Privacy Policy

Effective Date: July 10, 2026

MY1ST ("we," "us," or "our") is operated by Apply IT Sdn. Bhd. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service"). Please read this policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

Account Information: When you create an account, we collect your name, email address, and password. You may also provide a profile photo.
Educator Profile: Business name, teaching subjects, contact details, and professional information. Where you use the e-Invoice feature, this also includes your Tax Identification Number (TIN) and business registration number.
Student Data: Names, contact details, enrollment information, attendance records, and academic progress of students you manage through the platform.
Guardian Information: Names and email addresses of guardians you invite to connect with student profiles.
Financial Records: Payment records, invoices, and financial data related to your teaching services that you enter into the platform.
Course Content: Course names, descriptions, schedules, and related educational materials you create.
Feedback & Attachments: Student feedback, progress reports, and any photo attachments you upload.
Communications: Messages you send through the platform and any correspondence with our support team.

1.2 Information Collected Automatically

Device Information: Device type, operating system, unique device identifiers, and mobile network information.
Usage Data: Features used, actions taken, time and date of access, and app performance data.
Log Data: IP address, browser type, access times, and referring URLs when accessing our web services.

1.3 Information from Third Parties

If you choose to sign in using a third-party service (Google, Microsoft, or Facebook), we receive your name, email address, and profile picture as permitted by your account settings on that service.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Create and manage your account
Enable you to manage your students, courses, attendance, and finances
Send transactional emails (account verification, password resets, guardian invitations)
Generate reports and analytics for your teaching business
Respond to your requests, comments, and questions
Monitor and analyze usage trends to improve user experience
Detect, prevent, and address technical issues and security threats
Submit e-Invoices to LHDN's MyInvois platform on your behalf where you use the e-Invoice feature (see Section 3)
Comply with legal obligations

Where we process and transmit e-Invoice data to LHDN, our lawful basis for doing so is compliance with a legal obligation under Malaysian tax law (including the Income Tax Act 1967 and the LHDN e-Invoice mandate), and the performance of our role as your authorized MyInvois intermediary at your instruction.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

With Guardians: When you invite guardians to connect with student profiles, they will have access to relevant student information you choose to share.
Service Providers: We use third-party services for hosting, email delivery, and object storage. These providers are contractually bound to protect your data and only process it on our behalf.
LHDN (MyInvois): Where you use the e-Invoice feature, we transmit invoice and taxpayer data — including your Tax Identification Number (TIN), business registration number, transaction amounts, and buyer details — to the Inland Revenue Board of Malaysia (LHDN) via its MyInvois platform, as required by Malaysian tax law. As your authorized intermediary, we also retain records of these submissions and LHDN's responses (see Section 5).
Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset.
With Your Consent: We may share information with third parties when you explicitly consent to such sharing.

4. Data Storage and Security

Your data is stored on secure servers protected by encryption in transit (TLS 1.2+) and industry-standard security measures. We use PostgreSQL for structured data and S3-compatible object storage for files such as profile photos and attachments. Access to data is restricted to authenticated users through JWT-based authentication.

While we implement commercially reasonable security measures, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. If you request account deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes. Anonymized and aggregated data that cannot identify you may be retained indefinitely.

In particular, e-Invoice records and related submission logs are subject to statutory retention obligations under Malaysian tax law. As an authorized MyInvois intermediary, we are required to retain these records for the minimum period required by law (currently seven (7) years). These records will be retained for that period even after you request account deletion, and this obligation overrides the 30-day deletion timeframe above for the affected records only.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete data.
Deletion: Request deletion of your personal data (see our Account Deletion page).
Data Portability: Request a machine-readable copy of your data.
Withdrawal of Consent: Where processing is based on consent, you may withdraw consent at any time.
Objection: Object to processing of your personal data for certain purposes.

To exercise any of these rights, contact us at privacy@myfirsts.ai.

7. Children's Privacy

MY1ST is designed for use by educators (adults) to manage their teaching business. The Service is not directed at children under 16. Educators may store student information (including minors) as part of their legitimate educational activities. Educators are responsible for ensuring they have appropriate consent from parents or guardians to store and manage minor students' data through the platform.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws.

9. Third-Party Links and Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the app and updating the "Effective Date" above. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

Email: privacy@myfirsts.ai
General Support: support@myfirsts.ai