Privacy Policy

This Privacy Policy explains how MiniPeople (the “Service”, “we”, “us”, or “our”) handles personal data when people visit our website, create an account, subscribe to a plan, contact us, or use the Service. It is intended to support the privacy principles in Malaysia's Personal Data Protection Act 2010 (“PDPA”) and other privacy laws that may apply.

For employee, applicant, leave, payroll, and claims information entered by a customer, the customer organisation is generally the data controller and MiniPeople processes that data on the customer's behalf. The customer decides what workforce data to collect and why. MiniPeople acts as a controller for account administration, billing, platform security, and our own business communications.

If your employer uses MiniPeople and you have a question about your workforce record, contact your employer first. We will assist the employer with an appropriate request where required.

Depending on how you use MiniPeople, we may process:

• Account data: name, email address, password hash, email-verification status, profile details, account role, login time, and account identifiers.
• Organisation and workforce data: company name and registration number; employee name, contact details, address, department, job role, employment dates, and status.
• HR records: leave types, balances, requests, reasons, approval decisions and notes; payroll periods, salary, allowances, overtime, bonuses, deductions, tax amounts, payment status and notes; and expense-claim details, receipt references, review notes, and payment status.
• Billing data: plan, subscription status, billing period, Stripe customer and subscription identifiers, and transaction records. Card details are collected and handled by Stripe rather than stored by MiniPeople.
• Device and usage data: IP address, browser or device information, session data, security events, diagnostic logs, and performance information.
• Communications: information you provide when requesting support, giving feedback, or otherwise contacting us.

Please do not enter sensitive personal data that is unnecessary for the HR purpose selected by your organisation.

We receive data directly from account holders; from the employer, administrator, employee, or invited user who enters it; automatically from the browser or device when the Service is used; and from service providers such as Stripe when they confirm subscription and payment events.

Customers must ensure they have the authority to provide workforce data to MiniPeople and give employees and other individuals any notices required by law.

We process personal data to:

• provide employee records, leave, payroll, claims, reporting, PDF generation, and related HR features;
• create and secure accounts, authenticate users, manage permissions, and send verification or password-reset emails;
• administer subscriptions, invoices, payments, renewals, cancellations, and plan limits;
• maintain, troubleshoot, measure, and improve the reliability and usability of the Service;
• detect fraud, misuse, unauthorised access, and other security threats;
• provide support and send important operational or policy communications; and
• comply with law, enforce our Terms, and establish or defend legal claims.

Where applicable, we rely on performance of a contract, compliance with legal obligations, legitimate business interests, and consent. When we process workforce data for a customer, we do so under that customer's instructions and the customer is responsible for its lawful basis.

We may disclose personal data only as needed to:

• your organisation: authorised owners, administrators, managers, approvers, and employees according to their configured permissions;
• service providers: infrastructure, database, caching, email delivery (including Resend), payment processing (Stripe), performance monitoring, and security providers that help us operate the Service;
• professional advisers and authorities: auditors, insurers, lawyers, courts, regulators, or law enforcement where reasonably necessary or legally required; and
• business successors: a buyer or successor involved in a merger, financing, reorganisation, or sale, subject to appropriate confidentiality protections.

We do not sell personal data, use workforce records for targeted advertising, or disclose them to unrelated third parties for their own marketing.

MiniPeople uses cookies and similar browser storage that are necessary to keep users signed in, protect account sessions, remember interface preferences, and maintain security. Session cookies may be refreshed while an account remains active and expire according to our authentication settings or when removed from your browser.

We may also collect limited performance and diagnostic measurements to understand whether pages load and operate correctly. We do not use third-party advertising cookies. You can block or delete cookies in your browser, but necessary Service features may then stop working.

Some providers may process data in countries outside Malaysia. When personal data is transferred internationally, we take reasonable steps required by applicable law to ensure an appropriate level of protection, such as reviewing the destination's protections and using contractual, organisational, or technical safeguards.

A customer that chooses to access or use the Service from another country is responsible for its own cross-border transfer obligations for workforce data it controls.

We retain personal data for as long as an account or customer relationship remains active and as needed to provide the Service. After closure or a valid deletion instruction, we delete or anonymise data within a reasonable period, subject to backup cycles, fraud prevention, dispute resolution, financial recordkeeping, and other legal obligations.

Customers determine retention periods for the workforce records they control. Account deletion may not remove records that an employer must retain or that remain in another authorised user's organisation workspace.

We use reasonable administrative, technical, and organisational safeguards designed to protect personal data, including access controls, role-based permissions, session protection, and service monitoring. Customers are responsible for assigning appropriate permissions and protecting their login credentials and devices.

No online service is completely secure. If a personal data breach occurs, we will investigate, contain, and make notifications to affected customers, individuals, or regulators where required by applicable law.

Subject to applicable law and relevant exceptions, you may request access to or correction of your personal data, withdraw consent where processing relies on consent, object to direct marketing, ask about our processing, or request deletion or restriction. You may also have portability or objection rights under the law that applies where you live.

For workforce data, submit your request to your employer. For MiniPeople account, billing, or website data, email privacy@minipeople.app. We may need to verify your identity and authority before responding. You may also complain to Malaysia's Personal Data Protection Commissioner or your local data protection authority.

MiniPeople is a business HR service and is not directed to children. Account holders must be at least 18 years old or the age of legal majority where they live. Customers must not add a minor's data unless it is lawful and genuinely necessary for an employment or HR purpose.

We may update this Privacy Policy to reflect changes to the Service, our practices, or the law. We will post the revised version here, update the date above, and provide additional notice when a change materially affects your rights or our use of personal data.

For privacy questions, rights requests, or complaints, contact the operator of MiniPeople at privacy@minipeople.app. For the fastest response, include the email address associated with your account and the organisation concerned, but do not email passwords, full payroll records, or other unnecessary sensitive information.

If your request concerns data controlled by your employer, we may refer the request to that employer for handling.