Privacy Policy

1. Information We Collect

Account information

Name, email address, and a securely hashed password. We never store your password in plain text.

Financial information you enter

To provide the Service, you choose to give us: account/bank nicknames, the last 4 digits only of card or account numbers, credit limits, balances, transaction descriptions and amounts, categories, budget figures, and fixed monthly expenses. We never ask for or store a full card number, CVV, or online banking password.

Uploaded statements

When you upload a PDF bank or credit card statement, we parse it on our server to extract transaction data into your account, then permanently delete the uploaded file. We do not keep a copy of the original PDF.

Exception: if a statement fails to parse, we'll ask — never assume — whether you're willing to share that specific file to help us fix support for your bank. Nothing is kept unless you explicitly agree. If you don't respond, the file is deleted within an hour, same as normal. If you do agree, it's stored securely, visible only to us, used only to fix the parser, and deleted once that's done.

Payment information

Premium subscription payments are handled entirely by our payment processor, toyyibPay. Your card number and online banking credentials are entered on toyyibPay's own payment page and never pass through CreditoHub's servers. We store only the payment reference, amount, and status needed to activate your Premium access.

Technical & usage information

To keep your account secure, we log IP address, browser/device information, and session/login cookies required to keep you signed in.

2. How We Use Your Information

• To operate the Service you signed up for — dashboards, budgets, categorisation, payment tracking;
• To send account-related emails: email verification, password reset, and Premium expiry reminders;
• To process Premium payments via toyyibPay and keep your subscription status accurate;
• To detect, prevent, and investigate fraud, abuse, or security issues;
• To fix bugs and improve the Service.

3. What We Don't Do

We do not sell your personal data. We do not share your financial data with third parties for marketing purposes. We do not run third-party advertising or ad-tracking scripts on CreditoHub.

4. Third-Party Service Providers

We rely on a small number of service providers to run CreditoHub, each processing only what's needed for their function:

• toyyibPay — payment processing for Premium subscriptions;
• Resend — delivery of transactional emails (verification, password reset, reminders);
• [Hosting provider] — hosts our application and database.

These providers only receive the data necessary to perform their service and are not permitted to use it for their own purposes.

5. Data Security

Passwords are hashed, not stored in plain text. Traffic between your browser and CreditoHub is encrypted in transit (HTTPS). Uploaded statement files are deleted immediately after processing so they are never retained. No method of transmission or storage is 100% secure, but we take reasonable technical and organisational steps to protect your data.

6. Data Retention

We keep your account data for as long as your account is active. If you delete your account (available from Settings), your profile and financial data are permanently deleted from our production database, except where we're required to retain limited records (e.g. payment transaction records) for legal or accounting purposes.

7. Your Rights

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the right to access, correct, and request deletion of your personal data. You can:

• View and edit your data directly within the app at any time;
• Export a copy of your transactions, accounts, categories, and fixed expenses as CSV from Settings;
• Delete your account and associated data from Settings;
• Contact us at creditohub.tech@gmail.com for any other data request.

8. Cookies

We use strictly functional cookies — to keep you logged in and to protect against cross-site request forgery. We do not use third-party advertising or analytics-tracking cookies.

9. Children's Privacy

CreditoHub is not directed at, and should not be used by, anyone under 18 years old. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate, we'll notify you by email.

11. Contact Us

Questions about this Privacy Policy or your data? Reach us at creditohub.tech@gmail.com.