Privacy Policy

1. Introduction

Alconic Software Sdn Bhd ("we", "our", or "us") operates iLulus.my and is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

We comply with the Personal Data Protection Act 2010 (PDPA) of Malaysia and implement appropriate measures to ensure your data is protected and handled responsibly.

2. Information We Collect

We collect several types of information for various purposes to provide and improve our Service to you:

Personal Information

• Full name and identification number (NRIC/Passport)
• Contact information (email address, phone number, address)
• Date of birth and nationality
• Employment information and income details
• Banking and financial information
• Credit history and CTOS/CCRIS reports

User-Uploaded Documents

If you choose to upload documents for loan processing or iOCR, these documents may contain personal and financial information. Examples include:

• Payslips
• Bank statements
• Income tax documents / EA forms
• Booking forms / letter of offer and related property documents
• Other documents you submit for verification or analysis

Usage Data

• IP address and browser information
• Pages visited and time spent on our platform
• Device information and operating system
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the collected information for various purposes:

• To process your loan applications and connect you with financial institutions
• To verify your identity and perform credit assessments
• To provide customer support and respond to your inquiries
• To send you important updates about your applications and account
• To improve our services and develop new features
• To prevent fraud and ensure platform security
• To comply with legal obligations and regulatory requirements
• To send promotional materials (with your consent)

4. AI Processing (iOCR & Pre-Loan Analysis)

iLulus includes optional AI-powered features to help extract, compile, and summarize information from user-uploaded documents (“iOCR”), and to generate pre-loan readiness analysis to assist credit officers in understanding potential approval factors, possible issues, and recommended actions before submitting a loan application.

4.1 What data may be sent for AI processing

When you choose to use iOCR or AI pre-loan analysis, we may transmit only the content you explicitly submit for these features, which may include:

• Uploaded document content (e.g., payslip, bank statement, tax document, booking form / letter of offer)
• Text extracted from those documents (OCR output)
• Loan-related information you provide in the app (e.g., income, commitments, employment, property details)

We do not send your contacts, background photo library, or precise location data to AI providers. Any access to files/photos is limited to the specific document you select and upload.

4.2 Who receives the data

AI processing is performed through our AI gateway, which routes requests to third-party AI model providers for the limited purpose of generating iOCR extraction/summaries and pre-loan analysis:

• Anthropic (Claude Sonnet 3.5)
• Google (Gemini 3.0 Flash)

4.3 Your permission and choices

We will obtain your permission before transmitting personal data for AI processing. You may decline AI processing and continue using iLulus without these optional AI features. Where available, you can also withdraw consent or disable AI processing in the app settings.

4.4 Automated outputs and limitations

AI-generated summaries and pre-loan readiness analysis are provided as guidance to support review and decision-making. They may be incomplete or inaccurate and should be validated against original documents and applicable bank or regulatory requirements. Final loan decisions are made by financial institutions and/or authorized credit officers, not by iLulus.

4.5 Cross-border transfers

Because AI providers and processing infrastructure may be located outside Malaysia, the personal data you submit for AI processing may be transferred and processed in other jurisdictions. We take steps to require service providers to protect personal data and handle it responsibly in line with PDPA and contractual safeguards.

5. Sharing Your Information

We may share your personal information with:

• Financial Institutions: Banks and lenders to process your loan applications
• Credit Bureaus: CTOS, CCRIS, and other credit reporting agencies for credit checks
• AI Service Providers (optional features): When you consent to iOCR and/or AI pre-loan analysis, we may transmit the user-submitted content to third-party AI model providers (Anthropic and Google) via our AI gateway for processing as described in Section 4
• Service Providers: Third-party vendors who assist in operating our platform
• Legal Authorities: When required by law or to protect our legal rights
• Business Partners: With your consent, for specific services you've requested

We require third parties to handle personal data responsibly and to use it only for the purposes we specify, consistent with PDPA requirements and contractual safeguards.

6. Data Security

We implement industry-standard security measures to protect your personal information:

• SSL/TLS encryption for data transmission
• Encrypted storage of sensitive information
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Employee training on data protection practices

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights Under PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights:

• Right to Access: Request a copy of your personal data we hold
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Withdraw Consent: Withdraw your consent for data processing at any time
• Right to Limit Processing: Request limitation on how we use your data
• Right to Data Portability: Request your data in a portable format
• Right to Complain: Lodge a complaint with the Personal Data Protection Commissioner

8. Data Retention

We retain your personal information for as long as necessary to:

• Fulfill the purposes outlined in this Privacy Policy
• Comply with legal, regulatory, or contractual obligations
• Resolve disputes and enforce our agreements

Typically, we retain loan application data for 7 years after account closure, in accordance with financial regulations. After this period, we will securely delete or anonymize your data.

For AI processing, we aim to minimize retention of documents and extracted text where feasible. You may request deletion of uploaded documents and related outputs, subject to legal and regulatory retention requirements.

9. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for platform functionality and security
• Analytics Cookies: Help us understand how users interact with our platform
• Marketing Cookies: Used to deliver relevant advertisements (with consent)

You can control cookies through your browser settings, though disabling certain cookies may affect platform functionality.

10. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending you an email notification (for significant changes)

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the Service after modifications constitutes acceptance of the updated Privacy Policy.