Privacy Policy

01Introduction

TecerTools ("we", "us", "the app") is a teacher task-management platform for teachers in Malaysia. This Privacy Policy covers three parts of the service: (a) the TecerTools web application used by teachers, (b) the Parent Portal that lets parents/guardians view their child’s records, and (c) Kertas (kertas.tecertools.my), the question bank and exam-paper and worksheet builder that uses the same TecerTools account.

The data controller responsible for your personal data is TECERTOOLS DIGITAL SOLUTION (address: Indahria Apartment, Persiaran Teknologi Subang, Seksyen 22, 40300 Shah Alam, Selangor), the operator of TecerTools. Please contact us at the address in the final section of this policy for any privacy-related questions.

This policy is prepared in accordance with Malaysia’s Personal Data Protection Act 2010 (PDPA) and its 2024 amendments now in force, including the requirements on data breach notification, data portability, and a Data Protection Officer. Read Act 709 on pdp.gov.my

02Data we collect

(a) Teacher account data. When you register and use the app, we collect:

• Your name, email address, and (if you sign in with Google) your Google display name and profile photo
• Teacher profile details: school, subjects, classes, and schedule settings
• In-app activity records such as error logs for maintenance purposes

(b) Student and parent data entered by teachers. As part of your official duties, the app stores data you enter about students:

• Student names and identity card (IC) numbers
• Marks, grades, mastery levels (PBD / classroom assessment), attendance records, observations, and character tokens
• Assignment or project evidence (including photos) that is uploaded
• Parent/guardian contact numbers recorded for class communication

Some of this data concerns children (minors) and IC numbers, which we treat as sensitive and protect with additional safeguards.

(c) Parent Portal data. When a parent/guardian accesses the portal, we process the class code entered, part of an IC number to verify the child’s identity, an anonymous session created for access, and any evidence uploaded by the parent. Parents can also read the support updates a teacher chooses to publish about their own child only, and open the attachments the teacher added to that update; each time an update or attachment is opened, an access record is made. Parents do not need to create an account.

(d) Kertas and the other free apps. Kertas stores the question banks, exam papers and worksheets that teachers create, first in the browser and, when the teacher is signed in, synced to the teacher’s account on TecerTools’ servers. A teacher can share a question bank with another teacher; only a bank that is shared can be seen by that teacher. Kertas has no sign-in form of its own; the teacher’s session is handed over from the web app. Figura, Geometrik and Safari Senyap need no account and do not send your content to TecerTools’ servers; Safari Senyap analyses sound in the browser and does not record audio.

(e) Intervention plans. In Student Analytics, a teacher can prepare a support plan for pupils: the pupil’s need and baseline, targets, targeted SP, the activities planned and delivered, repeated observations, reviews and their outcomes, and printed or exported reports. These are a teacher’s professional notes about children, so teachers are advised to write only what relates to learning, attendance and classroom behaviour, and not to write diagnoses or health information. A teacher can also keep resources for a plan: web links and files (PDF, images, DOCX, XLSX, PPTX, up to 10 MB each). Files are stored privately and only the owning teacher can open them; file type and size are checked and image metadata is removed, but files are not scanned for viruses. Resources are internal by default: a parent can open only a file the teacher attached to an update the teacher published, and only if the file is tied to their own child or the teacher has confirmed it holds no pupil information. Teachers should not upload files that show other pupils.

(f) Usage statistics, errors and problem reports. To improve the app, we record which screens and features you use, linked to your account: page names (without record IDs or access codes), specific buttons pressed (only a button code, never its text), page load times, response times of calls to the server, device and browser type, and the app version. Typed text, pupil names, IC numbers and screen content are not recorded, and there is no screen recording. When an error occurs, the app stores the error message cleaned of e-mail addresses, IC numbers, phone numbers and IDs, the current page, the version, the browser and device type, and a few last steps (button codes and page names only). You can also send a problem report in your own words (up to 1,000 characters; do not write pupil names); if you tick “you may contact me”, we may reply to your account e-mail. No screenshot is sent. You can switch off usage recording in Settings > Privacy at any time.

03Purposes of processing

We process personal data only for the following purposes, in line with the PDPA’s Notice & Choice and Purpose principles:

• Providing the app’s core functions: class management, scheduling, assessment, attendance, and reporting
• Authenticating users and maintaining a secure signed-in session
• Allowing parents/guardians to view their child’s performance records via the Parent Portal
• Letting teachers plan, deliver and review extra support for pupils (intervention plans), and share the updates the teacher chooses with that pupil’s parents
• Maintaining, debugging, and improving the security and reliability of the service
• Understanding which features are used, finding and fixing errors, monitoring the performance and availability of the service, and replying to problem reports you send

We do not sell your personal data, do not display advertising, and do not use your data for third-party marketing.

04Legal basis & consent

Teachers enter student data in the course of their official duties as educators. Teachers are responsible for ensuring the collection of student data complies with school and Ministry of Education Malaysia policies. For the Parent Portal, parents/guardians provide consent by accessing the portal and verifying their child’s identity.

You may withdraw consent at any time by contacting us, although this may limit your ability to use parts of the service.

05Sharing & data processors

Your account, student and school data is stored and processed on TecerTools’ own servers (a self-hosted Supabase database) in Kulai, Johor, Malaysia. We use only the following limited third-party processors, each for the stated purpose:

• AI providers — OpenAI (United States) as the primary provider, and DeepSeek (China) only as a fallback for text tasks when OpenAI is unavailable; image generation uses OpenAI only. We do not store AI requests in our OpenAI dashboard, but the provider may keep API requests for up to 30 days for abuse monitoring before deleting them. You review every AI result; AI does not decide TP, grades or any action about a pupil. The features that use AI and what is sent: (1) Generating RPH: the subject, class name, number of pupils and the RPT details for that lesson (topic, SK and SP); pupil names, IC numbers and records are not sent. (2) Reading RPT documents or school RPH forms, and RPT photos or scanned PDFs, that you upload, and reading a photo of a calendar or timetable: the file is sent to the provider in full, so do not include pupils’ personal data in it. (3) Worksheets in Kertas (Professional plan): only selected educational fields such as subject, level, topic, SK/SP and objectives, plus the teacher’s choices; reflections, pupil attendance and teacher or school details are not sent. (4) AI pictures for worksheets: only a single word, a motif or a short scene description; generated pictures are kept in a shared library by keyword, with no personal data. (5) Intervention plan suggestions (Professional plan): AI can suggest a draft plan, adapt one activity, or summarise a review. Pupils are represented by invented labels such as "Murid A", "Murid B"; names, IC numbers, contact numbers, attachments and files are not sent. What is sent is the level, subject, category, the chosen SP and the text the teacher types in the plan (need, target, baseline, review outcomes), plus session counts and observation scores; so do not type pupil names, IC numbers or health information in that text. AI does not state a cause or diagnosis about a pupil and does not make decisions; a suggestion is used only when the teacher presses the button to use it. The name-matching feature of the Kehadiran Chrome extension uses the same providers, as stated in the Kehadiran Privacy Policy. Google Gemini is not used.
• Google Analytics 4 — app usage statistics: page paths (without record IDs or access codes), setup and guide steps completed, and error types. Names, IC numbers, error text and pupil data are not sent, and this data is not used for advertising.
• Stripe — subscription payments. Card details are handled by Stripe and are not stored by us.
• Cloudflare — delivering the tecertools.my website.

Cross-border transfer: the processors above (notably the AI provider and Stripe) may process data outside Malaysia. We take reasonable steps to ensure the data is protected to a standard comparable with the PDPA during such transfers.

We do not share personal data with any third parties other than those listed above, except where required by law or a valid court order.

06Storage & retention

• Student data (names, IC, marks, attendance, PBD, evidence) is kept while the class or pupil is active in the teacher’s account. Archived classes and pupils are deleted automatically two years after archiving, and all data (including evidence photos) is deleted when the teacher deletes their account.
• Intervention plans (including observations, reviews and resources) are kept while the related class or pupil is active in the teacher’s account. A teacher can delete a resource or plan at any time; files that are deleted, or whose plan, pupil, class or account is deleted, are removed from storage by an automatic cleanup. When a plan has been closed for over a year and still holds files, the app reminds the teacher to review and delete files that are no longer needed; files are not deleted without the teacher’s action unless the plan, pupil, class or account is deleted. An update published to parents stays until the teacher withdraws it (it is then hidden from parents) or until the pupil, class or account is deleted.
• Usage statistics linked to your account and problem reports are kept for 13 months (anonymous daily summaries may be kept longer); server-call timing data is kept for 30 days; all of it is deleted with the teacher account.
• Application error logs are kept for 90 days; Parent Portal access logs (including when an update or attachment is opened) are kept for one year.
• Teacher account data is retained while your account is active, and deleted when you request account deletion.
• Anonymous parent sessions are temporary and are not linked to a permanent account.

07Security

We protect data with technical measures including database row-level security that restricts access to the data owner (the authenticated teacher) only, email verification for teacher accounts, parent access through anonymous sessions with IC verification, encrypted data transmission (HTTPS), and private file storage with no direct access from the browser: a file is opened through a temporary link that is valid for only a few seconds after an access check. No system is entirely risk-free, however; we encourage you to keep your sign-in details confidential.

08Your rights

Under the PDPA, you have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Withdraw consent and request deletion of data
• Request data portability (transfer of your data in a readable format) in line with the PDPA 2024 amendments

To exercise any of these rights, contact us at the address in the final section of this policy.

09Data breach notification

In line with the PDPA 2024 amendments, in the event of a personal data breach that may cause significant harm, we will notify the Personal Data Protection Commissioner and, where required, affected individuals, within the timeframe set by law.

10Contact us about personal data

For any questions, access/correction requests, or complaints regarding your personal data, please contact TECERTOOLS DIGITAL SOLUTION at: tecertools@gmail.com

11Changes to this policy

If this policy changes, the "Last updated" date above will be revised. Material changes will be shown here before they take effect.