Privacy Policy for Duitlah
This Privacy Policy explains how ONEPLANNER TECHNOLOGIES (Registration No. 202503272767 (NS0314486-M)) ("Duitlah", "we", "us") handles personal data in connection with the Duitlah website and app. Unlike our B2B OnePlanner product, here we act as the data controller ("data user") under Malaysia's Personal Data Protection Act 2010 ("PDPA") — if you interact with Duitlah directly, or through the app at platform.duitlahapp.com, we are responsible for deciding how your personal data is used.
Last Updated: July 23, 2026
1. Information We Collect
1.1 On the Duitlah marketing website
As currently built, this website does not collect personal data through any form — it contains only outbound links (e.g. "Get a free financial review", "Join Us for Free") to platform.duitlahapp.com. It does run analytics tooling (see Section 4).
1.2 On platform.duitlahapp.com
The Duitlah app is a separate service from this website. Once live, it is expected to collect account registration data, financial data you enter (income, expenses, goals, debts, and similar), and, if you choose to engage one, data used to connect you with a licensed financial planner. This section will be confirmed and completed to reflect the app's actual data handling before this policy is treated as final.
2. How We Use Information
| Purpose | Data used | Basis |
|---|---|---|
| Operate the app you register for | Account and financial data you provide | Performance of contract / consent |
| Connect you with a licensed financial planner, if requested | Contact details, relevant financial summary | Consent |
| Product analytics | Usage data (site and, if applicable, app) | Legitimate interest |
| AI-assisted features (if any) | Data you submit to those features | Consent / performance of contract |
3. Data Sharing
We do not sell your personal data. We disclose personal data only to:
- Subprocessors listed in our Subprocessors page.
- A licensed financial planner or firm, only if and when you actively request to be connected with one — this is the point at which your relationship with a B2B firm (e.g. an OnePlanner customer) may begin, and their own privacy practices apply to their handling of your data from that point.
- Law enforcement or regulators, where required by Malaysian law.
- A successor entity, in the event of a merger, acquisition, or asset sale.
4. Cookies and Analytics
On this marketing website, Google Analytics (GA4) is used for page-view analytics. No cookie consent banner is currently implemented here — this is a known gap we intend to close before or alongside publishing this policy as final.
If and when Duitlah is served from the same platform as our OnePlanner product, the same cookies used by that app would apply: a Supabase Auth session cookie (strictly necessary) and PostHog analytics (non-essential, autocaptured, tied to your account once signed in). No consent banner exists in that app today either.
| Cookie / tool | Purpose | Type |
|---|---|---|
| Google Analytics | Web analytics (marketing site) | Analytics (non-essential) |
| Supabase Auth session | Keeps you signed in (app, once launched) | Strictly necessary |
| PostHog | Product analytics (app, once launched) | Analytics (non-essential) |
5. International Data Transfers
Google Analytics processes data on servers outside Malaysia, including in the United States. We rely on the transfer mechanisms available under PDPA Section 129 (such as your consent to this policy) to permit this; this basis should be confirmed with qualified counsel before this policy is treated as final.
6. Data Retention
Account and financial data on platform.duitlahapp.com, once live, will be retained for as long as your account remains active, plus 90 days after closure to allow you to request a copy, unless a longer period is required by applicable law. Website analytics data is retained per the standard retention windows of Google Analytics and PostHog, which can be configured.
7. Security
See our Security Policy.
8. Your Rights under the PDPA
You may request access to, correction of, or (where applicable) deletion of your personal data, and may withdraw consent for processing based on consent, by contacting [email protected]. We may need to verify your identity first.
9. Children
Duitlah is not directed at individuals under 18, and we do not knowingly collect personal data from minors.
10. Changes to This Policy
We will update the "Last Updated" date above for any change, and will highlight material changes prominently on the site.
11. Contact
ONEPLANNER TECHNOLOGIES (Registration No. 202503272767 (NS0314486-M))
P.O. Box 10251, GPO Kuala Lumpur, 50708 WPKL
Questions about this policy: [email protected]