Privacy Policy / Polisi Privasi

1. Who we are / Siapa kami

DuitMap ("duitmap.my", "we", "us", "our") operates online calculators, guides and tools that help Malaysians plan their money. We are a data user (data controller) under Malaysia's Personal Data Protection Act 2010 ("PDPA").

DuitMap ("duitmap.my", "kami") mengendalikan kalkulator, panduan dan alat atas talian untuk membantu rakyat Malaysia merancang kewangan. Kami ialah Pengguna Data di bawah Akta Perlindungan Data Peribadi 2010 ("PDPA").

2. What personal data we collect / Data peribadi yang dikumpul

Calculator inputs are browser-first. Numbers you type into calculators stay in your browser (localStorage) and are never sent to our servers unless you are logged in and explicitly press "Simpan ke Cloud".

Input kalkulator kekal dalam pelayar anda. Angka yang anda taip dalam kalkulator disimpan dalam pelayar (localStorage) dan tidak dihantar ke pelayan kami melainkan anda log masuk dan menekan "Simpan ke Cloud" secara jelas.

We do not collect sensitive data (religion, health, biometrics). / Kami tidak mengumpul data sensitif (agama, kesihatan, biometrik).

3. How we use your data / Cara penggunaan

1. Provide the calculators, guides and (optional) cloud-save features.
2. Send transactional emails: email verification and password reset links.
3. Protect the service: bot detection on registration, login rate limiting and account lockout, and breach-checking of new passwords (see Section 7).
4. Analytics to improve features (see Section 10).
5. E-mail updates or promotions — only if you opted in; you can opt out anytime.
6. Review reports about inaccuracies in articles and calculator pages.

Penggunaan data selaras dengan Prinsip Am, Notis & Pilihan, dan Integriti Data PDPA.

4. Legal basis & consent / Asas sah & persetujuan

We process data with your consent (Section 6 PDPA) and to perform the service you request. Consent is obtained via tick-box at signup and can be withdrawn at any time by deleting your account on the Akaun Saya page. Notice is provided in BM & EN as required by the Notice & Choice Principle (Section 7 PDPA).

5. Where data is stored / Lokasi penyimpanan

Our application and database are hosted on dedicated infrastructure in Singapore (Hetzner). Website traffic is routed through Cloudflare's global network for security and performance, and transactional emails are delivered through Resend using sending infrastructure in the Asia-Pacific region. This means personal data is transferred outside Malaysia as part of providing the service.

Aplikasi dan pangkalan data kami dihoskan di Singapura (Hetzner). Trafik laman web melalui rangkaian global Cloudflare untuk keselamatan dan prestasi, dan e-mel transaksi dihantar melalui Resend menggunakan infrastruktur di rantau Asia-Pasifik. Ini bermakna data peribadi dipindahkan ke luar Malaysia sebagai sebahagian daripada penyediaan perkhidmatan.

These transfers are made in line with Section 129 PDPA and the Personal Data Protection (Transfer of Personal Data Outside Malaysia) framework: we use established providers bound by their data-processing terms, all transfers are encrypted in transit (TLS), and we minimise what is transferred to what the service needs.

6. Third-party processors / Pemproses pihak ketiga

We share limited data with the following processors:

7. Security / Keselamatan

• HTTPS everywhere with HSTS; TLS 1.2 minimum.
• Passwords stored only as bcrypt hashes — we cannot see your password.
• New passwords are checked against known data breaches (privacy-preserving, see Section 6) and rejected if compromised.
• Password reset and email verification use single-use, expiring links whose tokens are stored hashed.
• Login protection: layered rate limiting and automatic account lockout with escalating cooldowns after repeated failed attempts.
• Bot protection (Cloudflare Turnstile) on registration; web application firewall in front of the site.
• Every account's cloud data is accessible only to that account — enforced structurally in every database query.
• Role-based admin access; security headers including a Content Security Policy.

Kawalan keselamatan mengikut Personal Data Protection Standard 2015.

8. Retention & deletion / Tempoh simpanan & pemadaman

You can delete your account and all cloud data yourself at any time on the Akaun Saya page ("Padam akaun") — deletion is immediate and permanent. You can also e-mail [email protected] and we will erase your personal data within 10 working days.

Anda boleh memadam akaun dan semua data cloud anda sendiri pada bila-bila masa di halaman Akaun Saya ("Padam akaun") — pemadaman adalah serta-merta dan kekal. Anda juga boleh e-mel [email protected] dan kami akan memadam data peribadi anda dalam tempoh 10 hari bekerja.

9. Your rights / Hak anda

Under PDPA you may access, correct, delete or withdraw consent to processing of your personal data. Deletion and data export (download your saved data as JSON) are self-serve on the Akaun Saya page; for anything else, contact us (Section 12). Fees permitted by law may apply for repeated or manifestly unfounded requests.

10. Cookies, local storage & analytics / Kuki, storan tempatan & analitik

Essential cookies keep you logged in. Financial inputs typed while logged out stay only in your browser's localStorage unless you choose "Simpan ke Cloud". We use Google Analytics to understand aggregate usage and improve the site; it loads by default, and you can switch it off for your device right here:

Kuki penting mengekalkan log masuk anda. Input kewangan yang ditaip semasa log keluar kekal dalam localStorage pelayar sahaja melainkan anda memilih "Simpan ke Cloud". Kami menggunakan Google Analytics untuk memahami penggunaan agregat; ia dimuatkan secara lalai, dan anda boleh mematikannya untuk peranti anda di sini:

11. Children / Kanak-kanak

Our tools are designed for Malaysians aged 18 and above. If you are under 18, please obtain parental consent before creating an account. We will delete any account created by a minor without verifiable consent.

12. Contact us / Hubungi kami

13. Changes to this notice / Perubahan notis

We may update this policy; the latest version is always at https://duitmap.my/privacy. Significant changes will be announced via in-app banner or e-mail.