Privacy Policy

This platform is operated by IKRAM Muda, a Malaysian Islamic youth movement, together with IKRAM Teens (collectively, “IKRAM Muda,” “we,” “us”). We use this platform to register members, run programs, collect feedback, accept program-related payments, and communicate with participants and their guardians.

This policy explains what personal data we collect, why, where it is stored, who we share it with, and the rights you have under the Malaysian Personal Data Protection Act 2010 (PDPA).

• Members and volunteers (aged 13 and above) who register for IKRAM Muda or IKRAM Teens programs.
• Minors aged 13–17 registered through IKRAM Teens. For minors, a parent or guardian must provide consent and may register the minor on their own phone number. See Section 4.
• Guardians and parents whose contact details we hold so we can reach minors enrolled with us.
• Survey, feedback and check-in respondents who engage with our public links (e.g. /feedback/…, /checkin/…, /v/…, /p/…).
• Customers of the IKRAM Muda store / claims flow who place orders or submit claims.

The data we collect depends on how you engage with us:

• Identity: name, date of birth, gender, IC number (only if you choose to provide it).
• Contact: phone number, email address, address, state (negeri), and kawasan.
• Membership: peringkat / tier, level, agency (Muda or Teens), referral source, organisational notes added by our administrators.
• Guardian relationship: for minors, the linked guardian member record. Phone numbers may be shared between a guardian and their child by design.
• Program participation: registrations, attendance, check-ins, custom-field answers configured by program organisers.
• Survey & feedback responses: your answers, and the name and phone you choose to give with the response.
• Volunteer applications: the information you submit on the volunteer form for a specific program.
• Store / claims: customer name, phone, email (optional), order details, claim photos and descriptions.
• Payments: the bill reference we create with our payment provider, the payment status it reports back, and the amount. We do not collect or store your card or banking details — these are handled directly by Billplz.
• Communication preferences: separate opt-ins for WhatsApp, SMS and email.
• Authentication & technical: session cookies (for administrators who log in), IP address and basic device information in server logs, and error diagnostics. We do not use advertising identifiers and we do not place tracking pixels for third-party advertisers.

IKRAM Teens serves participants aged 13–17. For anyone under 18, we rely on the consent of a parent or guardian. By registering a minor — whether on the minor’s own phone or on the guardian’s phone — the guardian confirms that they:

• have read this policy on behalf of the minor;
• consent to IKRAM Muda collecting and processing the minor’s data as described here;
• consent to us contacting the minor and/or the guardian through the channels they opt in to;
• may withdraw consent and request deletion of the minor’s data at any time by emailing admin@ikrammuda.my.

We do not knowingly collect data from anyone under 13. If you believe a child under 13 has provided data to us, please contact us and we will delete it.

• To register you (or your child) for programs you choose to join.
• To run those programs — including attendance, check-in, participant communication, and follow-up surveys.
• To process payments for paid programs through our payment provider.
• To maintain accurate membership records for IKRAM Muda and IKRAM Teens, including peringkat / tier progression.
• To send program announcements, reminders and notifications through the channels you have opted in to.
• To analyse survey and feedback responses in aggregate so we can improve our programs (see Section 7).
• To diagnose errors, prevent abuse, and keep the platform secure.

All data is stored on encrypted databases hosted with Supabase (Singapore region) and served through Vercel’s edge network. File uploads (e.g. claim photos, program materials) are stored in Supabase Storage.

We do not transfer your data to any country that lacks an adequate standard of protection without your consent.

We share the minimum necessary data with the following service providers so the platform can function. We do not sell your personal data to anyone.

• Supabase — database and file storage.
• Vercel — application hosting and edge delivery.
• Billplz — payment processing for paid programs. Card / banking details are submitted directly to Billplz and are never seen or stored by us.
• Resend — transactional email delivery (e.g. registration confirmations, invites).
• Anthropic (Claude API) — we use Claude to summarise survey and feedback responses, and to draft an operator-facing profile of members for our administrators. We send only the data needed for that specific task, and the AI provider does not train on our prompts under our agreement with them. AI output is reviewed by humans before any action is taken.
• Sentry — error and performance diagnostics. We scrub personal data from error reports where reasonably practicable.

We may also disclose personal data if required by Malaysian law, court order, or to protect the rights, property, or safety of IKRAM Muda, our members, or the public.

• Active member records — retained for as long as your membership is active, plus a reasonable archival period.
• Program registrations, attendance, feedback — retained alongside the program record for historical reporting.
• Payment records — retained for at least 7 years to comply with Malaysian tax and accounting requirements.
• Server and error logs — typically rotated within 30–90 days.
• Deletion on request — you can request deletion of your account at any time (see Section 9). We will action this within 30 days, subject to records we are legally required to keep.

Under the Malaysian Personal Data Protection Act 2010, you may:

• access the personal data we hold about you;
• correct any data that is inaccurate or out of date;
• withdraw your consent for any specific use (e.g. unsubscribe from a communication channel);
• request deletion of your data, subject to records we must retain by law;
• ask us to limit how we use your data while a request is being processed.

To exercise any of these rights, email admin@ikrammuda.my. We may ask you to verify your identity before acting on the request.

You can opt in or out of WhatsApp, SMS and email separately. To change your preferences, reply STOP to any message, click the unsubscribe link in an email, or email us at admin@ikrammuda.my.

We use HTTPS for all traffic, encrypted storage at rest, parameterised database access, server-side enforcement of access policies, rate-limiting on public endpoints, and audit logging for sensitive administrative actions. No system is perfectly secure, but if we ever discover a breach affecting your data, we will notify affected users without undue delay.

We will update this page if our practices change. The “Last updated” date at the top reflects the most recent revision. For material changes (e.g. a new category of data, a new service provider that processes personal data) we will notify members through the channels they have opted in to.

For any privacy question or request, contact us at admin@ikrammuda.my.