1. Introduction
Welcome to FraudShield ("we," "us," or "our"). We are committed to protecting your privacy and personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).
By using FraudShield's mobile application and services, you consent to the data practices described in this Privacy Policy.
Our Data Protection Officer: cgt.admin@citadelgroup.com.my
2. Personal Data We Collect
We collect different types of personal data depending on which features you use.
2.1 Account Registration & Profile Data
- Email address (required for login and account recovery)
- Phone number (for two-factor authentication)
- Full name (for identity verification)
- Password (stored as encrypted hash)
2.2 Scam Report Data
- Report type and category (call, SMS, email, website)
- Target identifier (phone number, bank account, URL)
- Description and narrative of the scam
- Evidence (screenshots, documents, recordings)
- Timestamp and optional location data
2.3 Real-Time Protection (Phase 2)
If you enable advanced protection features:
- Call monitoring: Incoming caller phone numbers, duration.
- Banking notifications: Transaction alerts from supported banks (processed locally).
- Clipboard guard: URLs and numbers you copy (processed on-device).
3. Legal Basis for Processing
Under the PDPA, we process your personal data based on:
- Consent: Explicit agreement obtained during registration or feature activation.
- Legitimate Interests: Fraud prevention, security, and service improvement.
- Legal Obligations: Compliance with tax laws and law enforcement requests.
4. How We Use Your Personal Data
- Service Delivery: Authenticating identity, risk scoring, and alert distribution.
- Real-Time Protection: Monitoring threats and triggering Macau Scam warnings.
- Machine Learning: Training models to detect emerging scam tactics accurately.
- Security: Scanning for malicious apps and maintaining audit logs.
6. Data Retention Periods
| Data Type | Retention Period | Justification |
|---|---|---|
| Account Data | Until deletion + 30 days | Recovery & Continuity |
| Scam Reports | 3 years | Pattern Analysis |
| Security Scans | 90 days | Optimization |
| Payment Orders | 7 years | Income Tax Act 1967 |
7. Automated Decision-Making
FraudShield uses AI to generate Risk Scores (0-100). You have the right to request human review of any automated assessment affecting you by contacting our DPO.
8. Data Security Measures
- Encryption: TLS 1.3 in transit and AES-256 at rest.
- Access: Strict role-based controls and two-factor authentication for admins.
- App Integrity: Certificate pinning and Google Play Integrity API.
9. Your Rights Under PDPA
You have the following rights under Malaysian Law:
- Right to Access: Request a copy of your records, subject to any fee permitted by applicable law.
- Right to Correction: Update inaccurate information anytime.
- Right to Withdraw Consent: Toggle off permissions in settings.
- Right to Deletion: Permanently delete your account (30-day grace).
10. Dispute Resolution
If you believe a report is inaccurate, use the "Dispute This Report" link. Our team will review and resolve within 14 business days.
11. Children's Privacy
FraudShield is not intended for users under 18. We do not knowingly collect data from children.
13. Changes to This Privacy Policy
Material changes will be notified via in-app alerts and email. Continued use constitutes acceptance of updated terms.
14. Contact Us
For questions or complaints:
Data Protection Officer (DPO)
Email: cgt.admin@citadelgroup.com.my
Response time: Acknowledgment within 7 days, full resolution within 21 days.
15. Regulator Complaints
You may lodge complaints with the Personal Data Protection Department (JPDP) at pdp@kkmm.gov.my.