1. Who we are
TeraFix is a shop management system for phone and gadget repair shops, available at terafix.my. TeraFix is operated by OTG MOBILE (registration no. 202503337018 (SA0646979-P)), a sole proprietorship registered in Malaysia (“TeraFix”, “we”, “us”).
This policy explains what personal data we collect, why, who we share it with, and the choices you have. It follows the Personal Data Protection Act 2010 (PDPA), as amended in 2024.
Privacy questions and requests: support@terafix.my (write “Privacy” in the subject so it goes to our Data Protection Officer) · General enquiries: info@terafix.my We handle all privacy requests by email. We do not accept requests by post at this time.
2. Two kinds of data, two roles
Data about you, our customer. When you sign up, use TeraFix, visit our website or contact us, we decide how that data is used. For this data we are the data controller.
Data your shop keeps in TeraFix. Your shop enters data about its own customers: names, phone numbers, devices, repairs, invoices and photos. Your shop decides what to collect and why, so your shop is the data controller and TeraFix is the data processor. We only process that data to run TeraFix for your shop, as set out in our Terms of Service.
If you are a customer of a repair shop that uses TeraFix, please contact that shop first about your data. We will help the shop answer your request.
3. Personal data we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, phone number, password (stored only as a secure hash), role in the shop | You, or the owner who invited you |
| Google sign-in | Name, email address and profile picture from your Google account | Google, when you choose “Continue with Google” |
| Shop details | Shop name, address, WhatsApp number, logo, SSM number, SST number, and later TIN for e-Invoice | You |
| Billing | Plan, billing history, card brand, last 4 digits and expiry. Full card numbers are held by Stripe, never by us | You and Stripe |
| Usage and device | IP address, browser and device type, pages and features used, error logs, and a record of important actions in your account (audit log) | Automatically, when you use TeraFix |
| Support | Messages, call notes and screenshots you send us on WhatsApp or email | You |
| Website visitors | Pages viewed, how you found us, and ad clicks, only if you accept measurement cookies | Cookies (see our Cookie Policy) |
| Leads | Name, shop name, phone and email when you ask for a demo or updates | You |
We do not ask for sensitive personal data, such as health, religious or political information. We ask shops not to store more about their customers than a repair needs. For example, an identity card number should only be recorded when the shop has a real need for it.
4. Why we use it
- To create and secure your account, and to let you log in.
- To run TeraFix for your shop: jobsheets, stock, invoices, reports, commission, and WhatsApp links.
- To bill your subscription and keep payment and tax records.
- To send service emails: verification codes, password resets, invoices, plan limit warnings, and important changes.
- To give support and on-site setup.
- To keep TeraFix safe: detect fraud and abuse, fix errors, and investigate security incidents.
- To improve TeraFix, using usage statistics.
- To send marketing news, only if you agree. You can stop it at any time with the unsubscribe link or by telling us. Marketing emails come from marketing@terafix.my, and our newsletter from info@terafix.my.
- To meet legal duties, such as tax and accounting record keeping, or a lawful request from an authority.
5. Consent and what is required
By creating an account you agree to us using your personal data as this policy describes. Marketing and measurement cookies are separate choices that you can say no to without losing access to TeraFix.
Your email address and a password (or Google sign-in) are required to create an account. Without them we cannot give you an account. Other details, such as a logo or SST number, are optional, though some features need them.
You may withdraw consent at any time by emailing support@terafix.my. If you withdraw consent that TeraFix needs to work, we may have to close your account.
6. Who we share it with
We do not sell personal data. We share it only with service providers that help us run TeraFix, and only as much as they need:
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Supabase | Database, login and file storage | Singapore |
| Cloudflare | Website hosting, security and speed | Global network |
| Stripe | Subscription payments | Global, including the United States |
| Resend | Sending service emails | United States |
| Sign-in with Google, and Google Analytics if you accept | Global | |
| Meta | Measuring our ads, if you accept | Global |
| Bukku | Accounting sync, only if your shop connects it | Malaysia |
| Our AI provider, named here before any AI feature launches | AI features, only the text or files you send to them | Outside Malaysia |
| LHDN MyInvois | e-Invoice submission, when this feature launches and your shop turns it on | Malaysia |
WhatsApp: TeraFix creates message links that open your own WhatsApp. Messages are sent from your WhatsApp account, under WhatsApp’s own terms.
We may also disclose data when the law requires it, to protect people or our rights, or to a buyer if our business is sold. A buyer would have to keep this policy’s protections.
7. Transfers outside Malaysia
Our main database and files are stored in Singapore, and some providers above process data in other countries. We transfer data outside Malaysia only under the conditions in section 129 of the PDPA: mainly where the transfer is needed to provide TeraFix to you, and to providers that keep security measures and contractual commitments that protect your data to a standard similar to the PDPA. We keep records of these transfers.
8. How we protect it
- All connections use encryption (HTTPS/TLS). Our providers encrypt stored data.
- Each shop can only see its own records. This is enforced in the database itself, not only in the app.
- Our staff access is limited to what the job needs, protected by multi-factor authentication, and logged.
- Daily backups, and a record of important changes in each account.
- We review our security regularly and fix issues found by our checks.
No system is perfectly secure. If you think your account is at risk, change your password and tell us at once.
9. If a breach happens
If a personal data breach causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner no later than 72 hours after we become aware of it, and the affected individuals within 7 days after notifying the Commissioner, as the PDPA requires. If the breach affects data your shop keeps in TeraFix, we will tell your shop without undue delay and help it meet its own duties.
10. How long we keep it
| Data | How long |
|---|---|
| Account and shop details | While your account is open. After closure, as below |
| Business records: invoices, receipts, payments, jobsheets, accounting entries | 7 years after the end of the financial year they relate to, as Malaysian tax and company law requires. Read-only, and exportable by the shop. |
| Billing records | 7 years |
| Security and usage logs | Up to 12 months |
| Backups | Rolling 30 days, then overwritten |
| Leads and marketing list | Until you unsubscribe, or 2 years after our last contact |
| Support messages | Up to 3 years |
When data is no longer needed we delete it or make it anonymous.
11. Your rights
You can ask us to:
- Access the personal data we hold about you.
- Correct data that is wrong, incomplete or out of date. Most details you can change yourself in Settings.
- Withdraw consent, or stop direct marketing.
- Port your data: get it in a common format, or have it sent to another provider where technically possible. Shops can also export their records to Excel or CSV at any time.
- Complain: to us first, and to the Personal Data Protection Commissioner if you are not satisfied.
Email support@terafix.my from the address on your account. We will reply within 21 days. We do not charge for requests. We may ask you to confirm who you are before we act.
12. Children
TeraFix is for businesses. You must be 18 or older to open an account. Shops may record customers who are under 18 as part of a repair, under the shop’s own responsibility.
13. Changes to this policy
If we make an important change, we will tell you by email or in the app at least 14 days before it takes effect. The date at the top shows the latest version.
14. Language
This policy is available in Bahasa Melayu and English. If the two versions differ, the English version applies.