You are handing unpublished research to strangers. This page covers who reads it, how long it is kept, what we will never do with it, and — more usefully — the risks that sit on your side rather than ours.
We keep two policies because they protect two different things, and mixing them makes both vaguer.
Your drafts, dataset, topic, framework, supervisor's comments, faculty guideline, and the fact that you are a client at all.
Your name, email, phone number, payment records and website analytics, and your rights over them under Malaysian law.
Two people, in most cases. Access is by role, not by seniority — nobody browses files they are not assigned to.
Reads enough of your brief to price it accurately. If you never order, that access ends and the files are deleted after thirty days.
Reads everything, because they cannot write your methodology without your guideline and your supervisor's comments. They sign a confidentiality undertaking before receiving a single file.
Where an order includes statistical work, one analyst may see your dataset. You are told this is happening rather than discovering it later.
No marketing team, no general staff access, no contractor browsing completed orders. There is no internal library to browse in the first place.
Fixed periods rather than "as long as necessary", which means nothing.
| What | Kept for | Why that long |
|---|---|---|
| Quote requests that never became orders | 30 days | So you can come back and reference the quote |
| Your drafts, datasets and delivered files | 90 days after close | So the included revision round is possible after supervisor feedback |
| Supervisor comments and guideline documents | 90 days after close | Needed for any revision to be consistent with the original brief |
| Email correspondence | 12 months | Dispute resolution and continuity if you return for a later chapter |
| Invoices and payment records | 7 years | Required by Malaysian tax and accounting law |
Want it gone sooner? Ask, and everything except the invoice record is deleted within seven working days.
Stated as absolutes because that is the only form in which a confidentiality promise is worth anything.
No fee, request or pressure changes these.
This has happened, so the answer is prepared.
Realistically, the weak point is almost never the company. It is worth knowing where it actually is.
If you send us files from an institutional address, your university administers that mailbox and can access it. Use a personal email address. This is the single most common exposure and it costs nothing to avoid.
A laptop issued by your employer or department may be monitored or backed up centrally. Downloaded files and browser history sit on that device, not on our systems.
The most common way a supervisor finds out is a coursemate mentioning it. We can control our records; we cannot control a conversation in a study room.
If you share a dataset by open link rather than restricted access, that link works for anyone who has it long after our access ends. Restrict it, and revoke it when the order closes.
Have a confidentiality question this page does not answer?Ask before you send anything. We would rather answer it up front than have you upload research you were uneasy about.
Ask Us First →No. A first name and a working email address are enough to order. We ask for a name for the invoice and for addressing you politely, not for verification, and a preferred name is fine.
Yes. Say so and everything except the invoice record is deleted within seven working days. The trade-off is that the included revision round becomes impossible, so most students wait until the chapter is accepted.
It is treated more restrictively. Datasets are accessed only by the analyst assigned to your order, are not copied into shared drives, and are deleted on the same ninety-day cycle. If your data involves human subjects, tell us and we will handle it under your ethics approval conditions.
Neither is told about the other, and no specialist works on two theses close enough in topic to create a conflict. Where we spot that risk at the quote stage, one of the two orders is declined.
They know your university and faculty, because formatting and structure depend on it. Your supervisor's name is not needed and is redacted from comment documents where it appears before the file is passed on.
Invoices are kept for seven years because Malaysian law requires it. Your academic work is not, which is why the ninety-day deletion cycle matters more than any promise about how we would respond to a request.
Use a personal email address rather than an institutional one. Everything else is covered by the policy above.