Privacy policy
Your information, handled with care.
What I collect, why, who sees it and your rights, wherever you are. Questions? Email me.
1. Who I am
This Privacy Policy explains how Asher, trading as AShifts Funnels (“I”, “me”), a sole proprietor based in Malaysia, collects and uses personal information when you visit ashifts.com, send me a project brief, contact me or work with me.
I am the controller of your personal information (a “data user” under Malaysian law and a “business” under US state laws). For any privacy question or request, contact me at hello@ashifts.com. I have not appointed a data protection officer because the law does not require one for a business of this size and type.
2. Information I collect
- Contact details: name, email address and, if you choose, phone or WhatsApp number.
- Business details: your business, offer, audience, goals, platform, website, country or time zone and target dates.
- Project information: messages, feedback, files, brand materials and any account access you choose to give me for the work.
- Billing details: name, business name, address, invoice and payment records. Card and bank details are entered with the payment provider and are not received or stored by me.
Information collected automatically: when you visit the website, my hosting provider Cloudflare processes technical data such as your IP address, browser type and the pages requested, to deliver the site and protect it from abuse. I do not use analytics, advertising or tracking cookies, and I do not build profiles of visitors.
Required and optional information: fields marked * in the project brief are needed to reply to you and prepare a quote. If you do not provide them I cannot respond to the brief, but you can still contact me by email or WhatsApp. Everything else is optional.
I do not knowingly collect sensitive information (such as health, religious beliefs, biometrics, government ID numbers or financial account credentials). Please do not send it.
3. How I use it, and the legal basis
- Replying to enquiries and preparing quotes: to take steps at your request before entering a contract.
- Delivering the agreed project, including calls, revisions, handover and support: to perform our contract.
- Invoicing, payments, accounting and tax records: to perform the contract and meet legal obligations.
- Running and securing the website, preventing spam and misuse: my legitimate interest in keeping the site and my business safe.
- Handling disputes and legal claims: legitimate interests and legal obligations.
- Showing your project in my portfolio or quoting your feedback: only with your consent, which you can withdraw at any time.
- Occasional updates or offers by email: only with your consent, and every message lets you unsubscribe.
Where I rely on legitimate interests, I have weighed them against your rights and you can object at any time (see section 8). I do not use your information for automated decision-making or profiling that has legal or similarly significant effects on you.
5. International transfers
I am based in Malaysia and my service providers operate in several countries, including the United States and the European Union. Your information may therefore be transferred to and stored in countries other than your own.
When I transfer personal information, I rely on recognised safeguards, such as adequacy decisions, the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum (built into my providers’ data processing terms), and the conditions for cross-border transfers under Malaysia’s Personal Data Protection Act. You can ask me for more information about these safeguards.
6. How long I keep it
- Enquiries that do not become projects: up to 12 months after our last contact.
- Client project files and messages: for the project and up to 2 years afterwards, so I can support you.
- Invoices, payment and accounting records: 7 years, as required for tax and business records.
- Website security logs held by Cloudflare: a short period under Cloudflare’s own retention settings.
After that, information is securely deleted or anonymised, unless the law requires me to keep it longer or it is needed for a legal claim.
7. How I protect it
I use reasonable technical and organisational measures appropriate to a small business: encrypted connections (HTTPS), reputable providers with strong security, two-step verification on business accounts, limited access and secure deletion. No online service is completely secure, so please avoid sending passwords or card details by email or forms.
If a data breach is likely to put your rights at risk, I will notify you and the relevant regulator where the law requires, within the required time.
8. Your rights
- Access: to know what personal information I hold about you and receive a copy.
- Correction: to have inaccurate or incomplete information corrected.
- Deletion: to have your information deleted.
- Restriction and objection: to limit how I use your information, or object to uses based on legitimate interests or to direct marketing.
- Portability: to receive the information you gave me in a commonly used format, or have it sent to another organisation.
- Withdraw consent at any time, without affecting what was done before.
- Opt out of sale, sharing or targeted advertising: I do none of these, and I honour Global Privacy Control signals.
- Non-discrimination: you will not be treated differently for using your rights.
How to make a request: email hello@ashifts.com from the address I know you by, or tell me how to verify your identity. You may use an authorised agent, who must provide your signed permission. I reply within one month (UK and EU), 21 days (Malaysia, for access and correction requests) or 45 days (US states), and will tell you if the law allows me more time. Requests are free unless they are clearly unfounded or excessive. If I refuse a request, I will explain why and, where US state law provides it, how to appeal by replying to my decision.
Some information may need to be kept to meet legal obligations, and deleting information the project depends on may mean I cannot complete the work.
9. Region-specific information
United Kingdom and European Economic Area. The UK GDPR and the EU GDPR apply when I offer services to you there. You can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local EU data protection authority, though I would appreciate the chance to resolve your concern first.
United States. I am a small business and may fall below the thresholds of state privacy laws such as those of California, Colorado, Virginia, Connecticut, Texas and others, but I extend the rights in section 8 to all US residents. In the past 12 months I have collected the categories described in section 2 (identifiers, commercial information, internet activity and professional information), for the purposes in section 3, from you and your devices, and disclosed them only to the recipients in section 4. I have not sold or shared personal information and do not use sensitive personal information.
Malaysia. This policy is my written notice under the Personal Data Protection Act 2010 (as amended in 2024). You may request access to or correction of your personal data, limit its processing, or request data portability, by contacting me as above. Complaints can be made to the Personal Data Protection Commissioner (pdp.gov.my). A Bahasa Malaysia version of this notice is available on request.
Singapore and other Asian countries. I follow the same standards for clients in Singapore and elsewhere in Asia, consistent with laws such as Singapore’s Personal Data Protection Act. You can contact me for access, correction or withdrawal of consent at any time.
11. Children
My services are for businesses and are not directed to children. I do not knowingly collect personal information from anyone under 16. If you believe a child has sent me information, contact me and I will delete it.
12. Other websites and services
Links to other websites and services, such as WhatsApp, payment pages or funnel platforms, are covered by their own privacy policies.
13. Changes and contact
I may update this policy when my services or the law change. The date below shows the latest version, and significant changes will be highlighted on this page or sent to current clients. Questions or requests: hello@ashifts.com.
Effective date: 11 November 2026.
Start your project
Ready to turn more clicks into customers?
Send a short brief and I will reply within 24 hours with a recommended scope, price and next steps.
Prefer to message? Email Asher or chat on WhatsApp.