Privacy Policy

1. Who We Are

Gloup is a platform that connects customers with independent home service professionals. For the purposes of data protection law, Gloup is the data controller of the personal data described in this policy.

2. Information We Collect

We collect the following categories of personal data:

3. How We Use Your Information

We use your personal data to:

1. Create and manage your account;
2. Process bookings, payments, and refunds;
3. Connect customers with appropriate service professionals;
4. Verify the identity of service professionals through KYC checks, including NRIC details, identity-card photos, selfie matching, and licence checks where applicable;
5. Detect, prevent, and investigate fraud, abuse, illegal activity, and other crimes, including using a one-way cryptographic identifier derived from your NRIC number to prevent fraudulent re-registration and to support fraud or crime investigations;
6. Communicate with you about bookings, updates, and support;
7. Send marketing messages, where you have consented or as permitted by law;
8. Personalise your experience and recommend relevant services;
9. Monitor, improve, and secure the platform;
10. Comply with legal, regulatory, and tax obligations.

4. Legal Basis for Processing

Where required by law, we rely on the following legal bases:

1. Performance of a contract to deliver bookings and account services.
2. Consent for marketing communications, location access, certain cookies, and identity-verification uploads required to complete provider onboarding.
3. Legitimate interests to improve the platform, verify providers, prevent fraud, investigate crime, and ensure security.
4. Legal obligation to meet tax, accounting, regulatory, and law-enforcement requirements.

5. How We Share Your Information

We share personal data only as needed to operate the platform:

1. With service professionals, to enable them to deliver the service you booked. This includes your name, contact details, address, and booking notes.
2. With service providers and partners that help us run Gloup, such as cloud hosting, payment processing, analytics, communications, and customer support.
3. With professional advisers, such as auditors, lawyers, and insurers, where necessary.
4. With authorities, regulators, and law-enforcement agencies, where required by law or to support fraud or crime investigation.
5. In a corporate transaction, such as a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

We do not sell your personal data. IC / MyKad photos, passport photos, selfie photos, and licence document images are used for verification and security purposes and are not shown to customers.

6. International Transfers

Your data may be processed in countries outside Malaysia where our service providers operate. When this happens, we put appropriate safeguards in place to ensure your data receives a comparable level of protection.

7. Data Retention

We keep personal data only for as long as needed to:

1. Provide our services to you;
2. Verify service professionals and maintain platform safety;
3. Detect, prevent, and investigate fraud and crime;
4. Comply with legal, tax, and accounting obligations;
5. Resolve disputes and enforce our agreements.

Sensitive identity verification images — including IC / MyKad photos, passport photos, selfie photos used for matching, and licence document images — are retained for up to 90 days after upload. After 90 days, these images are removed from our app and systems, unless we are required by law to keep them longer for an active investigation or legal process. While your account is active, your NRIC number is stored in encrypted form for identity verification, platform safety, and fraud or crime investigation. When you request account deletion, your account remains usable for a 30-day period during which you can still log in; after that period the account is deleted entirely. At final deletion, we delete the readable / encrypted NRIC number from your account record. We may retain a one-way cryptographic identifier (an HMAC-based fingerprint) derived from your NRIC number solely to prevent fraudulent re-registration and to support fraud or crime investigations. That identifier cannot reasonably be used to reconstruct your NRIC in ordinary use. Separately, your email address is pseudonymised rather than fully erased — for example, deleted-on-16022026-markspencer@gmail.com — where the date reflects the day of deletion, for fraud prevention, audit purposes, and to prevent duplicate re-registrations. These retained records are not shared with third parties for marketing. For full details of how deletion is handled, see our Data Deletion Policy.

8. Your Rights

Depending on your location, you may have the following rights:

1. Access the personal data we hold about you;
2. Correct inaccurate or incomplete data;
3. Request deletion of your data;
4. Object to or restrict certain processing;
5. Withdraw consent where processing is based on consent;
6. Request a copy of your data in a portable format;
7. Lodge a complaint with the relevant data protection authority.

To exercise any of these rights, contact us at the details in Section 12.

9. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, measure performance, and personalise content. You can manage cookies through your browser or device settings. Disabling certain cookies may affect how the platform works.

10. Security

We use technical and organisational measures to protect your personal data, including encryption in transit, access controls, and regular reviews. While an account is active, NRIC numbers are stored encrypted. After account deletion, we do not retain readable NRIC numbers; we retain only a one-way HMAC-based fingerprint for anti-fraud matching. Identity verification data is accessible only to authorised personnel who need it for verification, security, or investigation purposes. Access to readable identity data is logged. No system is fully secure, so we encourage you to use a strong password and to keep your login details confidential.

11. Children

Gloup is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided personal data to us, please contact us so we can remove it.

12. Contact Us

For privacy questions, requests, or complaints, contact us at:

Gloup Privacy Team. Email: gloup.support@gmail.com. Support: in-app support channel.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app, website, or by email. Continued use of Gloup after changes take effect means you accept the updated policy.