Privacy notice

This notice explains what personal data IR Assist collects, why, and your rights under Malaysia’s Personal Data Protection Act 2010 (PDPA). It is written in English; a Bahasa Malaysia version is available on request.

What we collect

• Account details: your name, organisation, work email and a password (stored only as a secure hash by our sign-in provider).
• What you ask: searches you type, questions you ask the AI assistant, and any mistakes you report about an award.
• Technical data: basic error logs (time, page, error message) needed to keep the service running and secure.

We do not collect data about the employees or cases you work on. Please do not type personal data about other people into search or the assistant.

Why we use it

• To create and secure your account and let you sign in.
• To answer your searches and questions. The text you type, and which award or filters are on your screen, is sent to an AI model to produce the answer.
• To fix mistakes you report, and to improve the service from search patterns that are not linked to your name.
• To send account emails you ask for, such as password resets.

We do not sell your data or use it for advertising.

Who processes it

• Supabase (database and sign-in), in Singapore. Data is encrypted at rest (AES-256) and in transit (TLS). Supabase is SOC 2 Type 2 audited.
• Vercel (website hosting), running in Singapore. Vercel is ISO 27001 certified and SOC 2 Type 2 audited.
• OpenRouter and the AI model provider it routes to (search answers and the assistant). Only what you type and what is on your screen is sent, never your account details. We allow only providers that do not store your questions or use them to train AI models (zero data retention).

Some of these providers are outside Malaysia. We use them only for the purposes above.

How long we keep it

Account data is kept while your account is open. When you delete your account (Settings, Delete account), your account details are deleted straight away. Search logs and error logs are not linked to your name and are deleted automatically after 12 months.

Cookies

We use only the cookies needed to keep you signed in and secure. We do not use advertising or tracking cookies, so there is nothing to opt in or out of.

Security and breaches

Data is encrypted in transit and at rest, and access to it is restricted. If a personal-data breach occurs, we will notify the Personal Data Protection Commissioner and affected users as required by the PDPA (as amended in 2024). More detail is on our Security page.

Your rights

• See and correct your details in Settings at any time.
• Delete your account and its personal data in Settings.
• Ask for a copy of the personal data we hold about you, or withdraw consent, by contacting us.

Court awards

Awards in the data bank are published by the Industrial Court of Malaysia and are public records. Our summaries are derived from those published awards.

Contact

Questions or requests about your personal data: jchandrasegaran@gmail.com.