Belanje Privacy Policy

1. Introduction

This Privacy Policy explains how AIZZ TECH SOLUTIONS ("we", "us", "our") collects, uses, and protects your personal information when you use the Belanje mobile application (the "Service"). Belanje is a personal and small-business finance app for tracking income and expenses, budgets, bills, invoices, and Malaysian tax estimates, developed and operated by AIZZ TECH SOLUTIONS, a partnership registered in Malaysia under business registration number 202603004666, of No. 3B, Lot 2967, Jalan Bukit Naga, 40460 Shah Alam, Selangor, Malaysia. AIZZ TECH SOLUTIONS is the data controller for the personal data described in this policy. By using the Service you agree to the processing of your information as described below.

We handle your personal data in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024. This policy applies only to the Belanje app. Other AIZZ TECH SOLUTIONS products and websites may have their own privacy notices.

2. Information we collect

We collect only the information needed to run the Service:

• Account information: your email address, display name, and (if you sign in with Google or Apple) the basic profile fields those providers return.
• Financial records you enter: transactions (income and expenses), budgets, bills, subscriptions, loans, savings goals, and the categories, notes, dates, and payment methods you attach to them. This is the content you create to use the app.
• Receipts and documents: photos of receipts you scan or upload, and the line items, merchant, totals, and tax amounts extracted from them.
• Business and invoicing data (business mode): your business profile, invoices, customers, inventory, and SST/e-invoice details you choose to record.
• Tax profile: figures you enter for tax estimates, such as annual income, reliefs, marital status, and PCB/MTD amounts. These are estimates for your own planning and are not filed with any authority.
• Team data (optional): if you invite a team member with a connect code, the members you add and their assigned role. Team members can see the business data you share with them.
• Notification token: a token that identifies your device so we can deliver the bill reminders, budget alerts, and updates you opt into.
• Diagnostics: basic crash logs and error events used to fix bugs. No advertising identifiers are used.

We do not collect or store payment card data. Subscription payments are processed entirely by Apple or Google through your App Store or Google Play account.

3. Automatic payment detection (Android, optional)

On Android, Belanje offers an optional "payment alerts" feature. If you turn it on and grant the system "Notification access" permission, the app reads incoming bank and e-wallet notifications on your device to pre-fill a transaction (amount, merchant, and whether it was money in or out) for you to confirm.

This parsing happens entirely on your device. The contents of your other notifications are never sent to our servers or shared with anyone. You can disable the feature, or revoke Notification access in your device settings, at any time. This feature is not available on iOS.

4. How we use your information

• Operate the finance tracker, budgets, bills, invoicing, and tax-estimate features you use.
• Authenticate you and keep your account secure.
• Read receipt photos to extract their details so you don't have to type them (see section 6).
• Deliver bill and subscription reminders, budget alerts, and product updates at the times and for the items you choose.
• Sync your data across your devices and, where you enable it, with team members you invite.
• Respond to support requests, enforce our Terms of Use, and investigate abuse.

5. Who we share information with

We never sell your personal information. We share limited data only with service providers that help us run Belanje:

• Supabase: hosts our database, authentication, and encrypted file storage for your receipts.
• Apple and Google: process Sign in with Apple, Sign in with Google, and in-app subscription payments.
• RevenueCat: manages Belanje Plus and Pro subscription entitlements. It receives a pseudonymous app user ID and your purchase status, not your financial records.
• Receipt processing service: reads receipt images and quick-add text through a secure server-side function so we can extract the details for you. Only the specific content needed for that task is sent (see section 6).
• Notification delivery service: sends the push notifications you opt into.

We may also share information when required by law, to protect the rights and safety of our users, or in connection with a business transfer, in which case the new entity will be bound by this policy.

6. Receipt scanning

When you scan or upload a receipt, the image is stored in your private encrypted storage and sent to our receipt-processing service through a secure server-side function, only for the duration of that extraction task. The image and text are used solely to return the receipt's details to you and are not retained by that service for training. The same applies to the "quick add" text parser. You can delete any receipt and its extracted data from the app.

7. Data retention

We retain your data for as long as your account is active. When you delete your account from Settings → Delete Account, we permanently remove your profile, transactions, budgets, bills, invoices, receipts, tax figures, and team records from our primary database within 30 days. Encrypted backups are rotated out within 60 days.

8. Your rights under Malaysian law

Under the PDPA and equivalent laws, you can exercise these rights at any time, in the app or by contacting us:

• Access and export: request a copy of the data on your account.
• Correction: edit your profile and financial records in-app.
• Deletion: delete your account from Settings → Delete Account.
• Object or restrict processing: email us to opt out of optional processing.
• Withdraw consent: turn off payment alerts, notifications, or remove team members at any time.
• Data portability: ask us to transmit your personal data directly to another service provider, where this is technically feasible and the receiving service is compatible with our export format. Contact us at contact@aizztech.com to make such a request.

To exercise any of these rights, use the controls in Settings within the app, or contact us at contact@aizztech.com. We will respond within 21 days as required under the Act.

9. Children

Belanje is intended for users aged 18 and above and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.

10. Security

We use industry-standard safeguards including TLS in transit, encrypted database and file storage, row-level security policies so each user can only access their own data, and audited access controls. No system is 100% secure; please use a strong, unique password and enable your device passcode/biometrics.

11. Transfers outside Malaysia

Some of the service providers we use to operate Belanje process data on servers located outside Malaysia (such as Singapore, the United States, and the European Union). These are listed in section 5, "Who we share information with", above. Before transferring your personal data outside Malaysia, we satisfy ourselves that the receiving jurisdiction or provider affords a level of protection substantially similar to, and no less protective than, that required by the Personal Data Protection Act 2010. We do this by relying on the contractual data protection commitments given by each provider.

12. If there is a data breach

Belanje holds financial records, receipts, invoices and tax information, and we treat the security of that data as a priority. If a breach of security occurs that causes or is likely to cause significant harm to you, we will notify the Personal Data Protection Commissioner as soon as possible and in any event within 72 hours of becoming aware of it, and we will notify you within 7 days of that notification. We will tell you what happened, what data was involved, and what you should do.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the Belanje app or by email.

14. Contact us

Questions about this policy or about how we handle your personal data may be sent to contact@aizztech.com. If you are not satisfied with our response you may lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Malaysia.

AIZZ TECH SOLUTIONS
Business Registration No. 202603004666
No. 3B, Lot 2967, Jalan Bukit Naga, 40460 Shah Alam, Selangor, Malaysia
Developer of the Belanje mobile app
aizztech.com