Legal

Privacy Policy

Last updated: July 2026 · This policy is published for transparency during early access and is undergoing formal legal review.

1. Who we are

Sampul (“we”, “us”) provides a financial planning platform for Malaysian households. This policy explains how we collect, use, and protect your personal data, in line with the Personal Data Protection Act 2010 (PDPA).

2. Data we collect

We collect only what the product needs to work:

Account data — your name, email address, and login credentials.
Financial data — balances and transactions from accounts you connect (read-only) or add manually, and the budgets, goals, and plans you create.
Household data — the members you invite and the sharing choices you make.
Documents — files you choose to store in your legacy vault.
Usage data — how you use Sampul, to keep the service reliable and improve it.

3. How we use your data

We use your data to provide Sampul: showing your financial picture, calculating zakat, powering forecasts, answering your questions through Sampul AI, and providing support when you ask for it.

We do not sell your personal data, and we do not use it to advertise third-party products to you. If you request an advisor referral, we share your contact details with TSI Wealth Planners only with your consent.

4. How we protect it

Your data is encrypted in transit (TLS) and at rest. Bank connections are read-only. Internal access is limited to what's needed to run the service and resolve issues you raise, under access controls and logging. See our Security page for the full picture.

5. Your PDPA rights

Under the PDPA you may:

Access the personal data we hold about you (export it from Settings → Data).
Correct inaccurate data (edit your profile in Settings, or ask us).
Withdraw consent and delete your account and data (Settings → Data — deletion is permanent).

6. Data retention

We keep your data while your account is active. When you delete your account, we delete your personal data, except where we're legally required to retain specific records for a defined period.

7. Contact

For privacy questions or formal PDPA requests, email support@sampul.app. We respond within the timelines the PDPA requires.