TUJUBook a Conversation →
Legal

Privacy Policy

Tuju is an advisory practice, not a data business. We collect the minimum needed to respond to an enquiry, prepare the work you asked for, and keep a record of it.

Last updated: 9 August 2026

1. Who we are

Tuju (“Tuju”, “we”, “us”) is an independent executive advisory practice based in Malaysia, operating the website tuju.work. Tuju advises leadership teams on business direction and decision criteria before AI investment begins.

Tuju is the trading name of Michelle Lee, a sole proprietorship registered in Malaysia (registration no. 202403323709, business no. AS0488144-P). We are the data user and controller for the personal data described in this policy. Our registered address is available on request.

For any question about this policy or about personal data we hold, contact grow@tuju.work.

2. What this policy covers

This policy applies to:

  • the Tuju website at https://www.tuju.work and its subpages;
  • the AI Starting Hypothesis request page at https://www.tuju.work/ai-starting-hypothesis;
  • enquiry, resource-download and contact forms on those pages;
  • email correspondence and advisory work that follows from a submission;
  • advertising and Page activity we run on LinkedIn and other platforms, including LinkedIn Lead Gen Forms.

It does not cover third-party websites we link to. Their own policies apply once you leave tuju.work.

3. Personal data we collect

3.1 Information you give us

We collect only what a form asks for. Nothing on this site requires you to create an account.

  • Direction Conversation / enquiry form — name, business email, company, role (optional), the decision you are trying to make, your organisation’s stage (optional), and any message you add.
  • Resource downloads — name, business email and company, so we can send you the resource.
  • AI Starting Hypothesis request — name, job title, company, business email, company website (optional) and your position on AI (optional).
  • LinkedIn Lead Gen Forms — where we run one, LinkedIn passes us the fields you confirmed on LinkedIn, typically name, email, job title and company.
  • Correspondence — anything you choose to send us by email or share during an advisory conversation or engagement.

Please do not send us confidential, commercially sensitive or personal information about other people through a web form. If an engagement requires it, we will agree the appropriate terms with you first.

3.2 Information collected automatically

Our hosting provider records standard server and security logs — IP address, browser type, pages requested, timestamps and referring URL — to serve the site, keep it available and defend against abuse. Our forms include a hidden anti-spam field; if it is completed we discard the submission.

Tuju does not run its own analytics, advertising or profiling cookies on tuju.work. Where we advertise on LinkedIn, LinkedIn’s own tracking may apply — see section 7.

3.3 Publicly available company information

To prepare an AI Starting Hypothesis, we review information your company has already published — your website, public filings, published announcements, job listings, industry reporting and similar sources. We research the organisation, not the individual who submitted the form.

4. The AI Starting Hypothesis — how it works

This matters enough to state plainly, because it is where most data reaches us.

  • Submitting a request is not a guarantee of a report. We review each request and prepare a hypothesis only for selected companies.
  • We triage submissions. Job title, email domain and company website are scored automatically to help us decide where to spend research time. This is an internal prioritisation aid reviewed by a person — it produces no legal or similarly significant effect, and no decision about you is made by automated means alone.
  • The hypothesis is written by a human. It is an outside-in view drawn from public information: one relevant business priority, one plausible AI-enabled possibility, the operational change it may require, the evidence management would need, and what cannot be known from outside.
  • Where we use AI tools to help research, structure or draft material, we use business-tier services under agreements that do not permit your data to be used to train their models. We do not put confidential client material into general-purpose consumer AI tools.
  • It is not advice on you. A Starting Hypothesis is a starting point for a leadership conversation — not a diagnosis, an AI strategy, a business case or an investment recommendation.

5. Why we use your data, and our lawful basis

  • To respond to your enquiry and deliver what you requested — necessary to take steps at your request before entering a contract, and to perform one.
  • To assess whether an engagement is a fit, including the triage described above — our legitimate interest in allocating advisory capacity sensibly.
  • To send occasional relevant material where you asked for it or where you are an existing business contact — consent, or legitimate interest in business-to-business communication. Every such email carries an unsubscribe option.
  • To keep the site secure and available, and to keep business records — legitimate interest and legal obligation.

Under Malaysia’s Personal Data Protection Act 2010, we process personal data with your consent, given when you submit a form, and for the purposes stated at the point of collection. Where the EU/UK GDPR applies to you, the lawful bases above apply.

We do not sell personal data, and we do not share it for advertising purposes.

6. Who we share data with

We share personal data only with service providers who process it on our instructions, and only as far as their function requires:

  • Vercel — website and form hosting, including server logs.
  • Resend — delivery of confirmation and notification emails.
  • Google (Workspace and Google Sheets) — our record of enquiries and requests, and business email.
  • AI service providers (including Anthropic) — where AI tools assist with research or drafting, under business terms that exclude training on our data.
  • LinkedIn — where you reach us through a LinkedIn advert or Lead Gen Form.
  • Professional advisers or authorities — where we are required by law, or need to establish or defend a legal claim.

Some of these providers operate outside Malaysia, so your data may be transferred and stored abroad. Where that happens, we rely on the providers’ contractual data-protection commitments, including standard contractual clauses where applicable.

7. Cookies, LinkedIn and advertising

tuju.work uses only what is strictly necessary to serve the site. We do not set marketing or analytics cookies of our own, which is why you will not see a consent banner.

If we run LinkedIn advertising, LinkedIn may set cookies or use its Insight Tag to measure campaigns and build audience segments, and LinkedIn acts as an independent controller for that activity under its own Privacy Policy. You can manage this in your LinkedIn advertising settings, and control cookies generally in your browser settings.

8. How long we keep it

  • Enquiries and requests that do not proceed — up to 24 months, then deleted.
  • Client and engagement records — for the engagement and up to 7 years afterwards, to meet accounting, tax and professional-record obligations.
  • Mailing list — until you unsubscribe.
  • Server and security logs — for the short period our hosting provider retains them.

9. How we protect it

Data is held in access-controlled business accounts protected by strong authentication, transmitted over encrypted connections, and available only to those who need it to do the work. No system is perfectly secure, but we keep the amount of data we hold deliberately small — which is the most reliable protection available.

10. Your rights

You may ask us at any time to:

  • confirm what personal data we hold about you, and give you a copy;
  • correct anything inaccurate or incomplete;
  • delete data we no longer have a reason to keep;
  • stop using your data for marketing, or limit how we use it;
  • withdraw consent, without affecting what was lawful beforehand.

Write to grow@tuju.work and we will respond within 21 days, or sooner where the law requires it. We may need to verify your identity first. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia, or to your local supervisory authority.

11. Children

Tuju’s services are for organisations and their leadership. The site is not directed at anyone under 18, and we do not knowingly collect their data. If you believe we have, tell us and we will delete it.

12. Changes to this policy

We will update this page when our practices change, and revise the date at the top. Where a change is significant and we hold your contact details, we will tell you directly.

13. Contact

Tuju · Direction Before Investment
Michelle Lee (202403323709 · AS0488144-P)
Kuala Lumpur, Malaysia — registered address available on request
Email: grow@tuju.work
Web: tuju.work