Legal

Privacy Policy

Last updated: 23 June 2026 · Effective from launch

MORTAR ("MORTAR", "we", "us") provides a mobile application that helps Malaysian contractors manage quotations, invoices, projects, site photos, workers and expenses. This Privacy Policy explains what we collect, why, and the choices you have. We handle personal data in a manner consistent with the Malaysian Personal Data Protection Act 2010 (PDPA).

1. Information we collect

a. Information you provide

• Account details — your name, email address and password (passwords are never stored in plain text; authentication is handled by our identity provider).
• Business profile — company name, registration/SSM number, address, CIDB/contractor grade and logo, where you choose to add them.
• Operational content — quotations, invoices, payments, projects, progress claims, expenses, worker records, attendance, compliance documents and site photos that you create in the app.
• Client details you enter — names and contact information of your customers, for the purpose of issuing documents to them.

b. Information collected automatically

• Device & usage data — device type, operating system version, app version, and crash/diagnostic logs, used to keep the app stable and secure.
• Basic analytics — anonymous, aggregated usage events (for example, which features are used) to improve the product. We do not sell this data.

MORTAR does not collect precise location, contacts, or advertising identifiers for tracking. Photos are only accessed when you choose to add them to a project.

2. How we use your information

• To provide and operate the app and sync your data across your devices.
• To generate documents (quotations, invoices, claims) and PDFs you choose to share.
• To send essential service emails (for example, account verification or important notices) via our email provider.
• To maintain security, prevent abuse, and diagnose and fix problems.
• To improve features based on aggregated, non-identifying usage.

We process your data to perform our agreement with you and on the basis of your consent, which you may withdraw at any time by deleting your account.

3. Where your data is stored

Your data is stored on reputable cloud infrastructure with primary hosting in Singapore (ap-southeast-1), selected for low latency to Malaysia and alignment with PDPA expectations. Files such as site photos and PDFs are stored using an object-storage provider. Some service providers we use (for authentication, email delivery and crash reporting) may process limited data in other regions under appropriate safeguards.

4. Sharing & disclosure

We do not sell your personal data. We share data only:

• With service providers ("data processors") who host our database, deliver email, store files and report crashes — bound by contract to protect your data and use it only on our instructions.
• At your direction — for example, when you share a document PDF or enable a read-only client portal link. The client portal deliberately excludes costs, margins and worker information.
• When required by law — to comply with a valid legal obligation, court order, or to protect rights and safety.

5. Data retention

We keep your data for as long as your account is active. The app uses "soft deletion" — deleted items are archived rather than immediately destroyed — so you can recover from mistakes. When you delete your account, we remove or anonymise your personal data within a reasonable period, except where we must retain certain records to comply with legal or tax obligations.

6. Your rights

Under the PDPA you may request to access, correct, or withdraw consent for the processing of your personal data, and request deletion of your account. To exercise any of these rights, email hello@mortar.my. We will respond within a reasonable timeframe.

7. Security

We use encryption in transit (HTTPS/TLS), access controls and reputable infrastructure providers to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you of any material breach as required by law.

8. Children

MORTAR is a business tool intended for users aged 18 and over. We do not knowingly collect data from children.

9. Changes to this policy

We may update this policy as the product evolves. Material changes will be notified in-app or by email. The "last updated" date above always reflects the current version.

10. Contact us

Questions about privacy or your data? Contact us at hello@mortar.my.

← Back to home