Privacy Policy

Kutip helps groups keep track of who has paid into a collection. This policy explains what personal data we handle, why, and the choices you have. It is written to meet Malaysia's Personal Data Protection Act 2010 (PDPA). Kutip is operated by KUTIP, contactable at kutip0818@outlook.com.

What we collect

If you organise a collection: your name, email address (to sign in), mobile number, bank or e-wallet name, account number and account name, your DuitNow QR image if you upload one, the collection details, and the names of the people you add.

If you pay into a collection: your name as the organiser listed it, the amount, your payment status, and the receipt screenshot you upload. A receipt usually shows names, part of an account number, the amount, the date and a reference number. Members don't create accounts.

Technical data: a one-way scrambled version of your IP address, used only to stop abuse (we never store the address itself), and basic server logs. Organisers get a sign-in cookie. On members' phones, the browser remembers which name you paid as, so the page can show your status. We don't use advertising or tracking cookies.

Visit statistics: we count page views to see how Kutip is used, such as which pages are visited, roughly which country and type of device visits come from, and which website referred them. These counts are anonymous: they use no cookies and can't be used to identify you.

Why we use it

• To run collections: show the payment page, record payments and show the organiser who has paid.
• To check receipts: we read the amount, date, recipient and reference number to spot mistakes and duplicates.
• To prevent fraud and abuse, including handling reports about a collection.
• To answer your questions and keep Kutip working.
• To understand, from anonymous visit counts, which parts of Kutip people use, so we can improve it.

We don't sell personal data or use it for advertising.

Who can see it

• Anyone with a collection's link sees the organiser's name, phone number and payment details, the list of names and, if the organiser allows it, who has paid.
• Only the organiser can see uploaded receipts, reference numbers and the issues Kutip flags.
• Our team looks at data only when needed to support you, investigate a report or keep Kutip secure.

Service providers

We use these companies to run Kutip. They process data only on our instructions:

• Supabase: database, file storage and sign-in, hosted in Singapore.
• Vercel: hosting of the website, and the anonymous visit statistics.
• Anthropic: reads receipt images to extract payment details. Under Anthropic's commercial terms, this data isn't used to train its models.
• Google: only if you choose to sign in with Google.

Some of these providers process data outside Malaysia. We rely on their contractual and security safeguards to protect it, as the PDPA requires.

How long we keep it

• Receipt images are deleted automatically 90 days after a collection is closed or its due date passes, whichever comes first.
• Collections and member lists are kept until the organiser deletes them or their account.
• Reports about a collection are kept only as long as needed to deal with them.

Your rights

You can ask to see, correct or delete personal data we hold about you, or withdraw your consent. Organisers can edit or delete their collections at any time. Members can ask the organiser, or contact us at kutip0818@outlook.com. We reply within 21 days.

Security

Data is encrypted in transit, receipts and QR images are kept in private storage, and access is limited to the people who need it. If a breach affects your data, we will notify you and the authorities as the PDPA requires.

Changes

If we change this policy in a way that matters, we'll say so on this page and update the date above.