This policy explains what personal data the MooPayroll service and the MooPayroll mobile app (iOS and Android) collect, why, and what you can do about it. It is published by Moo Apps Systems Sdn Bhd (Malaysia), the operator of MooPayroll.
1. Who is responsible for your data
Your employer is the data user (controller): they decide what employee data is held and for how long. Moo Apps Systems Sdn Bhd is the data processor — we run the software and store the data on your employer's instructions, under a contract with them.
If you want to see, correct or remove your data, start with your employer's HR administrator. If they cannot help, contact us at support@moopayroll.com.
2. What the app collects
| Data | Why |
|---|---|
| Name, employee number, department, company | To identify you and show your own records |
| E-mail address and password | To sign you in. Passwords are stored only as a salted hash — never in plain text |
| Mobile number, home address, emergency contact | Your employee record; you can edit these yourself in the app |
| Pay data — salary, allowances, deductions, EPF, SOCSO, EIS, PCB, net pay, payslip PDFs | To show your payslips and your EA form |
| Leave balances, leave applications and their approval history | To let you apply for leave and follow the decision |
| Expense claims, amounts and photographs of receipts you attach | To let you claim expenses and follow them to payment |
| Push notification token, app version, device platform | To deliver a notification to the right device, and to stop sending to a device that has uninstalled the app |
| Sign-in events — time, IP address, device | Security and the audit trail your employer is required to keep |
| Where you were when you clocked in or out — only if your employer has turned this on and you have allowed it on your phone | To check a clock-in against your employer's work sites. The position is read once, at the moment you tap the button, never in the background. If you were inside a work site only the site's name is kept. If you were outside every site, the position is kept so your supervisor can review it, and is erased after the retention period your employer sets (90 days by default); the distance and the site name remain. If your phone cannot get a fix, the clock-in is still recorded, without a location |
| A photo of you taken by the front camera when you clock in or out — only if your employer has turned this on | So the person who reviews your attendance can see that it was you who clocked in. The photo is shown to them and to you; it is never used to recognise you automatically or matched against any other picture. If your employer requires it and you decline, the clock-in is still recorded and the day is marked for review. Photos are deleted after the retention period your employer sets (90 days by default) |
| The date, time and IP address recorded when you sign or acknowledge an HR document | To make an electronic signature verifiable, as the law requires |
What the app does not collect
- No background location, ever. The app asks for location permission only when your employer has turned on location for clock-ins, and reads it only at the moment of a clock-in or clock-out (see the table above). Refusing the permission does not stop you clocking in.
- No contacts, calendar, microphone, health or fitness data.
- No advertising identifier, no advertising or marketing SDK, no ad network.
- No analytics or behavioural tracking SDK, and no third-party crash reporter. We do not build a profile of how you use the app.
- No browsing or search history from outside the app.
Camera and photo library
The app asks for camera or photo-library access for one purpose only: attaching a photograph of a receipt to an expense claim. The photo you pick is uploaded to your employer's MooPayroll account and attached to that claim. Nothing else in your photo library is read, and access can be declined — claims that do not need a receipt still work.
Face ID and fingerprint
Unlocking the app with Face ID, Touch ID or a fingerprint is optional and is handled entirely by your phone. MooPayroll never receives your face or fingerprint data — the phone only tells the app "this was the right person". It is a local convenience lock over a session you have already signed into.
3. How the data is used
Only to provide the service: showing you your own records, sending your leave and claim applications to the right approvers, notifying you of decisions and announcements, and producing the statutory payroll output your employer is legally required to file. We do not use your data for advertising, profiling, automated decision-making or product personalisation.
4. Who the data is shared with
- Your employer — HR administrators and the managers in your approval chain, which is the point of the service.
- Malaysian statutory bodies and your employer's bank — EPF (KWSP), SOCSO (PERKESO), EIS (SIP), LHDN and the bank that pays your salary, in the files your employer submits. This is a legal obligation of your employer, not a choice we make.
- Our infrastructure providers — the service is hosted on Alibaba Cloud in the Asia-Pacific region, and e-mail is sent through our mail provider. They process data on our instructions and may not use it for anything else.
- Push notification delivery — Expo, Apple (APNs) and Google (FCM) carry the notification to your device. A notification contains only a short title and message (for example, "Your leave application was approved"). Payslip figures are never put in a push message.
We never sell personal data, and we never share it for advertising.
5. How long it is kept
Your employer decides. Malaysian employment and tax law obliges employers to keep payroll records for several years (generally seven), so pay records usually outlive your employment. When your employer closes their MooPayroll account, their data is deleted or returned under the terms of their contract with us.
Your push notification token is deleted when you sign out, uninstall the app, or when Apple or Google tells us the device no longer accepts notifications.
6. Security
- Everything between the app and our servers travels over HTTPS (TLS).
- The sign-in token is held in the iOS Keychain / Android Keystore, never in ordinary app storage.
- Passwords are stored only as a salted one-way hash.
- Each company's data is isolated from every other company's, and access inside a company is limited by role — a colleague cannot see your payslip unless your employer has given them that permission.
- Administrative access to production systems is restricted and logged.
7. Your rights
Under Malaysia's Personal Data Protection Act 2010 you may ask to access your personal data, to have inaccurate data corrected, and to limit how it is processed. Because your employer is the data user, send these requests to your HR administrator first; they can act on most of them directly in MooPayroll. We will help your employer respond, and you can reach us at support@moopayroll.com.
Deleting your account and data is described on the account and data deletion page.
8. Children
MooPayroll is a workplace service for employed adults. It is not directed at children and we do not knowingly collect data from anyone under 18 except where a young employee is lawfully employed and entered by their employer.
9. Changes to this policy
If this policy changes materially we will update the effective date above and notify employers. Continued use of the app after a change means the updated policy applies.
10. Contact
Moo Apps Systems Sdn Bhd, Malaysia
support@moopayroll.com