Privacy Policy

Pomodoro Tech Sdn Bhd is committed to protecting personal data per Malaysia's Personal Data Protection Act 2010 (PDPA). Data collected: account data (name, email, phone, company, role), procurement data (requests, approvals, vendor records, POs, receipts, contracts, price history), billing data (via Stripe — full card numbers not stored), usage data (via PostHog analytics).

Used to provide the service, process subscriptions, send service/billing notifications (via Brevo), provide support, and improve the product — never sold to third parties. Third-party processors: Stripe (payments), Brevo (email), Cloudinary (file storage), Railway (hosting/database), Vercel (frontend hosting), PostHog (analytics).

Data retained while the account is active plus a period after closure for legal/audit purposes (approximately 7 years, consistent with Malaysian tax record-keeping requirements).

Users may request access, correction, or deletion of personal data (subject to legal/contractual limits) and may withdraw consent for non-essential processing by contacting our Data Protection Officer. Bilaro uses role-based access control, audit logging, and encrypted connections to protect data. This policy may be updated; material changes notified by email or in-app notice. Contact: support@bilaro.my.