Your data. Plainly explained.

Notis privasi ini juga tersedia dalam Bahasa Malaysia. This notice is also available in Bahasa Malaysia.

Who we are

Tinylab is run by [Company Sdn. Bhd.] (SSM: [SSM number]), [registered address] (“Tinylab”, “we”, “us”). We are the data user responsible for your personal data under the Personal Data Protection Act 2010 (“PDPA”).

Our data protection officer is [name of data protection officer]. You can reach them through our WhatsApp, +60 11-2522 8592.

What we collect

• Your name and phone number, mostly from WhatsApp when you message us.
• Device details: the model, serial or model number, the fault, and the part grade you choose.
• Photos and videos you send us of the device or the problem.
• Your area or address, so we can suggest a drop-off point, arrange a Lalamove pickup or post the device back.
• Messages with our AI assistant on this website, including any photos you upload there.
• Payment records: the amount, date and payment reference. We don’t see or keep your full card or bank details.

You don’t have to give us any of this, but without your name, phone number and device details we can’t quote or carry out a repair, and without an address we can’t arrange pickup or postage. We don’t ask for sensitive personal data, such as health or religious information.

Why we use it

• To give you a quote and book your repair.
• To repair your device.
• To get your device to us and back to you.
• To take payment, issue receipts and keep the records the law requires.
• To handle warranty claims, complaints and disputes.
• To answer you through our AI assistant, and to improve its answers.
• To send you updates about your repair. We only send offers if you’ve said yes, and you can stop them at any time.

The data on your device

Your phone, tablet or laptop holds far more personal data than anything we collect, so we treat it carefully. We never ask for your passcode. Screens and batteries are fixed with your device locked, and we never open your apps, photos, messages or files.

A repair can occasionally go wrong in ways nobody planned for, so please back up your device before you send it. We don’t copy, keep or restore data from customers’ devices.

Who we share it with

We don’t sell your personal data. We share it only with people who help us do the job, and only what they need:

• Couriers and delivery partners, such as Lalamove and our postage partners: your name, phone number and address.
• Partner drop-off points, when you choose one: your name and the booking.
• Payment providers, such as banks and e-wallets, to process your payment.
• Our AI provider, which processes messages and photos you send to the chat assistant on this website so it can reply. Today that provider is DeepSeek.
• Service providers that host our website and WhatsApp messaging (for example Cloudflare and Meta).
• Authorities, when the law requires it, or to protect our rights in a dispute.

Data outside Malaysia

Some of these providers store or process data outside Malaysia. In particular, messages and photos you send to our AI chat assistant may be processed on servers in China, and our hosting and messaging providers use servers in several countries. When we transfer data abroad, we do so as the PDPA allows and choose providers that protect it. If you’d rather not use the AI chat, you can message us on WhatsApp instead.

How long we keep it

• Chat messages with the AI assistant: up to 12 months.
• Booking and repair records: for as long as you’re a customer and up to 2 years after your last repair.
• Payment and tax records: 7 years, as Malaysian tax law requires.

After that we delete the data or make it anonymous.

How we protect it

We limit who can see your data to the people working on your repair, use providers with proper security, and protect our accounts with strong passwords and two-step sign-in. If a data breach could harm you, we’ll notify the Personal Data Protection Commissioner and you, as the law requires.

Your rights

Under the PDPA you can:

• Access the personal data we hold about you.
• Correct anything that’s wrong, out of date or incomplete.
• Withdraw your consent, or ask us to stop using your data for a purpose, including marketing.
• Ask for a copy of your data to take elsewhere, where the law allows.

To do any of these, message us on WhatsApp. We’ll reply within 21 days, as the PDPA requires. We may ask you to confirm who you are first, and the law allows us to charge a small fee for an access request. If you withdraw consent while a repair is in progress, we may not be able to finish it. If you’re unhappy with how we’ve handled your data, you can complain to the Personal Data Protection Commissioner.

This website

We don’t use advertising trackers. The website stores the area you pick (for drop-off and pickup options) in your browser, so it remembers it next time. You can clear it any time in your browser settings. Our hosting provider keeps standard technical logs, such as IP addresses, to keep the site secure and working.

Under 18s

If you’re under 18, please ask a parent or guardian to book the repair with you, or to agree to it first.

Changes and contact

We’ll update this notice when the way we use data changes, and show the new date at the top. For anything about your data, message us on WhatsApp at +60 11-2522 8592.