Privacy Notice
Last updated: 10 June 2026
This Privacy Notice is issued by Bryan Tan Hou Quan, the individual who operates the Alfa Personal Finance app ("Alfa", "we", "us"), in compliance with the Personal Data Protection Act 2010 of Malaysia ("PDPA"), as amended by the Personal Data Protection (Amendment) Act 2024. It explains how we handle your personal data when you use the Alfa Personal Finance app.
1. Who we are
Bryan Tan Hou Quan, operating the Alfa Personal Finance app from Malaysia, is the data controller in respect of your personal data. For any privacy matter, including contacting our Data Protection Officer, you can reach us at privacy@alfapersonalfinance.com.
2. What personal data we collect
We collect the following categories of personal data:
- Account data: name, email address, authentication identifiers.
- Profile data: date of birth (if you choose to provide it), occupation, country, gender (if you choose to provide it).
- Financial transaction data: transactions, budgets, account balances, categories and recurring transaction records that you enter.
- Device and usage data: device identifiers, app version, language preference, and app-usage analytics such as which features and screens you use and how often, collected through Google Analytics for Firebase to operate, secure and improve the app. This does not include the content of your transactions, and we do not collect your advertising identifier.
- Support enquiries: the reason, title and message you send through Contact us, together with the name and email linked to your account, plus your app version and device type, so we can reply and investigate the issue.
3. How we use your data
We use your personal data for the purposes below, on the lawful basis indicated:
- To provide and operate the App's personal-finance tracking features (contractual necessity).
- To authenticate you and secure your account (contractual necessity, legitimate interest in security).
- To save your preferences and settings (contractual necessity).
- To respond to your Contact us enquiries and provide support (contractual necessity, legitimate interest).
- For internal product analysis and improvement (legitimate interest).
- To produce anonymised, aggregated industry insights that may be published or shared with business partners (legitimate interest, data is anonymised before any external sharing).
- To show you personalised offers within the app, where you have given opt-in consent.
- To send you promotional notifications and emails, where you have given opt-in consent.
- To share anonymised, aggregated cohort insights with business partners, where you have given opt-in consent.
4. Third parties we share with
We may share anonymised, aggregated insights (such as cohort spending trends) with the following classes of business partners:
- merchants and retailers (for offers and market analysis)
- financial institutions, e-wallets and banks (for partnership integrations)
- insurance providers (for product personalisation)
- research and analytics firms (for industry reports and benchmarking)
- marketing and advertising partners (for offer placement),
and other service providers acting on Alfa's behalf under contractual confidentiality and data-protection obligations (such as cloud hosting, email delivery and customer-support tooling).
We never share your name, email or other identifying information with these business partners. Identifiable user data is never disclosed to merchants for marketing purposes.
Exchange-rate lookups. When you record a transaction in a foreign currency, or set up a trip in another currency, the App requests the latest exchange rate from a third-party rate provider (open.er-api.com, with frankfurter.app as a fallback). Only the currency codes involved (for example MYR and JPY) are sent. Your transactions, amounts, name and other personal data are never sent for this lookup.
5. Direct marketing and your right to opt out
Where you have given consent, we may send you direct marketing communications via in-app placements, push notifications and email. Under section 43 of the PDPA you have the right to require us to stop processing your personal data for direct-marketing purposes. You can do this at any time in Settings → Privacy and data in the app, or by contacting privacy@alfapersonalfinance.com.
6. Cross-border transfer
Your personal data is stored on Google Firebase Cloud Firestore in the Singapore region (asia-southeast1). Singapore is a jurisdiction recognised as offering personal-data protection comparable to Malaysia's PDPA.
Some related Google services (including Firebase Authentication, Google Sign-In, and, where present, crash and analytics SDKs) process certain data through Google's infrastructure in the United States. By using the App you consent to this transfer. The relevant Google services operate under their own privacy commitments and contractual safeguards.
7. Data retention
- Account and profile data: retained while your account is active.
- Financial transaction data: retained until you delete the data via Settings → Delete all data, or until you delete your account.
- Consent records (
consent/current): retained while your account is active. - Consent audit log (
consent/history): retained for up to 7 years from the date of the entry, in anonymised form where the account has been deleted, for the purpose of demonstrating compliance. - Device and usage logs: retained for up to 12 months.
8. Your rights under the PDPA
You have the following rights:
- Access: request a copy of the personal data we hold about you.
- Correction: ask us to correct inaccurate or incomplete data.
- Withdraw consent: turn off any optional toggle in Settings > Privacy and data at any time.
- Data portability: request a machine-readable copy of your data, available on request via privacy@alfapersonalfinance.com.
- Deletion: delete all your data or your entire account via Settings.
- Complaint: lodge a complaint with the Personal Data Protection Commissioner of Malaysia (https://www.pdp.gov.my).
9. Children
Alfa is intended for users who are 18 years of age or above. We do not knowingly process personal data of children under 18 for direct marketing, profiling or sharing with business partners. The optional features in Settings → Privacy and data require you to confirm that you are 18 years of age or older. If we discover that data of a user under 18 has been processed for these purposes, we will delete it and revoke the related consent.
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, secure authentication, and access controls aligned with the platform-level controls provided by Firebase. No system is completely secure, and we cannot guarantee absolute security.
11. Data breach notification
In the event of a personal-data breach affecting your data and likely to result in significant harm, we will notify you and the Personal Data Protection Commissioner without undue delay, and in any event within 72 hours of becoming aware of the breach, in line with the 2024 amendments to the PDPA.
12. Data Protection Officer
We have appointed a Data Protection Officer who is responsible for overseeing our PDPA compliance programme. You can reach our Data Protection Officer at privacy@alfapersonalfinance.com.
13. Changes to this notice
We may update this Privacy Notice from time to time. Material changes (such as adding a new third-party category, a new processing purpose, or a new marketing channel) will require you to re-acknowledge the updated Notice in the app. Minor clarifications will be notified via an in-app banner.
14. Contact
If you have any questions about this Privacy Notice or wish to exercise any of your rights, please contact us at privacy@alfapersonalfinance.com.
A Bahasa Malaysia translation is also available in the app.