Privacy Notice
BETA: Kutip is operated by MSR ONG Network PLT. Kutip is an early-stage service; this notice is updated as the service evolves.
This notice explains how Kutip collects, uses, protects, and retains your personal data, in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA).
1. What we collect
We collect your display name, email address, phone number (optional), area, languages spoken, and role preference. For matched jobs, we also collect the worker's payment-receiving details (bank, DuitNow ID, TNG, QR code) and the customer's proof-of-payment image. We may collect identity documents if you choose to verify your account.
2. How we use it
Your profile is used to match you with jobs and to build your reputation through ratings. Your payment-receiving details are shown only to the one customer matched with you on a specific job. Proof-of-payment images are shown only to the one worker matched on that job. We do not sell, share, or disclose your data to third parties.
3. Who sees your data
Profile information (name, area, languages, ratings) is visible to other authenticated users for the purpose of matching. Your phone number is shown only to the specific person matched with you on a job. Payment details, proof images, and identity documents are strictly private: visible only to you and the one counterparty matched on that specific job. This is enforced at the database level (Row Level Security).
4. Data storage and security
Your data is stored in a Postgres database with Row Level Security policies that prevent unauthorized access. Sensitive files (QR codes, proof images, identity documents) are stored in private, access-controlled storage buckets and accessed only through short-lived signed URLs that expire in 60 seconds. Image metadata (EXIF/GPS) is stripped before upload. No sensitive data is sent to analytics, logs, or error tracking.
5. Retention and auto-deletion
Payment-receiving details and proof-of-payment images are automatically deleted 7 days after the job is marked as completed. After deletion, only the non-sensitive facts needed for the ledger and ratings remain (amount, type, area, dates, scores). No images, bank identifiers, or payment details are retained. Deletion is paused if a job is under dispute.
6. Your rights under PDPA
You have the right to access your personal data, request correction of inaccurate data, withdraw consent for processing, and request deletion of your data. To exercise these rights, contact us at the address below. We will respond within the time required by PDPA.
7. Contact
For data requests, privacy questions, or complaints, contact: hello@kutip.app. The data user is MSR ONG Network PLT, the operator of Kutip.
Privacy engineering
Kutip enforces these privacy guarantees at the infrastructure level: Row Level Security on all sensitive tables, private storage buckets with short-lived signed URLs, automatic EXIF metadata stripping before upload, and a 7-day auto-deletion schedule for payment details and proof images after job completion.