Privacy Policy

Effective Date: 15 June 2026

This Privacy Policy explains how GSR Construction Sdn Bhd ("we", "our", or "us") collects, uses, stores, and protects the personal information of users of the Petty Cash Management System mobile application ("App"). By using the App, you agree to the practices described in this policy.

We collect the following categories of information when you use the App:

• Account Information: Full name, work email address, and department as registered by your company administrator.
• Expense Claims: Merchant name, expense date, invoice number, amount, expense purpose, and project allocation details that you submit.
• Receipt Images: Photos of receipts that you upload when submitting a petty cash claim.
• LHDN E-Invoice Data: LHDN-issued UUID and Validation Link associated with a verified e-invoice, as entered by an administrator.
• Device & Usage Data: Basic app crash logs and error reports to help us maintain the App's stability. We do not collect advertising identifiers.

Your information is used solely for the following internal business purposes:

• Processing and tracking petty cash expense claims within your organisation.
• Generating monthly expense statements for payroll reimbursement.
• Maintaining compliance with Malaysian LHDN e-invoicing regulations.
• Allowing authorised administrators and managers to review and approve claims.
• Generating PDF reports for internal auditing purposes.

All data is securely stored on Supabase cloud infrastructure, which uses industry-standard encryption (TLS in transit, AES-256 at rest). Receipt images are stored in a private, access-controlled cloud storage bucket. Access to data is restricted by role-based permissions — employees can only view their own claims; administrators can view all claims within the organisation.

We do not sell, trade, or rent your personal information to third parties. Your data may be shared only in the following limited circumstances:

• Within your organisation: Authorised administrators, the company Owner, and appointed assistants may access claim data as part of the expense approval workflow.
• LHDN Compliance: E-invoice UUIDs and validation links are issued by and may be verified against the Malaysian Inland Revenue Board (LHDN) MyInvois portal.
• Legal Requirements: If required by law or a valid government authority, we may disclose data to comply with legal obligations.

Expense claim records and receipt images are retained for a minimum of 7 years in accordance with Malaysian tax and accounting regulations (Income Tax Act 1967). Upon an employee's departure from the organisation, their account is deactivated but historical claim records are preserved for auditing purposes.

You have the right to:

• Access the personal data we hold about you by contacting your company administrator.
• Request correction of inaccurate personal data.
• Request deletion of your account (subject to legal retention requirements).

Requests relating to your personal data should be submitted to your company administrator or directly to us using the contact details below.

• Camera: Used only to capture receipt photos for claim submission.
• Photo Library: Used only to select existing receipt images for claim submission.
• Internet: Required to sync claims and communicate with our secure backend.

No permission is used for advertising, tracking, or any purpose beyond the App's core functionality.

The App is intended for use by company employees only and is not directed at individuals under the age of 18. We do not knowingly collect data from minors.

We may update this Privacy Policy from time to time. Any significant changes will be communicated via the App or by email to registered users. Continued use of the App after changes are posted constitutes acceptance of the revised policy.

If you have any questions or concerns about this Privacy Policy, please contact:

• Company: GSR Construction Sdn Bhd
• Email: gweerenyu112@gmail.com