Privacy Policy

For data about your own employees, your organisation is the data user and decides how the data is used. iSalesAI HR acts as a data processor, handling that data on your instructions. For account and billing data of the person who registers, we act as the data user.

• Account data: name, work email, password hash, role and workspace membership.
• Employee data entered by your administrators: name, NRIC/passport number, contact details, address, date of birth, marital and tax status, dependants, bank account details, EPF, SOCSO and income tax reference numbers.
• Employment data: department, position, grade, salary, allowances, deductions, advances.
• Operational data: attendance and clock records, shifts, leave applications, claims and uploaded receipts or supporting documents.
• Payroll data: payroll runs, payslips, statutory contributions and tax computations.
• Billing data: subscription plan, invoices and payment status (card details are handled by Stripe, not stored by us).
• Technical data: log records, IP address, browser type and timestamps for security purposes.

• To create and operate company accounts and user access.
• To calculate payroll, statutory contributions and monthly tax deductions.
• To manage leave, attendance, shifts, overtime and expense claims.
• To generate payslips, statements and payout vouchers.
• To process subscription payments and issue receipts.
• To provide support, detect fraud or abuse, and secure the platform.
• To comply with legal and regulatory obligations.

Processing is carried out with consent, or where it is necessary for the performance of a contract, for compliance with legal obligations, or for the legitimate interests of operating the Service. Where your organisation uploads employee data, you confirm you have obtained the necessary notices and consents from those individuals.

We do not sell personal data. Data may be disclosed to:

• Authorised users within your own company account.
• Service providers that host, store or process data on our behalf.
• Stripe, for subscription payment processing.
• Regulators, courts or authorities where required by law.

We apply technical and organisational safeguards including encryption in transit, row-level access controls that isolate each company account, role-based permissions, access logging and restricted administrative access. No system can be guaranteed completely secure, but we work to protect data against unauthorised access, loss or misuse.

Personal data is kept for as long as your company account is active, and afterwards only for the period needed to meet legal, tax, accounting or audit obligations. Payroll records may be retained to satisfy statutory record-keeping requirements. On request, we will delete or anonymise data that we are no longer required to keep.

Data may be stored or processed on servers located outside Malaysia by our hosting and payment providers. Where this happens, we take reasonable steps to ensure a comparable level of protection.

Subject to the PDPA, you may:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent or limit processing for certain purposes.
• Request deletion where we are not required to retain the data.

Employees should first contact their employer’s HR administrator, who controls the records within the company account. You may also write to us at hello@isalesai.com.my.

We use strictly necessary cookies and browser storage to keep you signed in and maintain session security. We do not use advertising cookies.

The Service is intended for use by employers and is not directed to children.

We may update this policy as the Service evolves. The “last updated” date above reflects the current version, and material changes will be notified in advance.