Privacy Policy

Version 2026-08-14 · Effective 14 August 2026

RekaDesk is operated by REKADESK SOLUTION (SSM Business Registration No. 202603180314 (TR0345679-M)) of No 7 (Tingkat 1), Jalan Perniagaan 1, Jalan Bakri, Pusat Perniagaan Kenanga, 84000 Muar, Johor, Malaysia ("RekaDesk", "we", "us"). This policy explains what data we collect through rekadesk.com and app.rekadesk.com (the "Service"), why, and the choices you have. We handle personal data in line with the Personal Data Protection Act 2010 (Malaysia). This policy is published in Bahasa Malaysia and English; both versions say the same thing, and in the event of any inconsistency the English version prevails.

1.Data we collect about you

• Account data — your name, email address, mobile number, business name and role, provided when you register or are invited to a business account.
• Your mobile number is required. Supplying it is obligatory — without it we cannot verify your account or reach you about it, and the sign-up cannot be completed. We use it to confirm the account is yours and to message you on WhatsApp about your subscription, billing, or a problem with your account. These are account messages and they continue for as long as your account is open. Separately, and only if you tick the optional box at sign-up or switch it on in Settings, we may WhatsApp you about new features, tips, offers and the occasional short question about how you are finding RekaDesk.
• Business data you enter — your leads, clients, jobs, sessions, crew, quotations, invoices, payments, expenses, receipts and contracts. This is your business's working data; you control what goes in.
• Billing data — your subscription plan and payment status. Card details are collected and stored by Stripe, our payment processor; we never see or store your full card number.
• Survey and waitlist data — if you answer our vendor survey: your answers, email and contact details you choose to share.
• Technical data — standard server logs (IP address, browser type, timestamps) kept for security and troubleshooting; and local storage in your browser used to keep you signed in and remember preferences. We do not use advertising trackers.

2.Your clients' data (data you control)

When you store Your Clients' details in RekaDesk — names, phone numbers, addresses, identification numbers you choose to record, bookings and payment records — you are the data user (controller) of that information and we process it only on your behalf to provide the Service. We never sell it, never use it for advertising, and never contact Your Clients except to deliver documents and messages you initiate (for example, emailing an invoice or a portal link). Requests from Your Clients about their data should go to the business that serves them; we support you in fulfilling them.

3.How we use data

• To provide, secure and improve the Service — including backups, fraud prevention and support.
• To process subscriptions and send transactional messages (receipts, payment reminders you configure, account and security notices).
• To message you about your own account — by email and by WhatsApp — where your subscription, billing or access needs your attention. These are part of running your account; they are not marketing, and they continue while the account is open.
• Marketing, only with your consent. If you have opted in, we may send you occasional messages about new features, tips for running your business, offers, and short questions about your experience. You can stop them at any time: switch the setting off in the app, reply STOP to any marketing WhatsApp, or email us. We act on the request within 7 days. Stopping marketing does not stop account messages.
• To tell you about important Service changes.
• Aggregated, non-identifying statistics (for example, total revenue processed across all businesses) to operate and improve RekaDesk.

We do not sell personal data. Ever.

4.Google Calendar integration

If you choose to connect Google Calendar, RekaDesk requests the narrowest permission Google offers for this job (calendar.app.created): we can only create and manage a dedicated "RekaDesk" calendar that our app itself creates — we cannot see, read or change your personal Google calendars or events. We use this access solely to mirror your RekaDesk sessions into that calendar. We store the connection token securely server-side and delete it when you disconnect (Settings → Google Calendar → Disconnect), which also revokes our access at Google.

RekaDesk's use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer, sell or use Google user data for advertising, and humans do not read it except with your permission, for security, or where required by law.

5.Who processes data for us

We use a small set of reputable providers to run the Service, each bound by their own security and privacy commitments:

• Supabase — database and authentication hosting (Asia-Pacific region).
• Netlify — website and app hosting, form submissions.
• Stripe — subscription payments.
• Resend — transactional and marketing email delivery.
• WhatsApp / Meta Platforms — delivery of the WhatsApp messages described in sections 1 and 3: account messages to every account, and marketing messages only where you have opted in. Your mobile number is disclosed to WhatsApp in order to deliver them.
• Google — calendar sync, only if you connect it.
• ImprovMX — routing of inbound email to our support inbox.
• Anthropic (Claude) — AI receipt reading: when you use "Read with AI", the receipt image or PDF you submit is sent for one-time extraction of the date, amount and category; we do not permit its use for AI training.

Some of these providers, including WhatsApp / Meta Platforms, process data outside Malaysia. We choose providers with strong security practices and transfer data only as needed to run the Service.

6.Security

All traffic is encrypted in transit (HTTPS). Every business's data is isolated by row-level security in the database — one account can never read another's records. Access tokens and secrets are stored server-side, never in the app's public code. Optional two-factor authentication is available on every account, and client portals are protected by long, unguessable links. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you without undue delay.

7.Retention

• While your account is active, we keep your data so the Service works.
• If your subscription lapses, data is retained (read-only) so you can return.
• After account termination, data is kept for 90 days for export, then deleted from live systems in the normal course. Minimal records may be retained where required for legal, tax or fraud-prevention purposes.
• A record that you gave or withdrew marketing consent — the date and the wording you agreed to — is kept for as long as your account exists, and afterwards only as long as needed to show we honoured your choice.
• Survey/waitlist contacts are kept until launch outreach is complete or you ask us to remove you.

8.Your rights

Under the PDPA you may request access to, correction of, or deletion of your personal data, and withdraw consent to processing (which may mean we can no longer provide the Service to you). You may also require us to stop using your data for direct marketing at any time, without giving a reason. Email hello@rekadesk.com — we respond within a reasonable time and verify identity before acting. You can also export your business data by asking us at the same address, and you may complain to us or to the Personal Data Protection Commissioner.

9.Other things worth knowing

• The Service is for business users aged 18 and above; we do not knowingly collect children's data.
• Client portal links are private URLs — anyone holding a link can view that job's portal, so share them only through channels you trust.
• We may update this policy; the version and date at the top always identify the current one, and material changes will be notified in the app or by email.

10.Contact

Privacy questions, PDPA requests and complaints: hello@rekadesk.com
REKADESK SOLUTION (202603180314 / TR0345679-M)
No 7 (Tingkat 1), Jalan Perniagaan 1, Jalan Bakri, Pusat Perniagaan Kenanga, 84000 Muar, Johor, Malaysia