WealthIQ

Privacy Policy

Last updated: June 2026

This Privacy Policy describes how WealthIQ ("the App", "we", "our", or "us") collects, uses, stores, and protects your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and any other applicable data protection laws.

By registering for and using the App, you expressly and freely consent to the collection and processing of your personal data as described in this Privacy Policy.

1. Data Controller

WealthIQ operates as the data user under the PDPA 2010. All personal data collected through the App is controlled and processed by us in Malaysia.

2. Personal Data We Collect

We collect the following categories of personal data:

  • Identity and Contact Data: Full name, email address, phone number, date of birth, gender, occupation, and profile photograph
  • Location Data: City, state/region, and country of residence as voluntarily provided by you in your profile
  • Financial Data: Assets, income entries, expense entries, property details, loan information, rental records, zakat calculations, and other financial information you voluntarily input into the App
  • Technical Data: Hashed login credentials, OAuth provider tokens (Google, GitHub), IP addresses, approximate geolocation derived from your IP address (country, state, and city) recorded in session activity logs for security monitoring, device type, browser type, and session information
  • Usage Data: Pages visited, features used, AI advisor chat history, and in-app activity logs
  • Preference Data: AI advisor preferences, portfolio section preferences, currency settings, and notification settings

3. Your Explicit Consent and Authorisation

Under Section 6 of the PDPA 2010, we process your personal data on the basis of your explicit, informed, and freely given consent. By accepting these terms, you expressly authorise us to:

  • Create and manage your user account and authenticate your identity
  • Process your financial data to provide wealth tracking, reporting, and analysis features
  • Transmit your financial data (not your identity or contact details) to AI inference services solely to generate personalised financial insights and analysis within the App
  • Use your profile information (name, occupation, location, date of birth) to personalise AI-generated advice and zakat calculations
  • Derive approximate location from your IP address to record session activity logs and detect suspicious or unauthorised access to your account
  • Send you transactional emails, including password reset notifications and account security alerts
  • Send you in-app notifications relating to your account and App updates
  • Retain session logs, access records, and IP-derived location data for security monitoring and fraud prevention
  • Use aggregated, anonymised usage data (which cannot identify you) to improve the App

You may withdraw this consent at any time by deleting your account. Withdrawal of consent will result in the termination of your ability to use the App.

4. Data We Do Not Collect or Share

  • We do not collect your banking credentials, financial account numbers, or payment card details
  • We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes
  • We do not share your personal data with any government body except where required by a court order, warrant, or applicable Malaysian law
  • We do not use your data for targeted advertising or behavioural profiling beyond the App

5. Third-Party Service Providers

We engage the following categories of third-party service providers, who process your data strictly on our behalf under confidentiality obligations:

  • Cloud infrastructure and hosting providers (for App operation and data storage)
  • Email delivery service (for transactional emails only)
  • AI model inference providers (only anonymised financial data is transmitted; your name, contact details, and identity are never sent unless you voluntarily include them in a chat message)
  • OAuth identity providers (Google, GitHub) if you choose to sign in using those services

All third-party providers are prohibited from using your data for their own purposes and are required to comply with applicable data protection laws.

6. Your Rights Under PDPA 2010

As a data subject under the Personal Data Protection Act 2010, you have the following rights:

  • Right of Access: You may request a copy of the personal data we hold about you
  • Right of Correction: You may request that we correct any inaccurate or incomplete personal data
  • Right to Withdraw Consent: You may withdraw your consent at any time by deleting your account through the App settings
  • Right to Cease Processing: You may request that we stop processing your data for purposes causing you damage or distress
  • Right to Delete: You may request permanent deletion of your account and all associated personal data through the App settings

To exercise any of these rights, please use the relevant features within the App or contact us directly.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, your personal data will be permanently and irreversibly deleted from our systems within 30 days, except where retention is required to comply with a legal obligation, resolve a dispute, or enforce our agreements. Session activity logs, including IP-derived location records, are retained for the duration of your account and deleted alongside your account data. Anonymised and aggregated data that cannot identify you may be retained indefinitely for analytics purposes.

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal data, including:

  • Encrypted data transmission (HTTPS/TLS) for all communications
  • Hashed password storage using industry-standard bcrypt
  • Session token management with automatic expiry
  • Two-factor authentication (email OTP or TOTP authenticator app) available to all users
  • Session activity monitoring with IP-based geolocation for anomalous access detection
  • Access controls limiting data access to authorised systems and personnel only
  • Regular security monitoring of application infrastructure

9. Disclaimer Against Data Breach and Misuse

While we implement reasonable and appropriate security measures, no system or transmission of data over the internet is completely secure. We cannot guarantee the absolute security of your personal data.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you as required under applicable Malaysian law and take all reasonable steps to contain and mitigate the impact.

We shall not be liable for any loss, damage, or harm arising from:

  • A data breach caused by circumstances beyond our reasonable control, including cyberattacks, malware, or acts of third parties
  • Unauthorised access to your account arising from your failure to keep your login credentials confidential
  • Inaccurate data you have entered into the App that results in incorrect analysis or decisions
  • Decisions you make based on AI-generated insights or App analysis, which are informational only
  • Any indirect, consequential, or economic loss arising from use of or inability to use the App

Any misuse of the App by you, including entering false information or using the App for unlawful purposes, is solely your responsibility. We accept no liability for any resulting loss, legal consequence, or dispute.

10. Cookies and Local Storage

The App uses browser session cookies and local storage solely to maintain your authenticated session and user interface preferences. We do not use cookies for tracking, advertising, or behavioural profiling.

11. Cross-Border Data Transfers

Your data may be processed on servers located outside Malaysia, including by our third-party service providers. Where such transfers occur, we take steps to ensure that equivalent levels of data protection are maintained and that transfers comply with the requirements of the PDPA 2010.

12. Children's Privacy

The App is not intended for persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be notified to you through the App or by email. Your continued use of the App after the effective date of any change constitutes your acceptance of the updated Privacy Policy.

14. Contact and Regulatory Complaints

If you have any questions, concerns, or complaints about how we handle your personal data, or wish to exercise your rights under the PDPA 2010, please contact us through the App.

If you are dissatisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi) of Malaysia.