1. Who we are
Manabarang is an inventory service based in Kuala Lumpur, Malaysia. In this policy, “we” means Manabarang. We are the data user under Malaysia’s Personal Data Protection Act 2010 (PDPA) and the data controller for users in the European Economic Area and the United Kingdom.
This policy covers the website, the mobile app, the connected-app (MCP) service and the public pages we run. It is provided in English. A Bahasa Malaysia version is available on request through hello@manabarang.example.
2. What we collect
Your account
Your name, email address and a hashed password, or the name, email address and profile picture Google shares when you sign in with Google. We also keep your settings, such as which reminder emails you want.
What you put in your spaces
Items and their details (name, condition, purchase date, price, serial number, notes, custom fields), places, categories, warranties, pre-orders and their payments, wishlist entries, and loans, including the borrower’s name and any contact detail you type. Photos and receipts you upload are stored with their file name, type and size. Please do not put other people’s sensitive information in free-text fields.
Members and invitations
When you invite someone we keep their email address, the role you chose and any message you wrote. A space keeps a history of changes, including who made each one.
Sign-in and device information
For each signed-in session we keep a session token, its expiry, the IP address and browser details used to sign in, so you can review and end sessions. Connected apps and access tokens you create are stored as hashed values with their scopes and the time they were last used.
Billing
Your plan, billing period, billing name, billing email and tax number if you give one, invoices, and the card brand, last four digits and expiry date of your card. Card numbers are handled by our payment processor and never reach our servers. Purchases made in the Apple App Store or Google Play are billed by those stores, and we receive a purchase reference.
Messages and support
Anything you send through the contact, feedback and bug-report forms: your name, email address, message, rating, and any screenshot you attach. If you choose to include technical details we also receive the page you were on (without its query), app version, browser, screen size, plan and time. Replies sent to our support email are kept with the thread.
Waitlist and sales enquiries
Name, email address, how you plan to use the service and whether you agreed to hear from us.
Usage counts
We count how many times labels are scanned and connected-app calls are made for each space, with a timestamp and no personal detail, to run and plan the service. We do not use advertising or analytics trackers.
3. How we use it
- To provide the service: store your inventory, show it to the people you share it with and keep it available across your devices.
- To sign you in, keep your account secure and prevent abuse, including limiting repeat free trials and rate limiting public forms.
- To send emails you need: verification codes, password resets, invitations, loan, warranty and pre-order reminders, a weekly digest, billing notices and replies to your messages.
- To take payment, issue invoices and handle refunds.
- To answer support requests and fix problems.
- To meet legal obligations and to establish or defend legal claims.
We do not sell personal data, and we do not use your inventory to train machine-learning models or to show advertising.
5. Public pages and messages
Two features can be opened without an account, and only when an owner switches them on.
Found-item pages. A label can point to a page that shows only the item’s name. A finder may send a message with their contact detail. We email it to the owner and store it with a one-way hash of the sender’s IP address to limit abuse.
For-sale listings. A listing page shows the item, price, condition, description, photos, an area the seller typed and, if the seller chooses, their first name. It never shows the seller’s email, address or space name. Anyone with the link can read it. Buyers who send a message give a name and an email or phone number, which go to the seller. We count a view once per visitor per day using a salted hash, not the IP address itself.
7. How long we keep it
- Items you delete go to Recently deleted and are removed for good when their retention period ends, 30 days or longer depending on your plan. You can remove an item forever sooner.
- Spaces you delete are removed with everything in them after 30 days.
- Uploaded files that are never attached to anything are removed within days.
- Usage counts are deleted after 400 days.
- Invoices and billing records are kept as long as accounting and tax rules require.
- Support messages, waitlist entries and sales enquiries are kept for as long as needed to deal with them and for a reasonable period afterwards. Ask us if you want them removed sooner.
- Backups are rotated, so deleted data can remain in a backup for a short time before it is overwritten.
8. Your choices and rights
Under the PDPA you may ask for access to the personal data we hold about you, ask us to correct it, withdraw your consent, and limit how we process it. We will reply within the time the law allows. To make a request, use hello@manabarang.example.
- Export. You can export your items from Settings under Data.
- Edit. You can change your name, email, password and reminders in Settings.
- Delete your account. Settings lets you delete your account. If you own a space that other people use, you first need to hand it over or remove the members. Deleting your account deletes the spaces you own, signs out every session, removes your linked sign-in and access tokens, and anonymises the account record. Invoices are kept for the books.
- Marketing. We only send marketing if you agreed, and every message can be unsubscribed from.
You may be unable to use parts of the service if you withdraw consent to processing that the service depends on.
9. People in the EEA and the UK
If you are in the European Economic Area or the United Kingdom, the following also applies.
- Our reasons for processing. To perform our contract with you (running your account and plan), for our legitimate interests (security, preventing abuse, improving the service), to comply with law (tax and accounting), and with your consent where we ask for it, such as marketing.
- Your rights. You may ask for access, correction, erasure, restriction, portability and to object to processing, and you may withdraw consent at any time.
- Transfers. Our servers and providers may be outside your country. Where we transfer data internationally we rely on safeguards such as standard contractual clauses with the provider.
- Complaints. You can complain to your local data protection authority. We would like the chance to fix the problem first, so please write to us.
10. How we protect it
Passwords are hashed, connections use HTTPS, access tokens are stored as hashes, and every space is isolated from the others in the database. Administrators can only view an account in read-only mode, and each such view is logged. No system is perfectly secure. If a breach is likely to harm you, we will tell you and the authorities as the law requires.
11. Children
Manabarang is not meant for anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
12. Where data is processed
The service runs on servers we operate, and some providers named above process data in other countries. By using the service you agree to this transfer, and we take steps to keep your data protected wherever it goes.
13. Changes to this policy
We will update this page when our practices change and change the date at the top. If a change matters to you, such as a new use of your data, we will email you or show a notice in the app before it takes effect. Our Terms of Service also apply to your use of the service.
14. Contact us
Questions, requests or complaints about personal data: write to Manabarang, Kuala Lumpur, Malaysia, through hello@manabarang.example.