Privacy Policy

Version 2026-10-29 · Effective 29 October 2026 · RekaCrew lines added to sections 2, 3, 7 and 9

RekaDesk is operated by REKADESK SOLUTION (SSM Business Registration No. 202603180314 (TR0345679-M)) of No 7 (Tingkat 1), Jalan Perniagaan 1, Jalan Bakri, Pusat Perniagaan Kenanga, 84000 Muar, Johor, Malaysia ("RekaDesk", "we", "us"). This policy explains what data we collect through rekadesk.com and app.rekadesk.com (the "Service"), why, and the choices you have. We handle personal data in line with the Personal Data Protection Act 2010 (Malaysia). This policy is published in Bahasa Malaysia and English; both versions say the same thing, and in the event of any inconsistency the English version prevails.

1.Data we collect about you

• Account data — your name, email address, mobile number, business name and role, provided when you register or are invited to a business account.
• Your mobile number is required. Supplying it is obligatory — without it we cannot verify your account or reach you about it, and the sign-up cannot be completed. We use it to confirm the account is yours and to message you on WhatsApp about your subscription, billing, or a problem with your account. These are account messages and they continue for as long as your account is open. Separately, and only if you tick the optional box at sign-up or switch it on in Settings, we may WhatsApp you about new features, tips, offers and the occasional short question about how you are finding RekaDesk.
• Business data you enter — your leads, clients, jobs, sessions, crew, quotations, invoices, payments, expenses, receipts and contracts. This is your business's working data; you control what goes in.
• Billing data — your subscription plan and payment status. Card details are collected and stored by Stripe, our payment processor; we never see or store your full card number.
• Survey and waitlist data — if you answer our vendor survey: your answers, email and contact details you choose to share.
• Technical data — standard server logs (IP address, browser type, timestamps) kept for security and troubleshooting; and local storage in your browser used to keep you signed in and remember preferences. We do not use advertising trackers.
• App usage data — for each login, the days it opened RekaDesk, with the business it belongs to. Nothing about what was done in the app is recorded, and no IP address or device details are copied for it. We use it only to count how many people and businesses use RekaDesk, and to notice when a paying business stops opening RekaDesk, so we can offer help.

2.Your clients' data (data you control)

When you store Your Clients' details in RekaDesk — names, phone numbers, addresses, identification numbers you choose to record, bookings and payment records — you are the data user (controller) of that information and we process it only on your behalf to provide the Service. We never sell it, never use it for advertising, and never contact Your Clients except to deliver documents and messages you initiate (for example, emailing an invoice or a portal link). Requests from Your Clients about their data should go to the business that serves them; we support you in fulfilling them.

Freelancers (RekaCrew). You are likewise the data user (controller) of freelancers' details and job-offer answers; we process them only for you, and their requests go to you.

3.How we use data

• To provide, secure and improve the Service — including backups, fraud prevention and support.
• To process subscriptions and send transactional messages (receipts, payment reminders you configure, account and security notices).
• To message you about your own account — by email and by WhatsApp — where your subscription, billing or access needs your attention. These are part of running your account; they are not marketing, and they continue while the account is open.
• Marketing, only with your consent. If you have opted in, we may send you occasional messages about new features, tips for running your business, offers, and short questions about your experience. You can stop them at any time: switch the setting off in the app, reply STOP to any marketing WhatsApp, or email us. We act on the request within 7 days. Stopping marketing does not stop account messages.
• To tell you about important Service changes.
• Aggregated, non-identifying statistics (for example, total revenue processed across all businesses) to operate and improve RekaDesk. RekaCrew use is counted only in totals that identify no one; we never link one freelancer's records across businesses.

We do not sell personal data. Ever.

4.Google Calendar and Google Drive integrations

If you choose to connect Google Calendar, RekaDesk requests the narrowest permission Google offers for this job (calendar.app.created): we can only create and manage a dedicated "RekaDesk" calendar that our app itself creates — we cannot see, read or change your personal Google calendars or events. We use this access solely to mirror your RekaDesk sessions into that calendar. We store the connection token securely server-side and delete it when you disconnect (Settings → Google Calendar → Disconnect), which also revokes our access at Google.

If you choose to connect Google Drive, RekaDesk requests Google's narrowest Drive permission (drive.file): we can only see and manage the files and folders RekaDesk itself creates in your Drive — we cannot see your other Drive files. We use it to keep a second copy of your receipts (this starts when you connect Drive; you can turn it off in Settings, Receipts in Google Drive), to receive footage your crew uploads through the Footage Portal, to store photos of your equipment, and to store RekaGallery photos and videos. While a gallery is open, RekaDesk shares its folder as "anyone with the link can view" so your clients can see it. Locking the gallery removes that sharing (only the cover photo stays viewable, so the locked page can show it). If RekaDesk takes a gallery down, we remove the sharing from both its folder and its cover photo. When you delete a job or close your account, the files stay in your Drive, and RekaDesk removes the "anyone with the link" sharing from those galleries' folders and cover photos. RekaDesk can only do this while the Google account that holds the gallery is still connected: if you disconnect Google first, or we cannot reach that Drive, anything that was shared stays shared until it is changed in Google Drive. The connection token is stored securely server-side and deleted when you disconnect, which also revokes our access at Google.

RekaDesk's use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer, sell or use Google user data for advertising, and humans do not read it except with your permission, for security, or where required by law.

5.Who processes data for us

We use a small set of reputable providers to run the Service, each bound by their own security and privacy commitments:

• Supabase — database and authentication hosting (Asia-Pacific region).
• Netlify — website and app hosting, form submissions.
• Stripe — subscription payments.
• Resend — transactional and marketing email delivery.
• WhatsApp / Meta Platforms — delivery of the WhatsApp messages described in sections 1 and 3: account messages to every account, and marketing messages only where you have opted in. Your mobile number is disclosed to WhatsApp in order to deliver them.
• Google — calendar sync and Google Drive storage (in your own Drive), only if you connect them.
• ImprovMX — routing of inbound email to our support inbox.
• Anthropic (Claude) — AI receipt reading: when you use "Read with AI", the receipt image or PDF you submit is sent for one-time extraction of the date, amount and category; we do not permit its use for AI training.
• Anthropic (Claude), USA — Reka, our AI help chat on rekadesk.com and in the app, and AI-drafted support replies: what you type to Reka is sent to Anthropic so Reka can answer, and the reports, requests, replies and emails you send our support team (with your name or email address, business name, plan, number of jobs and clients, the date you signed up, and basic device details such as your device type and browser) may be sent so a draft reply can be prepared for our team to check before any reply is sent to you; we do not permit their use for AI training. Please never type passwords or card numbers into the chat or a support report.

Some of these providers, including WhatsApp / Meta Platforms, process data outside Malaysia. We choose providers with strong security practices and transfer data only as needed to run the Service.

6.Security

All traffic is encrypted in transit (HTTPS). Every business's data is isolated by row-level security in the database — one account can never read another's records. Access tokens and secrets are stored server-side, never in the app's public code. Optional two-factor authentication is available on every account, and client portals are protected by long, unguessable links. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you without undue delay.

7.Retention

• While your account is active, we keep your data so the Service works.
• If your subscription lapses, data is retained (read-only) so you can return.
• After account termination, data is kept for 90 days for export, then deleted from live systems in the normal course. Minimal records may be retained where required for legal, tax or fraud-prevention purposes.
• A record that you gave or withdrew marketing consent — the date and the wording you agreed to — is kept for as long as your account exists, and afterwards only as long as needed to show we honoured your choice.
• Survey/waitlist contacts are kept until launch outreach is complete or you ask us to remove you.
• Chats with Reka are deleted from our live systems after 90 days. The scrambled copy of your IP address saved with each chat message, kept only to stop abuse, is erased from our live systems after 7 days.
• When anyone opens a RekaGallery gallery, a scrambled code made from their IP address is kept, only to stop abuse, and deleted automatically about 2 days after their last visit. Reports sent with "Report this gallery" are kept as long as we need them to handle the report and to deal with repeated abuse.
• RekaCrew: "Can't make it" answers are deleted after 90 days; scrambled IP addresses, kept only to stop abuse, after 7 days.
• Support reports and their replies are deleted from RekaDesk 2 years after the report is closed.
• App usage data is kept for 13 months. After that we keep only totals (how many people and businesses used RekaDesk each day and each month), never who. A login's usage data is deleted when the login is deleted or its business account is closed. Copies in our daily backups are deleted within about 4 months after that.
• Copies of these chats, scrambled IP addresses, support reports, gallery reports and RekaCrew answers in our daily backups are deleted within about 4 months.

8.Your rights

Under the PDPA you may request access to, correction of, or deletion of your personal data, and withdraw consent to processing (which may mean we can no longer provide the Service to you). You may also require us to stop using your data for direct marketing at any time, without giving a reason. Email hello@rekadesk.com — we respond within a reasonable time and verify identity before acting. You can also export your business data by asking us at the same address, and you may complain to us or to the Personal Data Protection Commissioner.

9.Other things worth knowing

• The Service is for business users aged 18 and above; we do not knowingly collect children's data.
• Client portal links are private URLs — anyone holding a link can view that job's portal, so share them only through channels you trust.
• Freelancers' private links work like portal links: anyone holding one can see that person's jobs and answer or confirm offers. Businesses can reset a link; freelancers can tap "Stop job offers".
• RekaGallery links work like portal links: anyone holding a gallery link can open it, and while a gallery is locked its page also shows the balance and, if money is owed, a Pay button that opens the job's client portal. Gallery photos and videos load straight from Google Drive, so Google also receives a visitor's IP address.
• If you use "Report this gallery", we keep your message, any contact details you choose to leave (used only to reply to you) and a scrambled code made from your IP address (used only to stop abuse), and we email the report to our team so we can review it.
• We may update this policy; the version and date at the top always identify the current one, and material changes will be notified in the app or by email.

10.Contact

Privacy questions, PDPA requests and complaints: hello@rekadesk.com
REKADESK SOLUTION (202603180314 / TR0345679-M)
No 7 (Tingkat 1), Jalan Perniagaan 1, Jalan Bakri, Pusat Perniagaan Kenanga, 84000 Muar, Johor, Malaysia