Subprocessors
This list is referenced by our Privacy Policy. The Duitlah marketing website itself collects no data directly — all outbound calls to action point to the app at platform.duitlahapp.com. If that app is operated by OnePlanner Technologies or an affiliate, its subprocessor list will be added here once confirmed; if it is a separate legal entity, its own privacy policy will be linked instead of merged into this one.
Last reviewed: July 23, 2026
| Subprocessor | Purpose | Data involved | Location |
|---|---|---|---|
| Google Analytics (GA4) | Web analytics | Usage/event data on marketing site | United States |
| PostHog | Product analytics | Usage/event data | To be confirmed |
| platform.duitlahapp.com stack | Core app functionality | User financial data, if collected there | To be confirmed |
Every subprocessor that receives personal data transferred outside Malaysia needs a PDPA-compliant transfer basis (PDPA Section 129) — Google Analytics processing typically involves US infrastructure, and this transfer basis should be confirmed with qualified counsel.
Our key subprocessors maintain independent third-party security certifications as part of their own compliance programs. Documentation of a subprocessor's certifications can be requested at [email protected].
See also our Security Policy.