Effective date: 6 June 2026 · WangAku
Complies with Malaysia Personal Data Protection Act 2010 (as amended 2024) and Singapore Personal Data Protection Act 2012 (as amended 2021).
1. Information We Collect
We collect the following personal data when you use WangAku:
- • Identity & Contact — name, email address, and profile photo obtained via Google Sign-In.
- • Financial Profile — self-set daily budget target, job title, industry, and self-reported spending burdens (e.g. mortgage, family).
- • Expense Records — merchant names, receipt dates, item descriptions, amounts, and currencies recorded via receipt scanning, voice input, or manual entry.
- • AI-Derived Inferences — spending patterns, category trends, and financial behaviour insights generated from your expense records by our AI features.
- • Usage Data — AI feature usage count and date for service management.
2. How We Use Your Data
We use your data only for the purposes stated below. We will not use it for any other purpose without obtaining fresh consent:
- • To provide personalised expense tracking and financial summaries.
- • To generate AI-powered insights tailored to your financial profile.
- • To prevent duplicate expense entries and improve accuracy.
- • To manage your account and respond to support requests.
3. Third-Party Service Providers
To operate WangAku, we engage the following categories of service providers. Each provider is contractually bound by data processing agreements that require them to protect your data and process it only on our instructions. Transfers to providers outside Malaysia and Singapore are protected by standard contractual clauses or equivalent safeguards recognised under applicable law.
- • Identity Provider — a third-party single sign-on service authenticates your identity. Your name, email address, and profile photo are obtained from this provider when you sign in.
- • Cloud Database & Storage Provider — your account profile and expense records are stored in a managed cloud database. Servers may be located outside Malaysia and Singapore; transfers are protected by the provider's data processing agreement. We do not sell your data to third parties.
- • Application Hosting Provider — the WangAku application is served from a cloud infrastructure platform. Request metadata (IP address, device type) is processed by this provider in the ordinary course of serving the app.
- • AI Processing Provider — when you use receipt scanning, voice input, or spending summary features, the relevant data (receipt images, voice transcripts, or aggregated spending figures) is transmitted to an AI processing service solely to fulfil your request. This data is not used to train AI models on your behalf. The provider's data processing terms govern data processed through their API.
A full list of sub-processors is available on request via wangaku.my@gmail.com.
4. Data Retention
Your personal data is retained for as long as your account is active. When you delete your account:
- • Your profile and authentication record are permanently deleted within 30 days.
- • Your expense records are permanently deleted within 90 days.
- • Anonymised aggregate statistics (with no link to your identity) may be retained for service improvement.
We do not retain any personal data beyond these periods except where required by law.
5. Your Rights
Under Malaysia PDPA 2010 (amended 2024) and Singapore PDPA 2012 (amended 2021) you have the right to:
- • Access your data — use Export My Data in Settings (machine-readable JSON format).
- • Correct inaccurate data — use Profile Settings.
- • Delete your account and data — use the Danger Zone in Settings.
- • Data portability — your export includes all records in a structured, machine-readable format you can transfer to another service.
- • Withdraw consent — contact us at the address below. Withdrawing consent may limit app functionality.
6. Data Breach Notification
In the event of a personal data breach that is likely to cause significant harm, we will:
- • Notify the relevant data protection authority within 72 hours (Malaysia) / 3 calendar days (Singapore) of becoming aware of the breach.
- • Notify affected users as soon as reasonably practicable where the breach poses a real risk of significant harm to you.
- • Provide details of the nature of the breach, data affected, and steps taken to mitigate impact.
7. Security
All data is transmitted over HTTPS and stored with access controls and encryption at rest. We apply industry-standard security practices, conduct periodic access reviews, and restrict data access to authorised personnel only. No method of online transmission is 100% secure, and we cannot guarantee absolute security.
8. Data Protection Responsibility
WangAku is currently operated as a small-scale beta service. Data protection responsibilities are managed directly by the operator. As the service grows, we will appoint a designated Data Protection Officer (DPO) as required under applicable law. For all data protection enquiries, contact us at the address in Section 10.
9. Children
WangAku is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this policy from time to time. Where changes are material, we will notify you within the app before they take effect. Continued use of the app after the effective date of changes constitutes acceptance of the revised policy.
11. Contact Us
For data access requests, corrections, deletions, portability requests, complaints, or consent withdrawal, contact:
wangaku.my@gmail.com
We will respond to all requests within 21 days in accordance with Malaysian and Singaporean data protection law.
