Privacy notice · Notis privasi

Effective 16 August 2026. This notice explains how WangBuddy handles personal data under Malaysia's Personal Data Protection Act 2010. The English and Bahasa Malaysia sections describe the same practices.

English

Who controls your data

The data controller is OWN MY STAGE EVENT MANAGEMENT, at No 7, Gerai Kampung Merdeka, 83000 Batu Pahat, Johor. Privacy questions and requests may be sent to [email protected].

Data we collect and why

Required account data includes your name, email, password hash, server-backed session records, and security events. You choose whether to enter balances, income and spending transactions, commitments, reserves, safety buffers, Dream goals, and notes. WangBuddy processes this data to authenticate you, calculate and display your cashflow plan, provide exports and reports, prevent fraud and duplicate writes, support you, and meet security, payment, dispute, and legal obligations.

If you buy Pro, WangBuddy stores subscription, entitlement, invoice, provider-reference, verification, and reconciliation records. Card numbers and CVV are handled by Curlec / Razorpay or Google Play and are not stored by WangBuddy. Google Play purchase tokens are retained only on WangBuddy's server for verification, acknowledgement, reconciliation, cancellation, and fraud prevention.

Required and optional information

Name, email, password, and security records are required to provide an account. Financial entries and acquisition attribution are optional, but features that depend on omitted data cannot calculate a useful result. You may decline optional data or withdraw it by deleting entries or your account.

Who receives data

Data may be disclosed only as needed to infrastructure and database hosting providers, transactional-email providers, Curlec / Razorpay, Google Play, professional advisers, regulators, courts, law enforcement where legally required, and authorised WangBuddy operators who need it for support, security, billing, or reconciliation. Service providers may process data outside Malaysia subject to contractual, security, and legal safeguards. WangBuddy does not sell personal data.

Advertising is currently disabled. WangBuddy will not enable AdSense for production until the required consent, disclosure, and legal configuration has been approved. Setting ADSENSE_ENABLED=false disables WangBuddy's AdSense integration.

Optional first-party acquisition measurement is currently disabled.

Retention, security, and your choices

Account and cashflow data is kept while your account is active. Expired sessions and reset tokens have automatic expiry. After account deletion, financial entries and account identifiers are deleted. Limited billing and reconciliation records may be retained in pseudonymised form where needed for payment reconciliation, disputes, accounting, fraud prevention, or law. Exact statutory retention periods must be confirmed in the production retention schedule.

WangBuddy uses HTTPS in production, Argon2 password hashing, revocable server sessions, access controls, tenant-scoped queries, audit records, and restricted secrets. No online service can promise absolute security, and WangBuddy does not claim end-to-end encryption.

You may request access to or correction of personal data, export your data, object or withdraw consent where applicable, and permanently delete your account under Me. Contact [email protected] to exercise a right or make a complaint. Identity verification may be required. You may also contact Malaysia's Personal Data Protection Commissioner.

Bahasa Malaysia

Siapa yang mengawal data anda

Pengawal data ialah OWN MY STAGE EVENT MANAGEMENT, di No 7, Gerai Kampung Merdeka, 83000 Batu Pahat, Johor. Soalan dan permintaan privasi boleh dihantar kepada [email protected].

Data yang kami kumpul dan tujuan penggunaannya

Data akaun yang wajib termasuk nama, e-mel, hash kata laluan, rekod sesi pelayan dan peristiwa keselamatan. Anda memilih sama ada untuk memasukkan baki, transaksi pendapatan dan perbelanjaan, komitmen, rizab, penampan keselamatan, matlamat Dream dan nota. WangBuddy memproses data ini untuk mengesahkan identiti, mengira dan memaparkan pelan aliran tunai, menyediakan eksport dan laporan, mencegah penipuan dan catatan berganda, memberi sokongan, serta memenuhi kewajipan keselamatan, pembayaran, pertikaian dan undang-undang.

Jika anda membeli Pro, WangBuddy menyimpan rekod langganan, kelayakan, invois, rujukan penyedia, pengesahan dan penyelarasan. Nombor kad dan CVV dikendalikan oleh Curlec / Razorpay atau Google Play dan tidak disimpan oleh WangBuddy. Token pembelian Google Play disimpan pada pelayan sahaja untuk pengesahan, pengakuan, penyelarasan, pembatalan dan pencegahan penipuan.

Maklumat wajib dan pilihan

Nama, e-mel, kata laluan dan rekod keselamatan diperlukan untuk menyediakan akaun. Catatan kewangan dan atribusi pemerolehan adalah pilihan, tetapi ciri yang bergantung pada data yang tidak diberikan tidak dapat menghasilkan kiraan yang berguna. Anda boleh menolak data pilihan atau menarik baliknya dengan memadam catatan atau akaun.

Pendedahan dan pemindahan

Data hanya boleh didedahkan apabila perlu kepada penyedia infrastruktur dan pangkalan data, penyedia e-mel transaksi, Curlec / Razorpay, Google Play, penasihat profesional, pengawal selia, mahkamah, penguat kuasa apabila diwajibkan undang-undang, dan pengendali WangBuddy yang diberi kuasa. Penyedia perkhidmatan mungkin memproses data di luar Malaysia tertakluk pada perlindungan kontrak, keselamatan dan undang-undang. WangBuddy tidak menjual data peribadi.

Pengiklanan kini dilumpuhkan. WangBuddy tidak akan mengaktifkan AdSense untuk produksi sehingga persetujuan, pendedahan dan konfigurasi undang-undang yang diperlukan diluluskan.

Penyimpanan, keselamatan dan hak anda

Data akaun dan aliran tunai disimpan semasa akaun aktif. Sesi dan token tetapan semula tamat secara automatik. Selepas pemadaman akaun, catatan kewangan dan pengecam akaun dipadam. Rekod bil dan penyelarasan yang terhad mungkin dikekalkan secara samaran untuk pembayaran, pertikaian, perakaunan, pencegahan penipuan atau undang-undang. Tempoh penyimpanan berkanun yang tepat mesti disahkan dalam jadual penyimpanan produksi.

Anda boleh meminta akses atau pembetulan data, mengeksport data, membantah atau menarik balik persetujuan jika berkenaan, dan memadam akaun secara kekal di bahagian Me. Hubungi [email protected] untuk melaksanakan hak atau membuat aduan. Pengesahan identiti mungkin diperlukan. Anda juga boleh menghubungi Pesuruhjaya Perlindungan Data Peribadi Malaysia.

Delete your account · Padam akaun · Terms and disclaimer · Terma dan penafian