Privacy Policy

Our role in your data

When a business subscribes to TadauHR, that business is the data controller for its employees' personal data. It decides what to record and why. SabStack processes that data on the employer's instructions as a service provider.

For our public website, account sign-up, and billing, SabStack is the controller. If you are an employee asking about your own records, contact your employer (the HR or admin user of your TadauHR workspace) first — they manage that data directly.

Data we collect

Depending on how you use SabStack and TadauHR, we may process:

• Account and contact data — name, work email, phone, company name, and role.
• Employee records — profiles, departments, job positions, and identifiers entered by your employer.
• Attendance and leave data — check-in/out times, leave applications, balances, and supporting attachments.
• Overtime and attendance data — logged hours and records entered by your employer.
• Sensitive profile data — held only where needed for employment records, and stored encrypted at rest.
• Billing data — subscription and payment details processed by our payment provider, Stripe; we do not store full card numbers.
• Usage and technical data — log records, device and browser data, and audit trails of sensitive actions.

How we use personal data

• Provide and operate the TadauHR modules — attendance, leave, overtime, employee records, and HR documents.
• Produce reports for your records.
• Authenticate users, apply role-based access, and keep audit logs of sensitive actions.
• Process subscriptions, billing, and trials.
• Provide support, send service notices, and improve reliability and security.
• Meet legal, regulatory, and accounting obligations.

Why we are allowed to process it

We process personal data to deliver the service you or your employer signed up for, to meet legal obligations such as employment record-keeping, and on the basis of consent where required under the PDPA Notice and Choice principle. Where consent is the basis, you may withdraw it, though this may affect parts of the service.

Who we share data with

We do not sell personal data. We share it only with processors that help us run the service, under contractual safeguards:

• Stripe — payment and subscription processing.
• Our hosting provider (Hostinger, Malaysia region) that stores and serves the application.
• Cloudflare R2 — object storage for files uploaded to your workspace, such as leave attachments and HR documents.
• Email and notification providers used for approvals and service messages.
• Authorities or advisers where disclosure is required by law.

Cross-border transfers

The TadauHR application and its database are hosted in Malaysia. Files uploaded to your workspace are stored with Cloudflare R2, which we configure to keep data in the Asia-Pacific region; Cloudflare is a US-incorporated provider, so some data may be processed outside Malaysia. Payment processing also handles limited data abroad. For every such transfer we rely on written data-processing terms and standard contractual safeguards so the data receives a comparable level of protection.

How we protect data

• Encryption of sensitive profile fields at rest, encryption at rest for uploaded files in object storage, and TLS encryption in transit.
• Each business's data is kept logically separated so one customer can never see another's records, and access within a business is limited by user role. Uploaded files are stored under a per-business path in a private bucket that is not publicly listable, and are served only to authorised users.
• Audit logging of sensitive actions and periodic access review.
• No security measure is perfect; we work to detect, contain, and respond to incidents promptly.

How long we keep data

We keep personal data for as long as your account is active and as needed to provide the service and meet legal, tax, and employment record-keeping obligations. When data is no longer needed, we delete or anonymise it, including the corresponding files held in object storage. Employers can export their records at any time.

Your rights

Subject to the PDPA, you may:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent or limit certain processing.
• Ask about how your data is disclosed or transferred.

If you are an employee, route requests through your employer first, as they control your workspace records. We will assist them in responding.

Cookies and sessions

We use essential cookies to keep you signed in, remember your language preference, and keep the service secure. We do not use them for advertising.

Changes to this policy

We may update this policy as the product and legal requirements evolve. Material changes will be reflected here with a new update date.