Privacy Policy

Last updated: 3 November 2026

1. Who we are

EzHRai (www.ezhrai.com, and the EzHRai apps for Android and iOS) is an HR, payroll and attendance system operated by Raudhah Tech Sdn Bhd (Registration No. 201301019050 (1048880-D)), Jalan SP10/1, Selangor Cyber Valley, 63000 Cyberjaya, Selangor, Malaysia (" EzHRai ", " we ", " us ").

EzHRai is used by employers (" your employer " or " the company ") to manage their staff. This policy explains what personal data EzHRai handles, why, who it is shared with, and the choices you have.

2. Your employer and us

For staff records (your profile, salary, attendance, leave, claims and documents), your employer decides what is collected and why. Under Malaysia's Personal Data Protection Act 2010 (PDPA), your employer is the data user , and EzHRai processes that data on your employer's behalf as a data processor .

For our own customers (company accounts, billing contacts) and for visitors to our website, EzHRai is the data user .

If you have a question about your staff record, such as why something is recorded or how to correct it, please start with your employer's HR team. We will help them answer you.

3. What we collect

Depending on which features your employer uses:

Type Examples

Account Name, work email, phone number, password (stored only as a one-way hash), or Google sign-in if you choose it

Employment Employee number, job title, branch, department, manager, hire date, probation, contract and leaving dates, letters issued

Identity MyKad / passport number, nationality, date of birth, work permit details. MyKad and passport numbers are stored encrypted

Pay and statutory Salary and allowances, bank account (stored encrypted), EPF, SOCSO, EIS and income tax numbers, PCB, zakat, PTPTN deductions, payslips, EA forms

Family Spouse and children details, where your employer uses them for tax relief or benefits

Attendance Clock-in and clock-out times, your location at the moment you clock in or out , and a selfie photo at clock-in if your employer turns this on; shifts and overtime

Leave and medical Leave requests and balances, medical certificates you upload

Claims Claim amounts, receipts you upload, panel clinic used

Performance and conduct Goals, reviews, training records, certificates, disciplinary records

Recruitment CVs and application details, if your employer recruits through EzHRai

Device and technical Device type, app version, a notification token so we can send you alerts, IP address and security logs

Sensitive personal data. Some of this is classed as sensitive under the PDPA: medical certificates (physical health) and religion , where a zakat deduction is recorded. It is collected only for leave, claims and payroll, and only with the consent your employer obtains from you.

What we do not do. We do not track your location in the background or outside clock-in and clock-out. We do not use face recognition on selfies. We do not show advertising inside the EzHRai app. We do not sell personal data or use it for marketing on behalf of others.

Website visitors. On our public website (not inside the EzHRai app), and only if you click Accept on the cookie banner, we use Google Analytics, Meta Pixel and TikTok Pixel to measure visits and sign-ups and to show EzHRai ads to people who may be interested. These tools receive your device and browser details, IP address, the pages you visit and whether you signed up. They do not receive your name, email, phone number, or any staff or payroll data. If you click Decline, none of them are loaded. You can change your choice at any time through Cookie settings at the bottom of the website.

4. Phone permissions (EzHRai app)

Permission Used for If you decline

Location Confirming you are at your workplace when you clock in or out Clocking in on the phone may not be available; your HR team can record attendance instead

Camera Clock-in selfie; photographing receipts and medical certificates You can upload a file instead, where the feature allows

Photos / files Attaching receipts, MCs and documents You cannot attach from your gallery

Notifications Approvals, payslip ready, leave decisions, expiry reminders You still see all notices inside the app

You can change these at any time in your phone's settings.

5. Why we use it

To run HR for your employer: records, attendance, shifts, leave, claims, approvals, letters and documents.

To calculate and pay salaries and make statutory contributions and filings (EPF, SOCSO, EIS, LHDN, HRDF, zakat, PTPTN).

To notify you and your managers of things that need action.

To keep EzHRai secure, prevent misuse, and fix problems.

To meet legal obligations, such as keeping employment and tax records.

6. AI features

Some EzHRai features use an AI model to help HR, for example:

the HR assistant

reading the details from a receipt

shortlisting CVs

drafting performance notes

suggesting rosters

flagging overtime risk

When one of these is used, the data needed for that task is sent to our AI provider, Anthropic (United States). Anthropic processes it to return a result, under terms that do not allow it to use the data to train its models. AI output is a suggestion: a person at your employer makes the decision.

7. Who we share it with

Within your employer. Only people your employer authorises can see your record, according to their role. For example, a manager sees their own team; HR sees the company.

Within a group of companies. If your employer belongs to a group that uses EzHRai's group features, the group's HR administrators can work across the group's companies. When you transfer between them, your service record moves with you.

Service providers. We share data only with the providers below, only for running EzHRai, and under contract:

Provider What for Where

Supabase Database, file storage, sign-in Tokyo, Japan

Cloudflare Website hosting, security and bot protection Global network

Postmark Sending email (e.g. payslip ready, approvals) United States

Google Firebase Cloud Messaging Delivering phone notifications Global

Anthropic AI features (section 6) United States

Google Optional "Sign in with Google" Global

Stripe, PayPal, Wise, Payoneer Only if your employer uses EzHRai to pay salaries or pay its EzHRai subscription Varies by provider

OpenStreetMap Map tiles shown when HR draws a workplace boundary (your IP address is visible to the map server) Global

RaudhahPay (Raudhah Tech Sdn Bhd) and its card partner CHIP Subscription payments: name, email, amount and bill reference Malaysia

Google (Analytics) Website visit measurement, only after Accept on the cookie banner United States

Meta Website ads measurement, only after Accept on the cookie banner United States

TikTok Website ads measurement, only after Accept on the cookie banner Singapore, Malaysia, United States

Referral rewards (EzMarket), only if you opt in. If a company owner chooses to join EzHRai Refer & Earn and ticks the consent box, we share with EzMarket (ezmarket.live), operated by Raudhah Tech Sdn Bhd: the owner's name, email and Malaysian phone number, the company name, the referral code of the person who invited them, and a record of the consent (date and notice version). EzMarket opens an EzMarket account and rewards wallet in the owner's name. Each time the company's subscription payment clears, we send EzMarket the owner's EzMarket member ID, the payment amount and the payment reference, and the EzMarket member IDs of the people who invited the company, so EzMarket can calculate referral rewards (ganjaran). Rewards from the company's payments go to the owner's EzHRai inviter if that person is in Refer & Earn; otherwise they follow the owner's EzMarket network. We never share staff records with EzMarket. EzMarket uses this data under its own terms and privacy policy. You can stop taking part at any time by emailing admin@ezhrai.com ; we then stop sending your details and payments to EzMarket. Your EzMarket account itself is closed through EzMarket. If you do not opt in, nothing is shared with EzMarket.

Authorities. Your employer submits statutory data to bodies such as KWSP, PERKESO, LHDN and HRD Corp. We disclose data to others only where the law requires it, such as a court order.

8. Data stored outside Malaysia

EzHRai's database is hosted in Japan , and some providers above are in the United States or operate globally. We transfer personal data outside Malaysia only as section 129 of the PDPA allows, to providers bound by contract to protect it to a standard at least equivalent to the PDPA. If you join Refer & Earn, your details are also held by EzMarket in Singapore.

9. How we protect it

Encrypted connections (HTTPS/TLS) for all traffic. Data at rest is encrypted by our hosting provider.

MyKad / passport numbers and bank account numbers are additionally encrypted inside the database. Every time one is decrypted, the access is logged.

Each company's data is separated from every other company's at the database level.

Access by role, with approval workflows for sensitive actions.

An audit log of changes to key records.

Paid payroll runs cannot be altered afterwards.

If a personal data breach occurs, we will notify the affected employer without undue delay, and the Personal Data Protection Commissioner and affected individuals where the PDPA requires it.

10. How long we keep it

We keep your record for as long as your employer uses EzHRai, and afterwards for as long as the law requires employers to keep employment, payroll and tax records. In general we keep these records for 7 years after the end of the year they relate to, in line with the Income Tax Act 1967 (section 82).

Your employer sets a retention period for former staff (24 months after leaving by default). After that, EzHRai can anonymise the record: names and identifiers are removed, and payroll totals required for audit are kept.

When a company stops using EzHRai, we return or delete its data as agreed in its contract with us, except where the law requires it to be kept.

11. Deleting your account

You can delete your EzHRai login yourself in the EzHRai app ( Profile → Delete account ), or ask us to do it at any time at admin@ezhrai.com . Deleting your login:

removes your sign-in and the notification tokens on your devices, so you can no longer log in;

does not delete the employment, payroll and tax records your employer must keep by law. Those remain with your employer and are anonymised after the retention period above.

To ask for those records to be deleted or corrected, contact your employer's HR team, or email us at admin@ezhrai.com and we will pass your request to your employer.

12. Your rights

Under the PDPA you can:

access the personal data held about you, and get a copy;

correct data that is inaccurate, incomplete or out of date. Many details can be updated directly in the app, subject to HR approval;

withdraw consent to processing that is based on consent, such as the clock-in selfie. This may mean a feature is no longer available to you;

limit processing for direct marketing. EzHRai does not use your data for direct marketing.

Send requests to your employer's HR team, or to us at admin@ezhrai.com . We respond within 21 days, as the PDPA requires. You may also complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) .

13. Children

EzHRai is a workplace system for employees and is not intended for children. Where an employer employs a young person, the employer is responsible for any consent the law requires.

14. Changes to this policy

We will update this page when our practices or the law change, and change the "Last updated" date. Significant changes will also be shown to company administrators in EzHRai.

15. Contact

Data Protection Officer

Raudhah Tech Sdn Bhd (201301019050 (1048880-D))

Jalan SP10/1, Selangor Cyber Valley, 63000 Cyberjaya, Selangor, Malaysia

Email: admin@ezhrai.com

This policy is provided in English and Bahasa Malaysia. If the two versions differ, the English version prevails.