Rencana Privacy Policy

This Privacy Policy explains how AIZZ TECH SOLUTIONS ("Aizztech", "we", "us", "our") collects, uses, and protects your personal information when you use Rencana, including the mobile apps, website, account pages, billing pages, and related support channels (the "Service"). Rencana is a student planner developed by AIZZ TECH SOLUTIONS, a partnership registered in Malaysia under business registration number 202603004666, located at No. 3B, Lot 2967, Jalan Bukit Naga, 40460 Shah Alam, Selangor, Malaysia. We act as the data controller. By using the Service you consent to the processing of your information described here.

We handle personal data in accordance with the Malaysian Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024.

This policy applies to Rencana on iOS, Android, and web. Other AIZZ TECH SOLUTIONS products and websites may have their own privacy notices.

We collect only the information needed to run the Service:

• Account data — Name or display name, email address, a password credential held in hashed form by our authentication provider, and the institution and programme you select. If you sign in with Google or Apple, the profile fields those providers return. Source: your registration.
• Academic content — Timetables, subjects, courses, lecturers, venues, assessment components, marks you enter, deadlines, tasks, notes, flashcards, quizzes, and study records. Source: your entry, a photograph, a file upload, device calendar import, a connected Google Classroom account, or UiTM timetable endpoints if you use the student ID route.
• University record data — For UiTM students using the student ID route: your matric number, and the name, programme, faculty, semester, and group published by UiTM. Source: UiTM endpoints, requiring read-only access after verification by one-time passcode.
• Social content — Display status, study snaps, friend connections, study circles, and community feature posts. Source: the features you use.
• Usage data — Screens opened, features used, study streaks, generation counts against your allowance, and application errors. Source: automatic collection during use.
• Device data — Device model, operating-system version, application version, and push-notification token. Source: automatic collection.
• Approximate campus location — Only if you enable the campus map or "Share location". Source: your device with your permission, withdrawable in system settings.
• Subscription and billing data — Tier held, trial status, renewal dates, and the limited payment, invoice, refund, plan, and billing status identifiers returned by our payment providers so we can show your billing history, verify access, process refunds, and answer billing questions. Source: Apple, Google, or the web payment provider.

What we do not collect: card numbers, expiry dates, security codes, and bank details are never received or stored by us. Web payments are processed by Curlec, a Razorpay company; iOS and Android purchases are processed by Apple and Google. We receive only subscription status information. The Service does not collect data on health, religion, political opinions, or other sensitive personal data categories under the Act, and you should not enter such information into your notes. No advertising identifiers are used.

• Operate the planner, community, and notification features you use.
• Authenticate you and keep your account secure.
• Deliver class and task reminders at the times you choose.
• Provide AI features such as timetable import from a photo. Images you submit are sent to our AI provider only for the duration of that task and are not retained for training.
• Respond to support requests, enforce our Terms of Use, and investigate reports of abuse.
• Manage subscriptions, one-month passes, invoices, refunds, and plan entitlement changes.

We do not sell personal data. We do not use personal data for advertising and we do not run advertisements in the app.

The following service providers process personal data only on our instructions, for the purposes stated:

• Supabase, Inc. — Database, authentication, file storage, and server-side functions. Processing location: South Asia (Mumbai), India.
• Cloudflare, Inc. — Hosting and protection for our website, API routes, and webhook endpoints. Processing location: United States and global edge network.
• OpenAI, L.L.C. — Extraction, structuring, tutoring, and generation from content you submit. Processing location: United States.
• Google LLC (Gemini API and Google Cloud) — Optical character recognition on images and PDFs you submit. Processing location: United States and other Google regions.
• Google LLC (Google Classroom API) — Reading coursework, only if you connect your Classroom account. Processing location: United States.
• Spotify AB (optional) — Only accessed if you connect Spotify to share your "now playing" status with friends. Processing location: Sweden, United States, and elsewhere.
• RevenueCat, Inc. — Subscription entitlement management on the app stores. Processing location: United States.
• Curlec by Razorpay (Razorpay Curlec Sdn Bhd) — Payment collection and subscription billing for website purchases. Processing location: Malaysia.
• Apple Inc. and Google LLC — App distribution, sign-in, in-app purchase, and push notification. Processing location: United States and elsewhere.
• Functional Software, Inc. (Sentry) — Error and crash reporting. Processing location: United States.
• Mapbox, Inc. — Campus map rendering. Processing location: United States.

We also disclose personal data where required by law, court order, or regulator authority, and in connection with a business transfer, in which case the new entity will be bound by this policy.

Rencana lets you share specific things with specific people:

• Your profile name, university, and optional bio are visible to users you add as friends.
• Reactions, quick messages, and shared tasks are visible only to the recipient.
• Study-circle posts are visible only to members of that circle.
• Your live location, if enabled, is visible only to members of the circles you choose.

We retain your data for as long as your account is active. When you delete your account (in the app under Settings → Account & legal → Delete account, or on the website under Account → Delete account), we permanently remove your profile, timetable, tasks, notes, community content, and shared-task records from our primary database within 30 days. Encrypted backups are rotated out within 60 days. Billing, tax, fraud-prevention, and support records may be kept for longer where required for accounting, dispute handling, legal compliance, or payment processor obligations.

You may exercise these rights at any time, directly in the app or by contacting us:

• Access — Access the personal data we hold about you and download a copy from Account → Download my data on the website, or email us to request one.
• Correct — Correct your personal data, including directly in the app.
• Delete — Delete your account and associated personal data in the app (Settings → Account & legal → Delete account) or on the website (Account → Delete account), or email us and we will do it for you.
• Withdraw consent — Withdraw consent for optional features, including community features, location sharing, and third-party integrations.
• Restrict or object — Restrict or object to processing that is not necessary to provide the Service.
• Request data portability — Request transmission of your personal data to another service provider where technically feasible and compatible.

To exercise these rights, use the Settings controls in the app or contact contact@aizztech.com. We will respond within 21 days, as required under the Act.

Rencana is intended for users aged 13 and above. We do not knowingly collect information from children under 13. If you believe a child under 13 has provided us with information, please contact us and we will delete it.

Users under 18 should ensure a parent or guardian is aware of their use of Rencana and understands this policy, particularly the sections on community features and location sharing. Parents or guardians may contact contact@aizztech.com regarding the personal data of users in their care.

We use industry-standard safeguards including TLS in transit, encrypted database storage, row-level security policies, and audited access controls. No system is 100% secure; please use a strong, unique password and enable device passcode/biometrics.

Several of the providers listed in section 4 process personal data outside Malaysia. Under the amended Act, such transfers are permitted where the receiving jurisdiction has substantially similar law or ensures comparable protection, in line with the guidelines issued by the Personal Data Protection Department.

These transfers rely on the contractual protections in each provider's data processing addendum, and a transfer impact assessment is being completed.

Following a security breach that causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner as soon as possible and within 72 hours of becoming aware of it. Affected users will be notified within 7 days of that notification, including what happened, the data involved, and the actions we recommend.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the Rencana app or by email.

Questions about this policy or how we handle your personal data can be sent to contact@aizztech.com. If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Malaysia.

AIZZ TECH SOLUTIONS
Business Registration No. 202603004666
No. 3B, Lot 2967, Jalan Bukit Naga, 40460 Shah Alam, Selangor, Malaysia
Developer of Rencana
aizztech.com