JomSewa Privacy Policy
Version 2026-10-06. Operated by Miracle Mikhael Enterprise (SSM no. [to be added]), [business address to be added], Malaysia.
1. Who this covers
This policy covers people who use JomSewa: rental business owners and their staff. Each rental business is the data controller for its own customers' data. JomSewa processes that data on the business's behalf as a data processor.
2. Data we collect about users
- Account: name, email, hashed password, business name and contact details.
- Security: sign-in times, IP address at sign-in, and actions recorded in the business activity log.
3. Why we use it
To provide the service, secure accounts, prevent abuse, support you and meet legal obligations.
4. Where data is stored
On Cloudflare (Workers, D1 database, R2 file storage). Cloudflare runs a global network, so data may be stored or processed outside Malaysia.
5. How long we keep it
- Accounts: while active, then deleted within 90 days of a closure request.
- Database backups: up to 30 days after deletion.
- Activity logs: 2 years.
- Customer IC/licence copies and photos: deleted automatically per each business's retention setting (default 12 months after the rental ends).
6. Sharing
We do not sell personal data. We share it only with our infrastructure providers (Cloudflare, and a payment provider if enabled) or where required by law.
7. Security
Hashed passwords and session tokens, separation between businesses, private file storage, role-based access, rate-limited sign-in and an activity log of sensitive actions.
8. Your rights
You may ask to access, correct or get a copy of your data, or withdraw consent (which may end the service). We reply within 21 days.
9. Data breaches
If a breach is likely to cause significant harm, we notify the Personal Data Protection Commissioner within 72 hours, the affected business without undue delay, and affected individuals where required.
10. Changes
You will be asked to agree to material changes in the app.
Privacy contact: hello@getjomsewa.com