Privacy Policy

Mantap Math (https://mantapmath.app) is operated by Kaizen Improvement Solution, a business registered in Malaysia. Mantap Math is a maths game for schoolchildren that follows the KSSR and KSSM syllabus. In this policy, “we” and “us” mean Kaizen Improvement Solution, and “you” means the parent or legal guardian who uses Mantap Math or lets a child use it.

Under the PDPA, we are the data controller responsible for your and your child's personal data. This policy is our written notice under section 7 of the PDPA.

Please read this policy together with our Terms of Service and Cancellation and Refund Policy.

Our business details are shown in the Operator details box at the bottom of this page.

• Children can play without an account. We do not ask guests for a name, email or phone number, but their answers and results are stored with a random device ID.
• Only a parent or legal guardian aged 18 or over can open a parent account and create child profiles.
• If a teacher uses Misi A+ Classes, pupils join with a class code and a nickname only. In the app, only that class's teacher sees their answers and marks, and class data is deleted automatically (see section 6).
• We do not sell personal data, and there are no adverts in Mantap Math.
• Cikgu Mantap and the weekly report commentary use AI from Anthropic (United States). We do not send account names, email addresses or phone numbers to the AI, but anything your child types into Cikgu Mantap is sent.
• The weekly report is switched on automatically for parent accounts. You can turn it off at any time.
• Payments are processed by Stripe. Mantap Math never sees or stores your card number.
• Data is processed by service providers outside Malaysia, including in South Korea, Japan and the United States (see section 15).
• You can ask for a copy, correction or deletion of your data by emailing sokongan@mantapmath.app. We will reply within 21 days (see section 18).

Mantap Math is built for children, so we take their privacy seriously. For child profiles in a parent account, we accept consent only from a parent or legal guardian.

When you sign up, you tick a box confirming that you are aged 18 or over and are a parent, legal guardian or teacher, and that you agree to this Privacy Policy and our Terms of Service. We record the time of that consent.

If you sign in with Google without going through the sign-up page, we will ask for this consent and your phone number before you can use the account. An account record with your Google profile details (name, email, profile picture link and account ID) is created when you first sign in. If you do not continue, you can ask us to delete it by emailing sokongan@mantapmath.app.

With that consent, you agree on your own behalf and on behalf of each child whose profile you create.

We do not ask for a child's email, phone number or photo. We suggest using a nickname rather than a full name for a child profile.

When a child plays as a guest, we do not ask for their name or email, but their answers and feedback, and any Cikgu Mantap explanations they request, are still stored (see section 5). Guests cannot type messages to Cikgu Mantap; only a child playing in a parent account can do so. Parents and guardians should supervise their child's use, including when playing as a guest.

Pupils who join a Misi A+ Class with a class code do not open an account and are not asked to give consent to us. The teacher who creates the class confirms that they teach those pupils, have their school's permission (or the parents', for a class outside school), and will tell the pupils and their parents or guardians what data is kept. Pupils see a short notice before they join. Details are in section 6.

If you open an account (as a parent, guardian or teacher), we process the following data:

• Parent account: email address, name (up to 80 characters), phone number and password. Your password is handled by Supabase Auth and stored in hashed form, so we cannot see it.
• Google sign-in: if you choose it, your Google name, email, profile picture link and Google account ID (stored by our authentication provider; we do not use the picture).
• Account settings: your PIN for Kawasan Ibu Bapa (Parent Area), stored in hashed form, the time you gave consent, and your weekly report setting.
• Subscription status: free or Premium plan, plan type, Premium end date, whether the subscription has been cancelled, and your Stripe customer ID and subscription ID. We do not store card details.
• Child profile: a nickname (up to 40 characters), an optional Tingkatan (Form) and a hero of your child's choice.
• Learning data: each answer chosen and whether it was right or wrong, time taken, scores, levels completed, game records (wins, hits, combos, HP) and feedback after games, including any written comment.
• Cikgu Mantap conversations: the messages your child types and the AI tutor's replies (see section 10).
• Weekly reports: a copy of the statistics and commentary in each report we send you.
• Free Kilang Soalan trial: for accounts without Mantap Pro, a count of the free items opened, plus the paper code or quiz settings (topics, number of questions, level, number of pupil sets and a random seed number) of each item and when it was opened. These codes and settings contain no pupil names or data.
• Technical data: like most websites, our hosting provider processes IP addresses and browser information to deliver and protect the site. For Cikgu Mantap messages, we store a salted one-way hash of the IP address, used to enforce usage limits and detect misuse, rather than the IP address itself.
• Correspondence: emails you send us and our replies.
• Misi A+ Classes (teacher accounts): class name, optional Tingkatan (Form), class code, assignments given, confirmed marks, the time the teacher made the declaration when creating the class, and a short log of teacher actions (for example creating a class, deleting a class or downloading marks) without pupils' names. This log is kept for 12 months.

The data we keep for guests is explained in section 5, and for pupils in Misi A+ Classes in section 6.

We do not ask for sensitive personal data such as health information, and we do not ask for identity card numbers.

Kilang Soalan (the Mantap Pro paper and quiz generators) collects no pupil data: papers and quizzes are generated and printed without pupils' names or answers. Pupil data is stored only when a teacher uses Misi A+ Classes, as described in section 6.

Children can play as guests without signing up. We do not ask guests for a name, email or phone number.

The browser generates a random device ID. A guest's answers, game results and feedback, and their Cikgu Mantap requests and explanations, are stored on our server with this ID (and, for Cikgu Mantap, a one-way hash of the IP address).

When a guest presses the Cikgu Mantap button, the question and the chosen answer are sent to Anthropic (United States) to generate an explanation, as explained in section 10. Guests cannot type their own messages, so no free text from guests is sent.

Guest progress, such as which bosses are unlocked, is stored only in that device's browser. It is lost if the browser data is cleared, it does not carry over to other devices, and we cannot recover it.

Because guest data is not linked to a name or email, we may not be able to tell which data belongs to your child. If you have a request about guest data, contact us at sokongan@mantapmath.app and we will try to help.

This section applies when a teacher on Mantap Pro or our pilot programme creates a class in Mantap Math and pupils join it with a class code. Most of these pupils are under 18. They do not open an account.

The data we keep about each pupil:

• the nickname the pupil types (up to 40 characters), the class they joined and when they joined
• Paper 1 answers, and the times the pupil started and submitted
• Paper 2 mark ticks made by the pupil and by the teacher, the Section C question chosen, and the marks
• the date the pupil last opened the class
• a random session token and a temporary recovery code, stored as one-way hashes

We do not ask for a pupil's email, phone number, identity card number, date of birth, photo or school name. Pupils' nicknames and answers are not sent to Anthropic or any other AI provider, and are not used for advertising.

Purpose: to let the teacher give assignments, mark and confirm marks, and see the class's results; and to limit attempts at entering codes so that classes are not misused. For those limits we keep a salted one-way hash of the IP address, which changes every day, for 2 days, not the IP address itself.

Who sees it: the class's teacher sees the nicknames, answers and marks of the pupils in their class. A pupil sees only their own answers and marks, not their classmates', and the teacher's name is not shown to pupils. Other teachers and other parents cannot see it. Our team can access the database only for support and security. This data is stored by our service providers outside Malaysia (see section 15).

The teacher's and school's role: the teacher (and their school) decides to use classes with their pupils. When creating a class, the teacher makes the declaration described in section 3, and we record the time of that declaration. We provide a notice for parents that the teacher can print or share. Pupils see a short notice and a link to this policy before any data is stored. A parent who does not want their child to use the class can tell the teacher: the teacher can remove the pupil, and the pupil can answer printed papers instead.

How long we keep it: a class ends automatically 12 months after it is created (the teacher can extend it up to 24 months), or earlier if the teacher ends it. After a class ends, the teacher and pupils can see the marks for 90 days; then the class and all its pupil data are permanently deleted from our database. If Mantap Pro (or pilot access) ends and is not renewed, the teacher's classes are ended 180 days later and deleted 90 days after that. The teacher can remove a pupil or delete a class at any time, and that data is deleted from our database straight away. A short log of teacher actions (without pupils' names) is kept for 12 months and then deleted; when a pupil is removed or a class is deleted, references to that pupil in the log are removed straight away. Time-based deletion is carried out by a daily task.

Cookie: the pupil's device keeps a mm_murid cookie so the pupil stays in their class (see section 13). The Keluar dari peranti ini (Sign out of this device) button removes that class from the cookie; the cookie is deleted when no classes are left. On school computers or shared devices, pupils can choose Shared device: they are signed out automatically after 4 hours or when the browser closes.

Requests from pupils or parents: to get a copy, correct a nickname or delete data, contact the class's teacher (the teacher can rename or remove a pupil straight away), or email sokongan@mantapmath.app with the class name, the pupil's nickname and the teacher's name. We will check the request with the teacher before acting, and reply within 21 days.

If a data breach happens: we do not have pupils' emails or phone numbers, so we will tell the teacher of each affected class through the teacher's account email, and the teacher will tell the pupils and their parents. We will also notify the Commissioner as described in section 17.

• From you, when you sign up and use Kawasan Ibu Bapa (Parent Area).
• From your child, while playing: answers, results, feedback and messages to Cikgu Mantap.
• From Google, if you choose to sign in with Google: your name, email, profile picture link and Google account ID.
• From Stripe, when you pay: payment status, customer ID, subscription ID and subscription period dates.
• From pupils and teachers in Misi A+ Classes: the nicknames, answers and mark ticks pupils enter, and the assignments, ticks and mark confirmations made by teachers (see section 6).
• Automatically from your browser or device: the random device ID, technical data such as IP address, and cookies and browser storage (see section 13).

We use personal data to:

• open and manage parent accounts and child profiles, and let you sign in
• run the game: show questions, check answers, show worked solutions and save progress
• show you your child's progress in Kawasan Ibu Bapa (Parent Area)
• let teachers give assignments to their classes, mark and confirm marks, and see their pupils' results
• provide Cikgu Mantap, enforce its usage limits and detect misuse
• send the weekly report to parents (you can turn it off at any time)
• process Premium subscriptions, decide which content can be unlocked, and handle cancellations, refunds and payment disputes
• contact you by email or phone about your account, support, your child's progress, and changes to prices or policies
• improve questions, worked solutions and difficulty levels using data in aggregate, for example by spotting questions that many pupils get wrong
• keep the service secure, prevent misuse and comply with the law

We do not use your data for advertising.

Some data is required so that we can provide the service. The rest is up to you.

• Required for a parent account: email, password and name (or the name and email from your Google profile if you sign up with Google), phone number, and consent to the Terms of Service and this policy. Without these we cannot open an account, but your child can still play as a guest.
• Required for a child profile: a nickname. Without it, the profile cannot be created.
• Required for pupils in Misi A+ Classes: a nickname. Without it, a pupil cannot join the class, but the teacher can still use printed papers.
• Required while playing: learning data and technical data. These are collected automatically because the game cannot work or save progress without them.
• Optional: your child's Tingkatan (choose “Lain-lain” (Other) if you prefer not to say), a PIN, the weekly report, feedback after games and use of Cikgu Mantap. If you leave these out, the game still works; only the related feature is unavailable.
• For Premium: the payment details Stripe asks for. Without them you cannot subscribe to Premium, but free content remains available.

Cikgu Mantap is an AI tutor that a child can open with the “Ask Cikgu Mantap: why was I wrong?” button after getting an answer wrong. It explains the question step by step. A child playing with a profile in a parent account can also type follow-up questions; guests cannot type. It is powered by Anthropic's Claude model through the Anthropic API (United States).

What we store: every message from your child and every reply from the tutor, together with the child profile (for accounts) or the random device ID (for guests), the question ID, the time, and a salted one-way hash of the IP address, used to enforce usage limits and detect misuse. This hash is stored for messages from both accounts and guests, although the per-IP-address limit applies only to guests.

What is sent to Anthropic: your child's messages and Cikgu Mantap's earlier replies in the same conversation, the question and its topic (including the correct answer and worked solution), and the answer your child chose. Names, email addresses, phone numbers, account IDs and device IDs are not sent.

The Cikgu Mantap panel is labelled “AI tutor · can make mistakes” and reminds children not to share their name, school or personal details. If a child types them anyway, that information will be stored and sent to Anthropic as part of the message. Please talk to your child about this.

There is currently no screen in Kawasan Ibu Bapa (Parent Area) for reading these conversations. You can ask for a copy of your child's conversations through an access request (see section 18).

Cikgu Mantap can make mistakes. It is a learning aid, not a replacement for a teacher or parent.

The weekly report is a free email about your child's progress. It is switched on automatically when you sign up, and is sent on Sunday evening (around 8 pm) for weeks in which your child has played; weeks without play are skipped. You can turn it off at any time in Kawasan Ibu Bapa (Parent Area) → Akaun (Account) or through the link in the email.

The commentary in the report is written with the help of AI from Anthropic (United States). We send only learning statistics and sample answers (the question, your child's answer, the correct answer and the worked solution). Each child is referred to by a code only, with no name, email or phone number.

The report email is sent through Resend (Japan) and contains your child's nickname and a summary of their progress.

Premium payments are processed by Stripe through Stripe Checkout. You enter your card or payment details directly on the Stripe payment page, and Mantap Math never sees or stores your card number.

To set up a payment, we send your account email and internal account ID to Stripe. Stripe then tells us the payment status.

We keep your Stripe customer ID and subscription ID, plan type, Premium end date and cancellation status.

Receipts and invoices for every plan, including the 12-month pass, can be viewed in the Stripe customer portal through Kawasan Ibu Bapa (Parent Area) → Akaun (Account) → Urus Premium (Manage Premium) → Urus langganan · resit · tukar kad (Manage subscription · receipts · change card), where you can also change your card. After Premium has ended, use the Lihat resit lama (View past receipts) link on the Premium page. If you still cannot find a receipt, email sokongan@mantapmath.app and we will send you a copy.

Stripe keeps payment records as the law requires and processes payment data under its own privacy policy. For cancellations and refunds, see our Cancellation and Refund Policy.

We only use cookies and browser storage that the site needs to work. There are no advertising cookies or third-party tracking cookies.

Cookies we use:

• mm_bahasa (up to 1 year): remembers your chosen display language.
• mm_pelajar (up to 1 year): remembers which child profile is playing.
• mm_murid (up to 180 days, or until the browser closes if the pupil chooses Shared device): remembers which classes a pupil has joined on this device, up to 4 classes. The Keluar dari peranti ini (Sign out of this device) button removes that class from the cookie; the cookie is deleted when no classes are left.
• mm_ibubapa_buka (30 minutes): keeps Kawasan Ibu Bapa (Parent Area) unlocked after you sign in or enter your PIN.
• mm_setuju (15 minutes): remembers that you ticked the consent box when signing up with Google, until sign-up is complete.
• Supabase session cookies: keep you signed in.

Browser storage (localStorage), which stays in the browser until it is cleared:

• mm_peranti_id: the random device ID for guests.
• mm_tetamu_v1: guest progress, such as unlocked bosses.
• mm_antrian_v1: a temporary queue of answers and results waiting to be sent to our server, for example when the internet connection drops.
• mm_tugasan_…: a class pupil's Paper 1 answers and Paper 2 ticks that have not yet reached our server, for example when the internet drops; removed once submitted, when the pupil signs out of the device, when the device is no longer signed in as that pupil, or after 7 days.
• mm_latih_… and mm_spm_…: answers and ticks for a Misi A+ practice paper in progress on this device, so they are not lost if the page reloads.
• mm_peperiksaan_bahasa: your chosen language for exam questions (BM, EN or both).
• mm_senyap: remembers whether sound is muted.

If you block or clear these cookies and storage, you may need to sign in again and guest progress will be lost. Stripe's and Google's pages are subject to their own cookie policies.

We do not sell your or your child's personal data, and there are no adverts in Mantap Math.

We share data with service providers that help us run Mantap Math, and only as much as each one needs for its job:

• Supabase: database and sign-in (servers in Seoul, South Korea).
• Vercel: website hosting and server functions (Seoul, South Korea).
• Resend: email sending (Tokyo, Japan).
• Anthropic: AI for Cikgu Mantap and the weekly report commentary (United States).
• Stripe: Premium payment processing.
• Google: sign-in, only if you choose to sign in with Google.

Misi A+ Class pupil data is stored by Supabase and Vercel like other data, and is not sent to Anthropic. The class's teacher receives the nicknames, answers and marks of the pupils in their class, including in any marks file they download.

We may also disclose data to:

• our professional advisers, such as lawyers and accountants, under a duty of confidentiality
• a buyer or successor of the business if Mantap Math changes hands, subject to this policy
• authorities or others where required or permitted by law, for example under a court order or a lawful request from the authorities

Our service providers store and process data outside Malaysia: in South Korea (Supabase, Vercel), Japan (Resend) and the United States (Anthropic). Stripe and Google may process data in other countries through their global networks.

We transfer data outside Malaysia only for the purposes in this policy and in ways permitted by section 129 of the PDPA. The consent you give when you sign up covers these transfers.

Misi A+ Class pupil data is stored in the same locations. Pupils do not sign up with us; teachers inform pupils and parents as described in section 6.

Data protection laws in those countries may differ from Malaysian law.

We keep account data, child profiles and learning data while your account is active, or until you ask us to delete them. We will not keep personal data longer than needed for the purposes in this policy or than the law requires.

You can archive (hide) a child profile yourself with the Buang (Remove) button in Kawasan Ibu Bapa (Parent Area) → Akaun (Account). Its learning data stays stored until you ask us to delete it by emailing sokongan@mantapmath.app.

There is no delete-account button in the app. To delete your account and all your children's data, email sokongan@mantapmath.app.

If you ask us to delete your account, we will first cancel any Monthly or Yearly subscription that is still active, so that no further charges are made. Your deletion request counts as a successful cancellation from the date we receive it.

Any remaining Premium time you have paid for, including a 12-month pass, is not refunded. Payment records kept by Stripe are retained as the law requires.

When an account is deleted, the parent account, child profiles, learning data, Cikgu Mantap conversations, copies of weekly reports, free teacher trial records, and all Misi A+ Classes created by that account together with their pupil data are deleted from our database.

Transaction records, without card details, are kept by us and by Stripe for the period the law requires, including tax and accounting law.

Guest data is linked only to a random device ID, not to a name, email or phone number. For requests about guest data, see section 5.

How long we keep Misi A+ Class data, and how it is deleted, is explained in section 6.

We take practical steps to protect data from loss, misuse and unauthorised access, including:

• encrypted connections (HTTPS) between your device and our site
• access controls in the database so each parent can see only their own children's data
• access controls so each teacher sees only the pupils in their own classes, and pupils cannot see their classmates
• pupils' session tokens and recovery codes stored in hashed form, and attempts at entering class codes limited
• passwords and PINs stored in hashed form
• for Cikgu Mantap messages, a salted one-way hash of the IP address, used to enforce usage limits and detect misuse, stored in place of the IP address itself
• secret system keys kept on the server only and never exposed to the browser
• card details handled entirely by Stripe

Even so, no online system is completely secure.

If a personal data breach happens, we will act promptly to contain and investigate it. We will notify the Personal Data Protection Commissioner within the period set by the Commissioner, as the law requires.

If the breach is likely to cause you significant harm, we will also tell you without undue delay.

Under the PDPA, you can exercise the following rights for yourself and your child:

• Access: find out what personal data we hold and get a copy, including your child's Cikgu Mantap conversations.
• Correction: correct data that is inaccurate, incomplete or out of date. Some details, such as your child's nickname and Tingkatan and your phone number, can be changed yourself in Kawasan Ibu Bapa (Parent Area). For other details, contact sokongan@mantapmath.app.
• Withdrawing consent: at any time, by written notice to sokongan@mantapmath.app. You can withdraw consent for a particular feature without closing your account, for example by turning off the weekly report. If you withdraw the consent needed for an account, we will close the account and delete the data as described in section 16, which also explains what happens to a Premium subscription.
• Deletion: ask us to delete your account and your children's data (see section 16).
• Limiting processing: ask us to stop using your data for direct marketing, or to stop processing it in a way that is likely to cause damage or distress.
• Data portability: ask us to transfer your personal data to another data controller of your choice, subject to the conditions in the PDPA, including whether it is technically feasible and the data formats are compatible.

How to make a request: email sokongan@mantapmath.app with your request and your account email address. We may need to verify your identity first. We will reply within 21 days, and we do not charge a fee for these requests.

Pupils in Misi A+ Classes and their parents do not need an account to make a request: contact the class's teacher, or email sokongan@mantapmath.app as described in section 6.

If we need more time, as the PDPA allows, we will tell you in writing before the 21 days are up.

In certain situations allowed by the PDPA, we may be unable to fulfil a request. If so, we will tell you why.

If you are not satisfied with our response, you can complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, www.pdp.gov.my).

You can limit the data we process in these ways:

• Let your child play as a guest, without an account. Guest data is still stored with a random device ID, as described in section 5.
• Use a nickname for the child profile, and choose “Lain-lain” (Other) for Tingkatan if you prefer not to say.
• The weekly report is switched on automatically. You can turn it off in Kawasan Ibu Bapa (Parent Area) → Akaun (Account) or through the link in the email.
• Cikgu Mantap is only used when your child opens it with the “Ask Cikgu Mantap: why was I wrong?” button. Remind your child not to type their name, school or personal details there, or in feedback comments.
• Sign up with email and password if you would rather not use Google.
• Set a PIN so that only you can open the Parent Area.
• You can archive (hide) a child profile yourself with the Buang (Remove) button in Kawasan Ibu Bapa (Parent Area) → Akaun (Account). Its learning data stays stored until you ask us to delete it by emailing sokongan@mantapmath.app.
• Clear browser data to remove guest progress and the device ID from that device. This does not delete records already sent to our server.
• If your child joins a Misi A+ Class, remind them to use a nickname rather than their full name, and to press Keluar dari peranti ini (Sign out of this device) on shared computers.

This policy is provided in Bahasa Melayu and English. If the two versions conflict, the Bahasa Melayu version prevails. Users who choose the Chinese interface are shown the English version.

We may update this policy from time to time. The latest version is always shown on this page with its effective date.

For important changes, we will email parents who have accounts before the changes take effect. Changes do not affect your rights relating to payments made before the change takes effect, and do not reduce Premium benefits during a period you have already paid for.

If a change needs your fresh consent, we will ask for it before the change applies to you.

This version applies from 22 September 2026.

For any questions, requests or complaints about personal data, contact us at sokongan@mantapmath.app.

We reply to general enquiries within 3 working days, and to personal data requests under the PDPA within 21 days.

Our business details are shown in the Operator details box at the bottom of this page.