally in Singapore. Your personal data is therefore stored and processed outside Malaysia as a matter of course, not as an exception.

Where personal data leaves Malaysia, we comply with the PDPA's cross-border transfer provisions. We take reasonable precautions and exercise due diligence to prevent processing outside Malaysia that would contravene the PDPA if carried out here, and rely on consent, contractual necessity or another permitted basis only where its statutory conditions are met.

The transfer conditions above apply to every provider we use. The analytics and advertising providers our Cookie Policy names are different in one way worth stating: as well as processing data outside Malaysia for us, they process some of it for their own purposes under their own terms.

Cookies

We use a small set of first-party cookies to keep you signed in, protect the site, remember your preferences, and — where we serve advertising ourselves — count genuine delivery. Our analytics and advertising providers set their own cookies — first-party as well as third-party — when those services are running. Our Cookie Policy lists ours, names those providers, and describes how to limit theirs.

The full list of cookies, what each one does, and how to control them is in our Cookie Policy.

Security

We protect personal data with technical and organisational measures appropriate to the risk. Passwords are stored only as secure hashes. Traffic to O'Zone is encrypted in transit. Two-factor authentication is available on every account.

Access to personal data within the company is limited to the people who need it for their work.

No online service can promise perfect security. If something goes wrong, we handle it as described in Data Breach Notification.

Your Rights

Under the PDPA you have rights over your personal data. You can exercise any of them by writing to [email protected].

Formal data access and correction requests are handled within the 21 days the PDPA allows, extendable only where the Act permits. We aim to answer general enquiries and complaints as quickly as we reasonably can.

You can delete your account yourself at any time from your account settings; there is a holding period first, described in How Long We Keep It. An account that is under a ban cannot be deleted from settings; you can instead write to [email protected] to ask us to delete it, and we review and honour that request, keeping the enforcement record described in How Long We Keep It. You can also ask us at any time to delete your waitlist contact details, subject to the limited records described in How Long We Keep It, or your account and its personal data — deletion is handled as described in that section.

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to correct personal data that is inaccurate, incomplete, misleading or not up to date.
• Withdraw consent: withdraw your consent to processing at any time, with effect going forward.
• Limit processing: require us to stop, or not to begin, processing that is likely to cause you damage or distress.
• Stop direct marketing: require us to stop processing your personal data for direct marketing at any time, under section 43 of the PDPA.
• Data portability: ask us electronically to transmit your personal data directly to another data controller you choose, subject to technical feasibility and compatibility of the data format.

Marketing Email & Opting Out

You only receive marketing email from O'Zone if you consented to it — when you joined the waitlist, or in your account's notification settings. Every marketing email we send includes an unsubscribe link.

Unsubscribing adds your address to a suppression list. Suppression is durable: it persists even if you later sign up again, so one unsubscribe is enough.

You can also stop marketing at any time by writing to [email protected]. This is your right under section 43 of the PDPA, and we honour it promptly.

Transactional email — verification codes, password resets, security notices — is not marketing, and continues while you hold an account.

Children & Minimum Age

O'Zone is for people aged 16 and over. Creating or uploading content, earning money or rewards through O'Zone, buying anything from us, holding or spending credits, and consenting to marketing email all require you to be 18 or over. We do not knowingly collect personal data from anyone under 16, and we never ask for a birthdate at signup — these age requirements rely on the age you declare to us.

Mature content sits behind an age gate backed by the birthdate you set once in your account settings. If we learn that we hold personal data from anyone under 16, we will delete it. Parents and guardians can write to [email protected].

Data Breach Notification

The PDPA, as amended in 2024, requires notification of personal data breaches. If a breach affects your personal data, we will assess it promptly, notify the Personal Data Protection Commissioner where the law requires, and inform you without undue delay if the breach is likely to cause you significant harm.

Changes to This Policy

We will update this policy as O'Zone grows — certainly when the full service launches. The date at the top shows when it last changed. If a change materially affects your rights or how we use your data, we will take reasonable steps to tell you before it takes effect — for example by email, if we have your address.

The marketing consent wording, on the waitlist and in your account settings, is versioned, so we always know exactly which wording you agreed to.

We draft and maintain this policy in English as the core reference text, and translate it into Bahasa Malaysia, Tamil and Chinese. We provide the Bahasa Malaysia and English versions together for the purposes of section 7(3) of the PDPA; both are intended to convey the same information. If a translation appears inconsistent with the English reference text, contact us so we can clarify and correct it. No translation limits your statutory rights.

Contact

For privacy questions, rights requests, consent withdrawal, or complaints, contact our Personal Data Protection Contact at OC Global Technology Sdn Bhd: email [email protected], or telephone +607-283 1973.

By post: OC Global Technology Sdn Bhd, Unit 09-04, Level 9, City Plaza, Jalan Tebrau, 80300 Johor Bahru, Johor, Malaysia.

Formal PDPA access and correction requests are handled within the Act's 21-day timeline; we aim to answer general enquiries as quickly as we reasonably can. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia.