Last updated: 14 July 2026
This policy explains what information investstar.ai collects when you visit this site or use the service, how we use it, and the choices you have. By using investstar.ai you agree to the practices described here.
investstar.ai is operated by a Labuan company incorporated in Malaysia. It runs this website and the investstar.ai research dashboard and is the organisation responsible for the personal data described in this policy under Malaysia's Personal Data Protection Act 2010 (PDPA). You can reach us about anything in this policy through the contact form.
When you create an account or contact us we collect the information you give us:
Please do not submit sensitive personal data (such as government identifiers, health information, or data revealing racial or ethnic origin) — the service does not need it and is not designed to hold it.
Like most websites, our servers keep standard request logs: IP address, browser type, pages requested, and timestamps. We use these for security, debugging, and capacity planning.
investstar.ai sets a single authentication cookie to keep you signed in. We do not use advertising cookies or cross-site tracking.
We use the information above solely to operate and improve investstar.ai: to authenticate you, run the research you request, maintain your portfolios and report history, bill you correctly, respond when you contact us, and keep the service secure. We do not sell your personal information, and we do not use your portfolio contents for anything other than producing your own reports.
We send transactional email — sign-in links, receipts, and replies to your enquiries. If we ever send product updates, every such email will include an unsubscribe link and opting out will not affect your account.
investstar.ai relies on a small number of third-party processors to operate: a payment processor for billing, an email delivery provider for sign-in links and replies, market-data providers to fetch prices and fundamentals, and an AI model provider to generate research content. Each receives only the data required to perform its function and may not use it for other purposes. We may also disclose information where required by law or to protect the rights, safety, or property of investstar.ai or its users.
Our servers and service providers may be located outside Malaysia or your country of residence. Where data crosses borders we ensure it remains protected to a standard comparable to the PDPA, relying on the safeguards offered by our providers. No transmission over the internet is completely secure, and we cannot guarantee absolute security.
Access to the dashboard is authenticated, connections are encrypted in transit, and secrets are stored outside the codebase. We limit access to personal data to what operating the service requires.
Account data, portfolios, and report history are kept while your account is active so the service can show you your own past work. Server logs are rotated on a short schedule. When your account is deleted, associated personal data is removed within a reasonable period except where law requires retention (for example, billing records).
Subject to applicable law (including the PDPA, and the GDPR if you are in the EU/EEA), you may ask us to:
Make any of these requests through the contact form; we may need to verify your identity before acting on them.
investstar.ai is not directed at children and may not be used by anyone under 18. We do not knowingly collect personal data from minors.
We may update this policy from time to time. Material changes will be posted on this page with a new "last updated" date before they take effect.
If you have a concern about how your data is handled, contact us first through the contact form and we will try to resolve it. You may also complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi) or, where applicable, your local data-protection authority.