Privacy Policy

Last updated: September 2026

Introduction & Scope

Wrkboard ("we", "our", or "us") is a business management platform operated for Malaysian small and medium enterprises. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Wrkboard mobile application (Android and iOS) and the web application at app.wrkboard.com.

This policy applies to all users of Wrkboard, including business owners, administrators, and staff members. It is prepared in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

By creating an account or using Wrkboard, you consent to the collection and use of your data as described in this policy.

Data We Collect

We collect the following categories of data to provide and improve our service:

Personal Data You Provide

When you register and use Wrkboard, you provide us with:

• Phone number — used for registration and login
• Password — encrypted and never stored in plain text
• Full name — displayed in your profile and visible to your team
• Business or company name — used to identify your workspace
• Profile photo (optional) — displayed in your profile

Business Data You Create

Through your use of Wrkboard, you create and store business data including:

• Customer records, invoices, products, and expenses
• Staff records, payroll information, and attendance logs
• Bookings, tasks, and deliveries
• Expense receipt photos captured via camera or selected from your photo library

This is your business data. We process it on your behalf to provide the Wrkboard service and do not use it for any other purpose.

Device & Technical Data

We automatically collect certain technical data when you use the app:

• Device name, model, and operating system version
• App version — used to ensure compatibility and enforce minimum version requirements
• Push notification token — used to deliver notifications to your device
• Network connectivity status — used to show offline indicators and queue actions
• Device locale and timezone — used to display the app in your preferred language and correct time

Location Data

We collect location data only when you explicitly perform an action:

• GPS coordinates (latitude and longitude) are collected only when you check in or check out for attendance
• Location is never collected in the background or tracked continuously
• Location data is used solely to verify that attendance is recorded at the designated workplace

How We Use Your Data

We use your data for the following specific purposes:

• Phone number and password — to authenticate you into the app
• Biometric data (Face ID or Fingerprint) — for optional quick login. Your biometric data never leaves your device; only a verification token is sent to our server
• Business data — to provide the core Wrkboard service including invoicing, HR management, inventory, accounting, and operations
• Location — to verify attendance check-in and check-out at your workplace
• Device information — to identify your session, deliver push notifications, and enforce minimum app version requirements
• Push notification token — to send you notifications about invoices, leave requests, bookings, and tasks
• Receipt photos — to attach proof of purchase to expense records
• Locale and timezone — to display the app in your preferred language (English or Bahasa Malaysia) and in the correct timezone (UTC+8)

We do not use your data for advertising, profiling, or selling to third parties.

Data Sharing & Third Parties

We share data with a limited number of third-party services, all of which are essential to the functioning of the app:

We do not use analytics providers, advertising networks, data brokers, or social media SDKs. Your data is never sold or shared for marketing purposes.

Data Storage & Security

We take the security of your data seriously and implement the following measures:

• All data is stored on servers in the Singapore region
• All data in transit is encrypted using HTTPS/TLS
• Passwords are hashed using bcrypt and are never stored in plain text
• Authentication tokens are stored in your device's encrypted storage (Secure Enclave on iOS, Keystore on Android)
• Biometric data (Face ID, Fingerprint) never leaves your device — only a verification token is transmitted to our server
• Your business data is logically isolated from other tenants using row-level security

Data Retention & Deletion

• Your business data is retained for as long as your account remains active
• Upon account deletion, all your data (invoices, customers, staff records, expenses, and all other tenant data) is permanently deleted within 30 days
• Push notification tokens are removed immediately when you log out of the app

You may request account deletion at any time by contacting us at [email protected] or through the account settings in the app.

Your Rights Under PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right of Correction: You may request that we correct any inaccurate or incomplete personal data.
• Right to Withdraw Consent: You may withdraw your consent for data processing at any time. Please note that this may limit your ability to use certain features of the service.
• Right to Complain: You may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your data has been mishandled.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 21 days.

Children's Privacy

Wrkboard is a business management tool and is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal and regulatory reasons. Any changes will be posted on this page with an updated "Last updated" date. Your continued use of Wrkboard after any changes constitutes your acceptance of the updated policy.

Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at [email protected].