Privacy Notice

1. What we collect

• Google account profile when you sign in: email, display name, profile photo, and the Firebase user identifier.
• Documents you upload to run an evaluation — typically a MyKad, a payslip or income screenshot, and a utility bill.
• Evaluation history: the structured profile we extracted from your documents and the schemes you matched against, persisted in Firestore so you can see your past runs.
• Consent timestamp recorded when you tick the PDPA checkbox on sign-up.

2. What we do not store

• Your full MyKad number, and any IC tail. The persisted profile carries no IC information of any kind; the manual-entry path doesn't even ask for it.
• The original bytes of your uploaded files. Extraction runs in-memory inside a single request, and the raw files are discarded once the structured profile is produced.
• IC numbers, authentication tokens, or document content in any log line.

3. Why we collect it

• To match you against 20 tracked Malaysian scheme entries using deterministic rules with source-backed citations.
• To generate your draft application packets, every page watermarked "DRAFT — NOT SUBMITTED."
• To show you a history of your past evaluations on the dashboard.
• To enforce per-user fair-use rate limits on the free tier.

4. Where it lives

The web app is hosted on Vercel and the backend on Render (Singapore region). AI document processing uses Google's Gemini API. Your saved evaluations and profile are stored in Google Firestore, with sign-in handled by Firebase Authentication.

5. How long we keep it

• We keep your evaluations until you delete them — the same for every account, regardless of tier.
• Delete any saved evaluation at any time from your evaluation history.
• You can request immediate deletion of your account and all linked records at any time from the Settings page.

6. Your PDPA rights

• Access — download a JSON export of your profile and full evaluation history.
• Deletion — remove your account, your Firestore records, and your Firebase Auth identity in one action.
• Withdrawal — revoke consent by deleting your account. Further sign-in attempts will require fresh consent.

7. What we never do

• We never submit anything on your behalf to LHDN, JPN, JKM, or any government portal. Every output is a draft packet you submit manually.
• We never share your data with third parties for advertising.
• We do not sell your data.

8. Demo and hackathon scope

Layak is a non-production hackathon project. Use synthetic documents wherever possible during the demo period. Do not upload another person's MyKad or financial documents without their explicit consent.

9. Contact

Reach the team via the project's GitHub repository. For PDPA-specific queries, open an issue tagged pdpa.