Privacy Policy

Who we are and how to contact us

This policy is issued by Simplify Standards Sdn. Bhd. (company registration number 201701036149 / 1250320-H), a company incorporated in Malaysia. We are the controller of the personal data described here.

Registered office: A-5-9, Level 5, Block A, Empire Tower, Jalan SS16/1, SS 16, 47500 Subang Jaya, Selangor, Malaysia.

Corporate enquiries: contact@madebysimplify.com. StockZip support and privacy requests: contact@stockzip.app. Telephone: +60 19-281 9381. Office hours are 9:00 to 18:00, Monday to Friday, Malaysia Standard Time (GMT+8).

Data-protection requests should be sent to contact@stockzip.app, which is the monitored channel for access, correction, deletion and portability requests under this policy.

Scope of this policy

This policy covers the madebysimplify.com website and the software products operated by Simplify Standards Sdn. Bhd., including StockZip and its mobile applications.

Where a product has its own supplementary notice, that notice applies in addition to this policy.

• StockZip — web application and iOS / Android apps
• InControl — document control system
• Stockzip Works — maintenance management
• The madebysimplify.com corporate website

Information you provide to us

We collect the information you give us directly — when you enquire through this website, create an account, contact support, or use our products.

• Name and job role
• Work email address and telephone number
• Company or organisation name
• The content of your enquiry or support message
• Any files or screenshots you send us in support of a request

Account and authentication data

To operate an account we process your email address, a securely hashed password or third-party sign-in identifier, your role within your organisation, and records of sign-in activity needed to keep the account secure.

We do not store your password in a readable form.

Inventory and business records

When you use StockZip, the records you create — items, quantities, locations, folders, custom fields, movements and activity history — are your organisation’s business data. We process it in order to provide the service to you.

We do not sell it, and we do not use it to build profiles of you or your business for any other purpose.

Device, diagnostic and usage information

To keep the applications working we process technical information such as device type and operating system version, application version, language and region settings, crash reports and error diagnostics, and basic usage events that tell us which features are being used.

Crash reports and error diagnostics are processed by Sentry. The madebysimplify.com website uses Cloudflare Web Analytics, which is cookieless and does not identify individual visitors or track them across other websites.

We do not use advertising networks, cross-site tracking, or third-party product-analytics services. Crash and error diagnostics are needed to keep the products working and cannot be turned off separately, but they are never used for advertising or profiling.

Photos, camera, barcode and QR-code access

StockZip asks for camera access so you can scan barcodes and QR codes and attach photographs to items. Scanning happens on your device; the camera feed itself is not recorded or transmitted.

Photographs you choose to attach to an item are uploaded and stored as part of your organisation’s records. You can delete them from within the app.

You can withdraw camera or photo-library permission at any time in your device settings; the affected features will then stop working.

Notifications

If you enable notifications, we process a device push token in order to send operational alerts such as low-stock notices and work-order assignments. You can turn notifications off in the app or in your device settings.

Subscription and payment processing

Paid subscriptions are processed by a third-party payment provider. We receive confirmation of the transaction, the plan purchased and the billing contact details needed to issue an invoice. We do not receive or store your full card number.

Subscriptions bought directly from us are processed by Stripe, which handles card details on our behalf. Invoices are issued by Simplify Standards Sdn. Bhd. and show Stripe as the payment processor. We receive the last four digits and card brand for reconciliation, never the full card number.

Purchases made through the Apple App Store or Google Play are processed by Apple or Google under their own terms and privacy policies.

Why we process your information

We process personal data in order to:

• Provide, operate and maintain the products you use
• Authenticate you and keep your account secure
• Respond to enquiries and provide support
• Issue invoices and administer subscriptions
• Diagnose faults and improve reliability and usability
• Send service and security notices relating to your account
• Comply with legal, regulatory and tax obligations

Service providers and other recipients

We use a small number of service providers to operate our products — for example cloud hosting, file and image storage, transactional email, error monitoring and payment processing. They act on our instructions and are permitted to use the data only to provide their service to us.

We do not sell personal data, and we do not share it for advertising purposes.

Each provider processes data only on our instructions, under a written data-processing agreement. The providers we rely on are listed below.

• Supabase — database, authentication and file storage
• netcup GmbH — application hosting
• PowerSync — offline synchronisation, running on our own hosting
• Cloudflare — DNS, content delivery, security filtering and cookieless website analytics
• Sentry — error and crash monitoring
• Stripe — payment processing for direct subscriptions
• Resend — transactional email such as sign-in links and account notices
• Apple and Google — app distribution and in-app purchases

International data processing

Simplify Standards is incorporated in Malaysia, but our production systems run in the United States. Your account data, business records and uploaded files are stored and processed there, not in Malaysia.

We rely on this transfer because it is necessary to perform the contract with you — to provide the product you have signed up for — and each provider is engaged under a written data-processing agreement that requires them to protect the data to the standard set out in this policy and to process it only on our instructions.

If you would like to know more about the safeguards that apply to a particular provider, contact us at contact@stockzip.app.

Security

We restrict access to production systems to the people who need it, use role-based permissions inside our products, and keep our platform dependencies patched.

Data is encrypted in transit using TLS, and encrypted at rest by our database and storage provider. Backups are taken automatically on a rolling cycle and are themselves encrypted; older backups age out within 35 days.

We do not currently hold ISO 27001, SOC 2 or any equivalent third-party security certification, and we do not claim to. We say so plainly rather than implying an assurance we have not been audited against.

No system can be guaranteed absolutely secure. If a breach affecting your personal data occurs, we will act on it and notify the Personal Data Protection Commissioner and affected users as required by law.

How long we keep information

We keep your account and its records for as long as your account is active. After a verified deletion request, or after an account has been closed, the periods below apply.

Billing and accounting records are kept for seven years because Malaysian law requires it — section 245(2) of the Companies Act 2016 and section 82 of the Income Tax Act 1967. These are financial records: invoices, payment references and the company details on them. They are not your inventory data.

• Account, profile and business records — removed from production systems within 30 days
• Backups containing deleted data — aged out within 35 days
• Crash reports and error diagnostics — 90 days
• Support correspondence — 24 months
• Billing, invoice and accounting records — 7 years, as required by Malaysian law

Your rights

Subject to the law that applies to you, you may ask us to give you access to the personal data we hold about you, correct it if it is inaccurate, delete it, restrict or object to certain processing, or provide it in a portable form.

Our processing is governed by the Malaysian Personal Data Protection Act 2010, as amended. Where the law of your own country gives you broader rights, we will honour those too.

To exercise any of these rights, email contact@stockzip.app from the address associated with your account. We may need to verify your identity first. We respond within 21 days; if a request is complex and we need longer, we will tell you why before that period runs out.

If you are not satisfied with how we have handled a request, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) in Malaysia.

Withdrawing consent

Where we rely on your consent — for example for notifications, camera access, or marketing email — you can withdraw it at any time in the app, in your device settings, or by contacting us. Withdrawing consent does not affect processing that already took place, and some features will stop working without the permission they depend on.

Account and data deletion

You can request deletion of your account and its data at any time. The process, what is deleted and what may have to be retained are set out on our Data and Account Deletion page.

Children’s privacy

Our products are business tools intended for use by organisations and their staff. They are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as our products and obligations change. The current version and its date appear at the top of this page. Where a change materially affects you, we will give notice through the product or by email before it takes effect.

Contact

Simplify Standards Sdn. Bhd., company registration number 201701036149 (1250320-H). A-5-9, Level 5, Block A, Empire Tower, Jalan SS16/1, SS 16, 47500 Subang Jaya, Selangor, Malaysia.

Privacy and data requests: contact@stockzip.app. Corporate enquiries: contact@madebysimplify.com. Telephone: +60 19-281 9381.