Privacy Policy for Finlit Technologies Sdn. Bhd.

At Finlit Technologies Sdn. Bhd. (1623877-K) ("Finlit Technologies," "we," "our," or "us"), we're deeply committed to protecting your privacy and personal data. This Privacy Policy outlines how we collect, use, disclose, and manage your Personal Data (as defined below) in accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA").

By interacting with us, using our services, visiting our websites (including moneymama.co), or providing us with your Personal Data, you acknowledge and agree to the terms of this Privacy Policy.

1. Definitions

For the purpose of this Privacy Policy:

• “Personal Data” means any information in our possession or control that relates directly or indirectly to an individual, who is identified or identifiable from that information or from that and other information in the possession of Finlit Technologies. This includes, but is not limited to, your name, identity card/passport number, address, contact information, credit and bank account details, images recorded, audio recording of calls with you, and your account activity.
• “Sensitive Personal Data” means any Personal Data consisting of information regarding your physical or mental health or condition, political opinions, religious beliefs or other beliefs of a similar nature, the commission or alleged commission by you of any offence, Biometric Data, or any other Personal Data so determined by the PDPA.
• “Services” refers to the products and/or services provided by Finlit Technologies to you.

2. What Personal Data We Collect

We may collect the following types of Personal Data about you:

• Identity and Background Information: Your full name, passport or identity card number, nationality, and religion.
• Contact Information: Billing address, premises address, telephone number, mobile phone number, fax number, and email address.
• Account and Sign-in Information: The name and email address shared with us by Google or Apple when you sign in with them, the email address you sign up with, and, if you connect one, your WhatsApp phone number.
• What You Record in the App: The expenses, income, budgets, reminders and other financial details you enter or tell MoneyMama, receipt photos you take or choose from your photo library, and statements you import. Voice notes are transcribed to text so MoneyMama can read them; the audio recording itself is not saved.
• Payment Information: When you pay for a paid service, your card details are collected by our payment processor. We receive confirmation of the payment, the amount and the last four digits of the card; we do not store your full card number.
• Face ID, Fingerprint and Passcode: If you lock the app, the check is done by your phone's operating system. No biometric data is collected by us or sent to us.
• Financial Documents and Statements You Upload:When you use our debt-management tools, you may choose to upload financial documents such as credit card statements, bank or account statements, and loan or financing statements, together with the information they contain (for example, account or card numbers, outstanding balances, credit limits, transaction history, merchant names, dates and amounts, minimum payment amounts, and interest, profit, or fee charges). You provide these voluntarily to enable us to analyse your debts and generate repayment insights for you.
• Sensitive Personal Data: We don't generally collect Sensitive Personal Data. However, in exceptional circumstances, and only when necessary to serve you better and meet your particular needs, we may collect information such as your racial or ethnic origin, political opinions, religion or other beliefs, health, criminal background, or trade union membership.
• Visual and Audio Recordings: Recording of your photograph during any of our corporate events or third-party open days, and recording of calls placed by you to our customer services.
• Professional Information: Your function or post when you commence a business relationship with us, and resumes or CVs when you apply for a job with us.
• Technical and Statistical Information: For general web browse, although no personal data is revealed to us, certain technical and statistical information is available to us via our internet service provider, such as cookies, your IP address, the time, date, and duration of your visit.
• App Usage and Device Information: Which screens and features you use in the app and basic details about your device, so we can fix problems and improve it, and, if you allow push notifications, the token your phone's notification service issues so we can deliver them.
• Providing Third-Party Personal Data: If you provide us with any Personal Data relating to a third party (e.g., information of your spouse, children, parents, and/or employees), by submitting such Personal Data to us, you represent to us that you have obtained the consent of the third party to provide us with their Personal Data for the purposes listed in this Policy.

3. How We Collect Your Personal Data

We may collect Personal Data either directly from you, from your authorised representatives, from third parties, or from publicly available sources, which may include (but is not limited to):

• When you register for our Services (e.g., when you submit a form to become our customer).
• When you contact us in person, by a phone call, or over the counter (e.g., enquiries, complaints, comments, or feedback).
• When you participate in any surveys, questionnaires, competitions, contests, offers, or promotions.
• When you commence a business relationship with us (e.g., as a service provider or business partner).
• When you attend any of our corporate events or third-party open days.
• When you visit or browse our websites.
• When you apply for a job with us.
• When you interact with us via social media or interactive applications.
• When we collect information about you from third parties we deal with or are connected with you (e.g., financial institutions).
• From such other sources where you have given your consent, or where otherwise lawfully permitted.

4. Purpose of Collecting Personal Data

You agree that we may use your Personal Data where permitted by applicable law and for the following purposes (“Purposes”):

• To assess and process your application for the Services.
• To verify your identity.
• To manage and maintain your account or contract with us.
• To notify you about benefits and changes to the Services.
• To provide and improve our Services, including billing and facilitating payments.
• To analyse the financial documents and information you provide to our debt-management tools in order to identify your outstanding balances, interest or profit charges, and repayment obligations, and to generate personalised debt-repayment insights, suggested payoff plans, and related educational content for you.
• To carry out the analysis described above using automated means, including software algorithms and trusted third-party processing tools, for the sole purpose of producing your insights and repayment plans.
• To respond to any enquiries, complaints, comments, or feedback you have submitted to us.
• To protect or enforce our rights to recover any debt owing to us.
• To compile information for analysis and reports for regulatory authorities.
• To transfer or assign our rights, interests, and obligations under any agreements with you.
• To update, consolidate, and improve the accuracy of our records.
• To administer competitions, contests, offers, or promotions.
• To produce anonymised or aggregated statistics.
• To conduct research for analytical purposes, including data mining of your transactions with us.
• To assess financial and insurance risks.
• To conduct surveys and provide you with information you have consented to receive.
• To engage in business transactions regarding Services offered to you.
• To comply with legal or regulatory obligations.
• For internal management of the Services provided to you.
• To maintain records required for security, claims, or legal purposes.
• To provide training for our staff.
• To conduct marketing and IT activities (e.g., market research).
• To disclose to your authorised representatives for relevant transactions or enquiries.
• To disclose to third-party service providers, ensuring they use your data only to provide services to us.
• For any other purposes required or permitted by law or regulatory authorities.

5. Direct Marketing

We may process your Personal Data to communicate promotions, marketing, and advertising materials related to us, our Services, and our strategic partners. If you do not wish us to do so, please contact us via the details in Clause 12 below.

6. Cookies and Online Dealings

Cookies are packets of information stored in your device which assist your website navigation by customising site information. Cookies do not collect Personal Data that identifies you personally, only the device used. However, we may collect information about your use of our website or your preferences from cookies.

In the MoneyMama app we collect usage analytics (the screens and features you use) and crash and diagnostic information. These are processed by service providers acting on our instructions, and if you allow push notifications, the notification token is handled by your phone's platform provider. None of this is sold or used to advertise to you.

7. Disclosure to Third Parties

As part of providing our Services, we may disclose information about you to:

• Federal or state government agencies
• Law enforcement agencies
• Our regulator
• Agents, contractors, service providers, or professional consultants
• Companies processing transactions or providing requested Services
• Business associates and other related parties
• Financial planners, advisors, or other financial service providers you have agreed to connect with
• Any parties you have expressly or implicitly consented to
• Credit reporting or debt collection agencies, subject to applicable law

Except with your express consent, Finlit Technologies will maintain strict confidentiality of your Personal Data.

We do not sell your Personal Data. In particular, we do not share the financial documents or statements you upload with your banks, creditors, or any other lenders, and we do not contact or negotiate with your creditors on your behalf. Your uploaded documents are accessed only by authorised personnel and trusted service providers (such as secure cloud hosting and processing providers) who are bound by confidentiality obligations and act only to help us operate the Service.

8. Artificial Intelligence and Automated Processing

MoneyMama is an AI assistant. When you chat with MoneyMama, whether in the MoneyMama mobile app or on WhatsApp, the replies you receive are generated by an artificial-intelligence model and not written by a person. We tell you this in the app before your first message, and you can report any reply you think is wrong or harmful from inside the app.

To produce those replies, and to read the documents you choose to upload, we share the following with AI service providers acting as our data processors:

• The messages you send MoneyMama, together with the context needed to answer them: your first name, your country and currency, and the spending, income, budget, reminder and calculator information you have recorded with us
• Photographs of receipts, and the pages of any bank or credit-card statement you upload, so that the amounts and dates on them can be read automatically
• The text of any voice note you send, which is transcribed and then handled like a typed message; the recording itself is not kept
• Your question, where we search our own financial-education library to answer it

The providers we use for this are established commercial AI companies, engaged by us as data processors and bound by written contracts. They process your data only on our instructions and only to perform the tasks described above. We do not permit them to use your chats, your financial information or your uploaded documents to train their models, and we do not sell your Personal Data to anyone. If you would like to know which providers we currently use, write to us at [email protected] and we will tell you.

We do not send AI service providers your phone number, your email address, your date of birth, your identity-document details or your bank login credentials.

Some of the reminders and summaries the app sends you as notifications are also written by an AI model from the information you have recorded with us.

We ask for your explicit permission in the app before your first message reaches an AI service provider, and we keep a record of when you gave it. If you would rather not have your information processed this way, do not use the MoneyMama chat; you may withdraw your consent at any time as described in section 13, and you can delete your account and its data at any time from within the app or at moneymama.co/delete-account.

MoneyMama is not a licensed financial adviser. What it produces is general financial education and guidance generated automatically, not regulated financial, legal or tax advice, and it can be wrong. Decisions about your money remain yours, and we encourage you to check anything significant with a licensed professional. No decision producing legal effects concerning you is made about you solely by automated means.

9. If Personal Data Provided by You Is Incomplete

If you fail to provide complete Personal Data where indicated, we may not be able to process your application or provide our Services.

10. Your Rights to Access, Correct, and Limit Processing Your Personal Data

• Right to Access: Request access to the Personal Data we hold by emailing [email protected].
• Right to Correct: Request correction of inaccurate or incomplete Personal Data by emailing [email protected].
• Right to Limit Processing: Request limitation of processing of your Personal Data.

All requests will be handled in accordance with the PDPA.

11. Security, Storage, and Duration of Data Retention

We take reasonable technical and organisational steps to protect and secure your Personal Data. Information is transmitted over encrypted connections, and the financial documents you upload are stored on secure, access-controlled systems.

We retain the financial documents and statements you upload only for as long as necessary to provide our debt-management tools to you and for a reasonable period afterwards for support, record-keeping, and legal or regulatory compliance, after which they are securely deleted or anonymised. You may ask us to delete your uploaded documents at any time by emailing [email protected], and we will do so unless we are required to retain them by law. For all other Personal Data, we retain your data for the duration of our relationship and as required by law or our internal policies.

12. Transfer of Your Personal Data Outside Malaysia

Your Personal Data may be transferred outside Malaysia to service providers or partners. We will ensure they safeguard your data and use it only to provide contracted services.

13. Your Consent and Right to Withdraw Consent

By submitting your Personal Data, you consent to its use as set out in this Policy. You may withdraw consent at any time by written notice to Finlit Technologies. We will implement your withdrawal in accordance with PDPA requirements, provided it does not conflict with our legal obligations.

14. Children

Our Services are not directed at anyone under 18, and we do not knowingly collect Personal Data from children. If you believe a child has given us Personal Data, write to [email protected] and we will delete it.

15. Changes to This Policy

We may revise this Privacy Policy from time to time. The latest version will be published here with an updated effective date. By continuing to use our Services, you agree to any revisions.

16. Our Contact Details