Privacy Notice

1About This Notice

This Privacy Notice explains how MySemak and its verified operator ("MySemak", "we", "us" or "our", as applicable) process personal data when operating the MySemak service.

It applies to personal data relating to:

• registered users;
• report submitters;
• persons identified in community reports;
• persons whose identifiers are processed for an exact search;
• persons who contact MySemak regarding a report, account, dispute, security issue, or privacy request.

This Privacy Notice should be read together with MySemak's Terms of Use.

The Terms govern use of the service. This Privacy Notice explains personal-data handling.

2Data Controller / Operator

The operator responsible for the relevant MySemak personal-data processing is:

3Categories of Personal Data We Process

Depending on how MySemak is used, we may process the following categories of personal data.

Account and authentication data

This may include:

• email address;
• authentication/account identifier;
• account status;
• session and authentication information;
• account creation/update timestamps;
• security and account-recovery information;
• Terms and Privacy Notice versions and acknowledgement/acceptance timestamps.

Search data

To perform exact identity screening, MySemak processes the complete NRIC or passport number entered for the search.

MySemak is designed for exact matching and does not provide partial identity searching.

Where technically implemented, the service uses a secure keyed lookup or equivalent security mechanism for matching.

The complete search value is not intended to be stored in browser persistent storage or publicly displayed.

Report data

A report may include:

• customer/person name;
• NRIC or passport number;
• case/report title;
• report description;
• report date;
• report status and last-updated information;
• supporting identity/evidence files;
• reporter account reference;
• moderation or dispute history.

The current new-report form does not request the customer's telephone number.

Historical records may contain telephone numbers. Historical telephone numbers remain private and are not intended to appear in ordinary search results.

Supporting evidence

Supporting evidence may include:

• identity documents;
• photographs;
• screenshots;
• receipts;
• agreements;
• correspondence;
• other materials relevant to the reported dealing.

Depending on the content submitted, supporting materials or report information may contain data that requires heightened protection under applicable law.

Users should not submit unnecessary sensitive information.

Security and technical data

We may process information reasonably required to protect the service, such as:

• login/security events;
• timestamps;
• account identifiers;
• device/browser or network information made available to the service;
• rate-limit events;
• abuse indicators;
• failed or suspicious activity;
• moderation and administrative audit events.

Where a permanently closed account is prevented from re-registration, MySemak may retain a restricted security fingerprint/token derived from the relevant email address for that purpose.

4Where Personal Data Comes From

Personal data may be obtained:

• directly from a registered user during registration or account use;
• from a reporter who submits a community report;
• from supporting evidence uploaded by a reporter;
• when an identifier is entered for an exact search;
• from persons contacting MySemak about a report, correction, dispute, account, security, or privacy issue;
• from MySemak's authentication, security, moderation, and technical systems;
• from historical MySemak records migrated from earlier versions of the service.

A person named in a community report may not be a registered MySemak user and may not have supplied the report personally.

5Why We Process Personal Data

We may process personal data as reasonably necessary to:

• create and secure user accounts;
• verify account email addresses;
• authenticate users;
• perform exact NRIC/passport matching;
• associate a community report with the correct identity;
• display permitted report information after an exact verified match;
• receive and manage reports;
• store and protect supporting evidence;
• prevent scraping, identity enumeration, account abuse, and unauthorized access;
• enforce search limits and account restrictions;
• investigate security incidents;
• administer moderation;
• handle corrections, disputes, and report updates;
• preserve report and moderation history;
• communicate about account, security, report, dispute, or service matters;
• maintain and improve service reliability and security;
• comply with applicable legal obligations;
• respond to valid legal processes;
• establish, exercise, or defend legal claims.

MySemak must not use report-subject data to create an undisclosed commercial profile for unrelated advertising or data-broker purposes.

If MySemak introduces materially different purposes in the future, this notice and the relevant consent/choice mechanisms must be reviewed before those purposes are launched.

6What Search Users Can See

After a successful verified exact identity search, a newer report may display permitted information such as:

• supplied customer/person name;
• case/report title;
• factual report description;
• submission date;
• current report status;
• last updated date;
• whether supporting evidence exists.

Older reports may not contain a name, title, structured status, or all newer fields.

Ordinary search results do not display:

• the full NRIC/passport number;
• reporter identity;
• reporter email;
• private telephone numbers;
• private residential addresses;
• uploaded identity documents;
• supporting evidence images/documents;
• internal moderation notes;
• internal security records.

The existence of a report does not make private evidence public.

7Supporting Evidence and Private Files

Original supporting files are kept private from ordinary users.

MySemak may generate restricted derivative versions for purposes such as:

• secure preview;
• format conversion;
• image processing;
• resizing;
• watermarking where the system applies it;
• moderation or integrity review.

Creating a derivative does not make the original file public.

Authorized administrators may access private evidence where reasonably required for legitimate service, security, moderation, integrity, dispute, or legal purposes.

Access should be permission-controlled and auditable.

8Accuracy, Corrections, and Report Updates

MySemak relies in part on information submitted by users.

Reporters are required under the Terms of Use to submit factual information and to notify MySemak when material circumstances later change.

A report may therefore be:

• updated;
• marked disputed;
• marked resolved;
• corrected;
• restricted;
• hidden;
• removed.

Where appropriate, MySemak may retain historical and audit information even when the user-facing state changes.

If you believe personal data associated with you is inaccurate or misleading, you may use the privacy/support or dispute process described below.

9Security and Abuse Prevention

MySemak uses technical and organizational safeguards intended to reduce unauthorized access, disclosure, alteration, loss, misuse, scraping, and identity enumeration.

Depending on the implemented architecture, safeguards may include:

• access controls;
• private storage;
• encryption in storage or transport where applicable;
• restricted administrative permissions;
• secure/keyed identity matching;
• rate limits;
• abuse detection;
• account restrictions;
• audit logging;
• security challenge services.

No online service can guarantee absolute security.

Users must also keep their account credentials secure and promptly report suspected unauthorized access.

10Automated Processing

MySemak uses automated systems for functions such as exact matching, authentication, security controls, rate limiting, abuse detection, spam/integrity screening, or moderation support.

MySemak does not use the presence or absence of a community report to automatically assign a MySemak credit score or risk score to a report subject.

Where applicable law provides rights in relation to a decision based solely on automated processing, a person may contact MySemak through the privacy/support channel.

11Service Providers

MySemak uses service providers to operate and protect the application.

Known providers from the existing architecture include:

• Supabase, for authentication, database, and private storage;
• Vercel, for application hosting and delivery;
• Cloudflare Turnstile, for registration/security and abuse protection.

Service providers may process personal data only in connection with the services they provide to MySemak, subject to applicable contractual and legal requirements.

MySemak should not disclose personal data to unrelated third parties for purposes incompatible with this notice without reviewing the required notice, choice, consent, and legal requirements.

12Disclosure of Personal Data

Personal data may be disclosed where reasonably necessary to:

• authorized MySemak administrators or personnel;
• hosting, database, authentication, storage, security, email, monitoring, or other operational service providers;
• professional advisers where reasonably necessary;
• competent authorities or courts where disclosure is required or lawfully requested;
• parties involved in establishing, exercising, or defending legal claims;
• another party where the data subject has authorized the disclosure, where applicable.

MySemak does not make private report evidence available to ordinary users merely because they perform a successful search.

If MySemak introduces advertising or additional commercial data-sharing arrangements in the future, the privacy assessment and notice must be updated before deployment.

13Cross-Border Processing

Some service providers or their infrastructure may process or store personal data outside Malaysia.

Where personal data is transferred or made accessible outside Malaysia, MySemak will take steps intended to ensure the transfer is handled in accordance with applicable Malaysian personal-data requirements and appropriate safeguards.

14Retention

MySemak retains personal data only for as long as reasonably necessary for the purpose for which it is processed, subject to applicable legal, security, dispute, audit, and claims requirements.

Different categories of data may require different retention periods.

For example:

• account data may be retained while an account is active and for an appropriate period after closure;
• reports may be retained while they form part of MySemak's community record system;
• resolved or removed reports may require limited further retention for dispute, integrity, audit, or legal purposes;
• supporting evidence may be retained while reasonably necessary to support a report and related disputes;
• security and abuse records may be retained for the period needed to protect the service and enforce restrictions;
• legal-hold records may be retained for as long as the relevant legal requirement or claim requires;
• backup copies may remain for a limited backup cycle before deletion or overwrite.

Closing a user account does not automatically delete otherwise valid community reports or records that MySemak reasonably needs to retain for a lawful purpose.

The operator maintains or will maintain an internal retention schedule governing the relevant data categories.

15Your Privacy Rights and Choices

Subject to applicable law and relevant exceptions, you may contact MySemak to:

• ask whether personal data relating to you is being processed;
• request access to personal data;
• request correction or updating of inaccurate, incomplete, misleading, or outdated personal data;
• raise a concern about the processing of your personal data;
• request that certain processing be limited or stopped where applicable;
• withdraw consent where the relevant processing is based on consent;
• object to or stop direct marketing if MySemak introduces direct marketing;
• exercise other data-subject rights available under applicable law.

A request does not automatically require deletion of every record.

MySemak may need to retain or continue processing certain information where permitted or required for security, dispute handling, legal obligations, integrity, or legal claims.

16Report Corrections and Disputes

If your concern relates to a community report, you may request review through MySemak's designated support/dispute process.

MySemak may request information reasonably necessary to identify the relevant record and prevent unauthorized changes, including identity verification where appropriate.

You should not send full NRIC/passport images or other highly sensitive evidence through public social-media channels or unsecured communication unless MySemak has specifically provided or arranged an appropriate secure method.

A dispute does not automatically mean a report is false and does not automatically require deletion.

MySemak may update, mark as disputed, restrict, correct, hide, or remove a report depending on the outcome and circumstances.

17Identity Verification for Privacy Requests

To protect personal data from unauthorized disclosure or alteration, MySemak may need to verify the identity and authority of a person making an access, correction, dispute, or other privacy request.

MySemak should request only information reasonably necessary for that verification.

Verification materials used for a request must be protected and retained only as long as reasonably necessary for the request, security, audit, or applicable legal purposes.

18Personal Data Breaches

MySemak maintains or will maintain procedures to assess and respond to suspected personal data breaches.

Where a personal data breach is subject to notification requirements under applicable Malaysian law, MySemak will take the steps required by the applicable law and regulatory guidance, which may include notifying the Personal Data Protection Commissioner and affected individuals where the relevant legal thresholds are met.

Users should promptly report suspected unauthorized account access or suspected exposure of MySemak personal data through the verified support/security channel.

19Cookies, Sessions, and Browser Storage

MySemak uses browser/session technologies reasonably necessary to keep users signed in, maintain security, and operate the service.

Authentication session information may be stored in the browser according to the authentication architecture.

Customer identity searches and uploaded identity/supporting documents are not intended to be stored in browser persistent storage.

If analytics, advertising, or non-essential tracking technologies are introduced later, MySemak must review the required privacy notice, user choice/consent mechanism, and cookie controls before enabling them.

20Children and Inappropriate Use

MySemak is intended for legitimate customer screening and related service use.

The service must not knowingly be used to create unnecessary profiles of children or to search/report individuals where there is no legitimate dealing or lawful purpose.

If a report involves a minor or creates heightened privacy risk, it should be escalated for appropriate review rather than treated as an ordinary report.

21Changes to This Privacy Notice

MySemak may update this Privacy Notice to reflect changes in:

• service functionality;
• processing activities;
• providers;
• security practices;
• legal requirements;
• privacy safeguards.

The current version, effective date, and last updated date will be displayed on the Privacy Notice page.

Where a change is material, MySemak may provide an appropriate notice to registered users.

A Privacy Notice update should not be silently described as user consent to a new unrelated purpose where separate consent or choice is legally required.

22Contacting MySemak

Questions, correction requests, report disputes, access requests, account-security concerns, or other privacy matters should be submitted through MySemak's verified privacy/support channel.

Privacy & Support: mysemak7@gmail.com