Privacy Policy
Recurring Reminder is provided by Revnology Group (M) Sdn. Bhd. (202101013320 (1413619-U)), A-17-03A, Pinnacle PJ, Lorong Utara C, 46200 Petaling Jaya, Selangor, Malaysia (“Revnology”, “we”).
This policy explains what personal data Recurring Reminder collects, why, who it is shared with, how long it is kept, and the choices and rights you have. It is written for the Personal Data Protection Act 2010 of Malaysia (PDPA), as amended.
1. Two roles we play
- For your account (your name, email, password and settings), Revnology decides how the data is used. We are the data controller (“data user” under the PDPA).
- For what you put into the service (your businesses, reminders, records, files, and the names and email addresses of people you invite or add), we process it on your behalf, to provide the service to you. You decide what goes in, and you are responsible for having the right to give us other people’s details, for example a director you add to receive reminder emails.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash), time zone, email preferences, two-step sign-in settings | You, when you sign up or change Settings |
| Google sign-in | A Google account identifier, and the name and email Google shares | Google, only if you choose “Continue with Google” |
| Your businesses | Business names and types, financial year end, incorporation date, and answers such as whether a business has staff or is registered for SST | You and your team |
| Reminders and records | Due dates, amounts, references, notes, steps, and records of what was paid, filed or skipped | You and your team |
| Files | Receipts, proof of submission and samples you upload | You and your team |
| People | Names and email addresses of team members, invitees, and extra email recipients | You and your team |
| Activity | Who added, changed, marked done or deleted what, and when, so the team can see and undo changes | Created as the service is used |
| Sign-in and security | Active sign-ins (with the browser and device name), recent failed sign-in attempts, and a record of support staff access | Created as the service is used |
Your IP address is used briefly, in memory, to limit repeated sign-in attempts. It is not stored. We do not use analytics, advertising or tracking tools, and we do not collect data from other websites.
3. Why we use it
- To provide the service: show your reminders, work out due dates, keep your records and files, and let your team work together.
- To send the emails the service is for: reminder emails, “what changed” emails, invitations, and account emails such as confirming your address or resetting your password. You can turn reminder and change emails off in Settings.
- To keep accounts and data secure: sign-in, two-step sign-in, preventing abuse, and investigating problems.
- To support you: when you ask for help, or to fix a problem, authorised Revnology staff may look at your account. Every such access is recorded in an audit log with the reason.
- To run the business: plans, limits and billing, and meeting our legal obligations.
We do not sell your data, use it for advertising, or use what you put into the service for any purpose other than providing it to you.
4. Who we share it with
Only the service providers we need to run Recurring Reminder, each bound to protect the data and use it only for us:
- Hosting: the provider that runs our servers, database and file storage.
- Email delivery: the provider that sends our emails. It receives the recipient’s address and the email’s content.
- Google: only if you use “Continue with Google”, for signing in.
- Domain registry lookup (rdap.org): if you turn on the domain expiry check for a reminder, the domain name is looked up there. No personal data is sent.
Inside the service, what you add is visible to the people you give access to, as set in Settings → Team. We may also disclose data where the law requires it, or to protect the rights, safety or property of our users or Revnology.
5. Where it is stored
Your data is stored with our hosting provider. It may be stored or processed outside Malaysia. Where it is, we only use providers in places with protection substantially similar to the PDPA, or that are bound by contract to protect it to that standard.
6. How long we keep it
- Your account and team data: for as long as you use the service.
- A deleted business: kept for 30 days so it can be brought back, then deleted for good with its reminders, records and files.
- A deleted record or file: can be restored for 30 days, then removed.
- Deleting your account (Settings → Account) removes it straight away, together with every team you are the only owner of, and its businesses, records and files. Teams with other owners stay, without you.
- Sign-ins expire after 30 days.
- Backups may hold deleted data for a limited time until they are replaced in the normal backup cycle.
7. How we protect it
Connections are encrypted (HTTPS). Passwords are stored as one-way hashes, and two-step sign-in secrets are encrypted. Two-step sign-in with an authenticator app is available to every account and required for our support staff. Access inside a team follows the permissions you set. Staff access is limited to what support needs, and is logged. No method is perfectly secure, but we work to protect your data and will tell you, and the authorities where required, if a breach affects it.
8. Cookies
We use only the cookies the service needs to work. They are not used for tracking or advertising.
| Cookie | What it does | Lasts |
|---|---|---|
rr_session | Keeps you signed in | 30 days, or until you sign out |
rr_ws, rr_pf | Remembers the team and business you were viewing | 1 year |
rr_2fa | Holds the step between your password and your two-step code | 10 minutes |
rr_oauth | Protects “Continue with Google” sign-in | 10 minutes |
9. Your rights and choices
- Access and correction: see and change your details in Settings, or ask us for a copy of the personal data we hold about you.
- Take your data with you: download your history (CSV) and a full backup of your team (JSON) from Settings → Businesses.
- Emails: turn reminder and change emails off in Settings → Emails & calendar. Account emails, such as password resets, are still sent when needed.
- Deletion: delete your account yourself in Settings → Account, or ask us.
- Withdraw consent: you can stop using the service and delete your account at any time.
- Complaints: contact us first. You may also complain to the Personal Data Protection Commissioner of Malaysia.
If you were added to someone else’s team, or receive their reminder emails, most of your data is under their control. Ask them first; we will help where we can. Write to [email protected] for any request. We may need to confirm who you are first, and will reply within the time the law allows.
10. Children
Recurring Reminder is for businesses and adults managing their own affairs. It is not meant for anyone under 18, and we do not knowingly collect their data.
11. Changes
We may update this policy as the service changes. The date at the top shows the latest version. If a change is significant, we will tell you by email or in the app before it takes effect.
12. Contact
Questions or requests about your personal data: [email protected]. Our full details are at the top of this page. See also our Terms of Service.