Privacy Policy

Account information. When you register or sign in with Google, we receive your name, email address and profile identifier from the identity provider.

Tender documents and project data. Documents you upload (PDF, DOCX, TXT, or camera scans), the bill of quantities, pricing records, overrides and notes you create within the platform.

Payment information. Subscription payments are processed by Touch ’n Go eWallet. We receive transaction confirmations and references only — we never see or store your eWallet PIN or full payment credentials.

Usage and technical data. Audit events (uploads, extractions, overrides, logins), IP addresses, browser type and timestamps, used for security and service improvement.

We use the information we collect to:

• Provide, operate and improve the PERSIS platform, including document extraction, BOQ generation and pricing analysis;
• Authenticate your account and enforce role-based access;
• Process subscriptions and payments;
• Maintain a complete audit trail of actions taken in your workspace;
• Respond to support requests and communicate service updates;
• Detect, prevent and investigate fraud, abuse or security incidents.

To extract tender information and suggest pricing, uploaded documents may be processed by third-party large language model providers (such as Moonshot AI, DeepSeek, Alibaba or Google) over encrypted connections, strictly for the purpose of delivering the service to you. Documents are not used to train these models where the provider offers such an opt-out, and we select providers whose terms prohibit retaining your content beyond the processing window.

You can disable AI-powered stages at any time in the application settings; core upload and review features continue to work.

Your data is stored in encrypted databases hosted on reputable cloud infrastructure. Uploaded files are stored with access controls, and all traffic between your browser and our servers is encrypted with TLS. Access to production data is restricted to authorised personnel on a need-to-know basis.

We retain your project data for as long as your account is active. You may request deletion of your account and associated data at any time (see Section 7).

We do not sell your personal data. We share data only with:

• Service providers who help us operate the platform (cloud hosting, database, payment processing, AI inference), each bound by confidentiality obligations;
• Authorities where disclosure is required by Malaysian law or a valid legal process.

We use strictly necessary cookies for authentication sessions and security (CSRF protection). We do not use advertising or third-party tracking cookies.

Under the Personal Data Protection Act 2010, you have the right to:

• Request access to the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Withdraw consent to processing (which may limit service availability);
• Request deletion of your account and personal data.

To exercise any of these rights, email [email protected]. We respond within 21 days.

We may update this policy from time to time. Material changes will be announced in the application or by email, and the "last updated" date above will be revised. Continued use of the platform after changes take effect constitutes acceptance.