TambahTolak Privacy Notice

Last updated: 12 October 2026

1. Introduction

TambahTolak ("we", "us", or "the app") is owned and operated by Go Far Solutions (SSM Registration No.: 202603226157 / KT0620076-A). This Privacy Notice explains how we collect, use, store and protect your personal data when you use the TambahTolak mobile app and this website, in line with Malaysia's Personal Data Protection Act 2010 (PDPA) and its amendments.

By registering for and using TambahTolak, you consent to the collection and use of your personal data as described in this notice.

2. Data We Collect

We collect the following types of data when you use TambahTolak:

a) User Account Data

• Full name and display name
• Email address
• Phone number (if provided)
• Profile picture (if uploaded)
• How you sign in (email and password, Google or Apple) and whether your email address has been confirmed. Your password is held by Google Firebase Authentication in a form we cannot read.

b) Business Data You Enter

• Information about your customers (name, phone number) that you add to the system
• Credit/debit transaction records you log for each customer
• Payment reminders and notes you set
• Bank statements (PDF) you upload with the Import Bank Statement feature: the date, description and amount of each transaction are read from the file. The PDF is processed momentarily by our server and is not stored; only the transaction rows you review and confirm are saved to your account. Statements can contain third parties' details, so you are responsible for making sure you may use them for your business records.

c) Voice Data (AI Voice Entry Feature)

When you use the Voice Entry feature, your audio recording is sent to Google's Gemini AI service to be processed and converted into transaction details (amount, type, note). These audio recordings are not stored permanently by us once processing is complete. The recording passes through our server on its way to Google, and Google processes it under its Gemini API terms. Only the extracted transaction result (text/numbers) is stored in your database.

d) Technical Data

• IP address and device type (for security and troubleshooting)
• App activity logs (for example, login times and features used) and a daily count of how many times the voice feature was used
• Security identifiers: one-way hashes of your IP address, email address or phone number that we use to limit abuse and to stop the free trial being repeated. We cannot turn a hash back into the original value.

3. Purpose of Data Collection

We use the data we collect to:

• Provide and operate the TambahTolak service, including credit/debit tracking and managing your customers
• Process transaction entries through the AI Voice Entry feature
• Send the payment reminders you set yourself
• Generate reports (PDF) at your request
• Import transactions from a bank statement at your request
• Process subscriptions and payments
• Confirm your email address and prevent misuse of the free trial
• Communicate with you about your account, service updates or support questions
• Meet legal obligations and detect misuse or unlawful activity

4. Sharing Data with Third Parties

We do not sell your personal data. Your data is only shared with the following service providers, solely to run the app's functions:

• Google Firebase / Google Cloud: for database storage, account authentication and file storage (for example, profile pictures)
• Google Gemini API: to process voice recordings during AI transaction entry
• Payment gateway provider (for example, Billplz): to process your subscription payments securely; we do not store your card or bank details
• Email delivery provider (Hostinger) and Google Firebase Authentication: to send trial/subscription reminder emails and the email-confirmation link to your email address

All of these providers are bound by their own data protection standards and only receive the data needed to perform their respective functions.

Transfers outside Malaysia

Your account database is stored on Google Cloud servers in Singapore. Bank-statement reading and parts of the Google services we use (including Gemini and Firebase Authentication) may be processed in Google data centres outside Malaysia, including the United States. By using TambahTolak you agree to these transfers, which are made to providers that apply reasonable data-protection safeguards.

5. Data Security

Additional security measures include:

• API keys and sensitive credentials are stored securely on the server side and are never sent to the user's app
• Everything saved to your account is checked for format and size, and the server limits how often some features can be used, to reduce fake accounts and misuse
• Database backups run daily and are kept for 7 days, with point-in-time recovery and protection against accidental deletion
• You can delete your own account inside the app (see section 6)
• Access to backend systems is limited to authorised personnel only

6. Data Retention

We keep your data for as long as your account is active and it is needed to provide the service to you.

You can delete your account yourself at any time in the app: Settings → Delete my account. Deleting permanently erases your transactions, customers, reminders, profile picture and sign-in account from our systems. After deletion we keep only:

• subscription payment records, without your email address, for up to 7 years for accounting and tax purposes; and
• one-way hashes of your email/phone, only for as long as needed to prevent the free trial from being repeated.

7. Your Rights Over Your Personal Data

Under the PDPA, you have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Request deletion of your personal data, subject to applicable legal obligations. You can do this yourself in the app under Settings → Delete my account
• Take a copy of your records: export your ledger and reports as PDF or Excel from the app
• Withdraw consent to marketing communications at any time

To exercise these rights, please contact us using the details in section 12 below.

8. Data Breach Notification

If a data breach involving your personal data occurs and is likely to cause harm, we will notify the relevant authority within 72 hours as required under the PDPA, and inform affected users as soon as possible.

9. Children's Privacy

TambahTolak is designed for use by adult business owners and is not directed at children under 18. We do not knowingly collect personal data from children.

10. Website, Cookies & Analytics

The tambahtolak.com website uses Google Analytics 4 (by Google) to understand how visitors use this website, for example which pages are visited, where visitors come from (such as Google search or a partner link), which buttons are clicked and which files are downloaded. This helps us improve the website and measure how well our marketing works.

• Google Analytics uses cookies (small files in your browser) and technical information such as device type, browser, approximate city/country and IP address. Google Analytics 4 does not log or store your full IP address.
• We do not send your name, email, phone number or business data to Google Analytics, and we do not use it for targeted advertising.
• Analytics data is kept by Google for a maximum of 14 months and reported to us in aggregate form.
• This analytics applies only to the website; it is separate from the data inside the TambahTolak app.

You can block or delete cookies through your browser settings, or install the Google Analytics Opt-out Browser Add-on. The website remains fully usable without analytics cookies.

11. Changes to This Notice

We may update this Privacy Notice from time to time. Any changes will be posted on this page with a new "last updated" date. Continued use of TambahTolak after a change means you accept the updated notice.

12. Contact Our Data Protection Officer

For any questions about this privacy notice, or to exercise your rights over your personal data, please contact our Data Protection Officer (DPO):