Privacy Policy

FirmaHub (firmahub.my) provides an online office system for businesses. This policy explains what personal data we handle and how, in line with Malaysia's Personal Data Protection Act 2010 (PDPA). This is a translation; if it differs from the Malay version, the Malay version prevails.

1. Your data belongs to you

Everything your company enters into its office (clients, quotations, invoices, workers, payroll, documents) belongs to your company. Your company decides what is entered; FirmaHub stores and processes it only to provide the service to you. We do not sell your data and we do not use it for advertising.

2. What we collect

• Account details: company name, registration number, and the name, email and password (stored encrypted) of each user.
• Office data: whatever your company enters into the office, including data about your staff and clients.
• Technical data: login time, device session and basic server logs, used for security and troubleshooting.

3. Where your data is kept

• Each company has its own separate database; other companies cannot see your data.
• Our servers are in Malaysia. Website traffic passes through Cloudflare's network for security and speed.
• We make daily backups so data can be restored if something goes wrong.

4. Services we use

• OpenAI — only when you use an AI feature (for example scanning a receipt or business card), that image or text is sent to OpenAI for processing. Under OpenAI's current policy, API data is not used to train their models.
• Cloudflare — secure connection to firmahub.my.
• Hostinger — our email ([email protected]), for example password-reset emails.

5. Cookies

We use a login session cookie and a language-choice cookie. Cloudflare may set security cookies. We do not use advertising or tracking cookies.

6. How long we keep data

While your trial or subscription is active, your data is kept. If it ends, office access stops but data is kept for 90 days so you can continue by subscribing. After that, or earlier on your written request, the data may be permanently deleted. You may ask for a copy of your data before deletion.

7. Security

Passwords are stored encrypted, each login ID can only be active on one device at a time, and Admins can deactivate staff access immediately. No system is 100% secure, so please keep your password private.

8. Your rights

You may ask to access, correct or delete your personal data, or ask questions about this policy, by emailing [email protected].

9. Changes

We may update this policy. Important changes will be announced on this website or by email.