Privacy Policy

This Privacy Policy explains how the Mabiz business-management platform (“Mabiz,” “we,” “us,” “our”) collects, uses, shares and protects information. It applies to everyone who uses Mabiz, including organizations that subscribe to Mabiz and the people those organizations allow to use it (such as their employees, administrators, customers, suppliers and other business contacts).

This policy covers the Mabiz mobile application (the “Mabiz app”), the Mabiz web application and admin console, and the online services provided at mabizerp.com.

Please read this policy together with any agreements your organization has with us. If your employer or another organization has given you access to Mabiz, that organization is the one that decides what business information is entered into its Mabiz workspace, and you should also refer to that organization’s own privacy policies.

Mabiz is a cloud business-management (ERP) system that helps organizations run day-to-day operations. It is used to manage employees, customers and suppliers, sales and purchases, orders, quotations and invoices, payments, inventory and stock, accounting and financial records, workflows and approvals, and business documents.

Employees of an organization commonly use the Mabiz mobile app to sign in with their staff number and a personal PIN, view their profile, submit leave and claim requests, record attendance, respond to approvals, follow up on orders, and attach photos, receipts and documents.

Provided by your organization. Most business and workforce information in Mabiz is entered by your organization’s administrators and authorized users. Your account is normally created and maintained by your organization rather than by you directly.

Provided by you. You may provide information when you sign in, update your details, submit leave, claim or approval requests, upload photos, receipts or documents, and communicate within the app.

Generated automatically. Some information is created when you use Mabiz, such as security and audit records, activity logs, push-notification tokens, device and app information, and crash diagnostics.

We process information to operate Mabiz and deliver its features, including to:

• Authenticate users and keep accounts and workspaces secure;
• Provide the ERP, HR, accounting, sales, purchasing, inventory, reporting and approval features your organization uses;
• Send service communications such as password-reset and verification codes, and notifications you have enabled (in-app, push, email, SMS or WhatsApp, depending on your organization’s settings);
• Produce and store financial and accounting records, including e-invoicing and statutory reporting where applicable;
• Provide support, investigate problems and improve reliability;
• Detect and prevent unauthorized access, fraud and abuse;
• Comply with legal, accounting, tax, audit and regulatory obligations; and
• Enforce our agreements and protect our legal rights.

We process information to run Mabiz itself, and (in the case of the workspace, employee, customer, supplier and financial data your organization manages) to provide the services your organization has subscribed to. We do not use the personal information in your Mabiz workspace for advertising or to profile individuals for unrelated purposes.

Mabiz is a business platform offered to organizations. Each organization decides which of its employees, customers, suppliers and other parties it records in Mabiz, what data it enters about them, who within the organization may access that data, and which Mabiz features it uses.

Because of this, data entered and managed by an organization in its own Mabiz workspace — such as employee, customer, supplier and financial records — is primarily controlled by that organization. Mabiz hosts and maintains the platform and supports the organization in operating it.

If you are an employee, customer or other individual whose information has been entered by an organization using Mabiz, we may not be in a position to determine or change that information directly. For questions about how an organization uses your personal information in Mabiz, please contact that organization first.

We work with a limited number of service providers that help us operate Mabiz. Access is limited to what each provider needs to perform its function. These include:

• Google Firebase (Cloud Messaging and Crashlytics). Firebase Cloud Messaging delivers push notifications to the Mabiz app, and Firebase Crashlytics receives crash and error diagnostics to help us fix issues.
• Cloud object storage. Uploaded photos, receipts and documents are stored in cloud object storage (DigitalOcean Spaces) hosted in the Asia-Pacific (Singapore) region.
• Email delivery. Transactional and service emails such as verification and password-reset messages are sent through our email systems using standard email-through-SMTP delivery.
• SMS and WhatsApp messaging. Where your organization enables them, service and notification messages may be delivered by SMS (Exabytes) or WhatsApp (Ultramsg), which process the recipient phone number and the message content.
• Zoom. Organizations that use Mabiz’s meetings feature may join video meetings through the Zoom Meetings SDK, which receives meeting details and participant information for those calls.
• AI-assisted processing. Optional AI-assisted features in the web application that structure information from uploaded documents (such as importing data from statements or records) use an AI model service provider. This is only used when an organization uses those features on documents it uploads.

Our own servers (hosting, databases and related infrastructure) are used to run the Mabiz platform and store data.

We share information only in the following kinds of situations:

• With your organization and the people it has authorized to use its Mabiz workspace, to operate the service;
• With service providers described above, acting on our instructions;
• With the other parties to a transaction, to the extent needed for the business records the organization creates;
• Where required by law, such as to respond to a court order, legal process or regulator, or where disclosure is otherwise legally required;
• To protect rights and safety, such as to detect and prevent fraud, misuse or threats to the security of Mabiz or its users; and
• In connection with a corporate transaction, such as a merger, sale or transfer of assets, where reasonably necessary.

We do not sell personal information. We do not share personal information with third parties for their own advertising purposes.

We apply reasonable technical and organizational measures to protect information we process. These include:

• Encrypting data in transit using HTTPS/TLS between devices, apps and our services;
• Storing passwords and PINs in a protected (hashed) form rather than as readable text;
• Keeping authentication tokens and credentials in secure storage on supported mobile devices (operating-system keychain or keystore);
• Restricting access to information to people and systems that need it to perform their role;
• Using role- and permission-based access controls so users only see what their organization authorizes;
• Keeping each organization’s workspace data separate from other organizations’ data; and
• Recording security-related and significant business activity in tamper-evident audit logs.

No method of transmission or storage can be guaranteed to be completely secure. While we take reasonable precautions, we cannot guarantee absolute security of information you submit.

We keep information only for as long as it is reasonably needed for the purposes described in this policy. Generally, that means information is retained while it is needed to:

• Provide Mabiz to your organization and meet the terms of its subscription;
• Operate, secure and maintain the platform;
• Satisfy accounting, tax, audit and other legal or regulatory requirements; and
• Handle queries, disputes and legal claims.

Information that belongs to an organization’s workspace generally remains within that organization’s workspace. When an organization closes and deletes its workspace through the Mabiz deletion process for workspaces, we take steps to delete the workspace’s business records as part of that process, to the extent technically possible.

Internal audit and activity logs are kept for a set period configured for the platform (by default approximately seven years) so that we can maintain a reliable security and compliance record. Where law requires us to keep records longer (for example, financial or accounting records), we do so for the period required.

Because specific details depend on the organization’s settings and applicable law, we do not state a single fixed time period for every type of data. We review and dispose of information in line with the principles above.

Control over your account and device. You can sign out of the app, change your password (or request a password reset), and manage how the app uses device features such as notifications, the camera and the photo library through your device settings. The Mabiz app only uses these features when you choose to (for example, to capture a receipt or allow notifications).

Control by your organization. Because your organization runs its workspace, it controls most of the information in it — including who has access, which notifications are sent, whether employees can be deactivated or removed, and whether the workspace is archived or deleted. If you have a question about an account managed by your employer or another organization, please contact that organization’s administrator.

Push notifications. You can disable push notifications for the Mabiz app at any time in your device settings or within the operating system’s notification settings.

If you would like to access, correct, export or delete personal information, or raise any other question about your information in Mabiz, please start with the administrator of the organization that gave you access. They can review, update or remove workspace data and accounts, and can guide you on the details their organization records.

For requests relating to data that Mabiz controls directly, or if your organization is unable to help, you can submit a request to us using our data request page or by contacting us using the details below. We will verify your identity and request, review it, and respond to you. Where we are required to keep certain records (for example, accounting, tax or audit records), those records will be kept for the period required by law even after a deletion request, and we will explain this when we respond.

There is currently no fully automated process in the Mabiz app for deleting accounts or exporting personal data; requests are handled through the administrator and contact channels described above.

Mabiz is an ERP and business-management platform intended for use by organizations and their adult representatives. It is not directed at children, and we do not knowingly collect personal information from children through Mabiz. If you believe a child’s information has been provided to us through Mabiz, please contact us using the details below so we can address it.

Mabiz operates online, and our service providers may process or store information in countries other than the country where you are located. For example, uploaded files are stored in cloud object storage located in the Asia-Pacific (Singapore) region.

Where information is transferred between countries, we rely on our service-provider arrangements and your organization’s agreements with us, and take reasonable steps to protect the information regardless of where it is processed.

We may update this Privacy Policy from time to time to reflect changes in our services, technology or legal requirements. When we do, we will update the “Last updated” date shown at the top of this page. If we make significant changes, we will take reasonable steps to make you aware of them, such as by updating this page and providing notice in Mabiz where appropriate.

If you have questions or concerns about this Privacy Policy or how Mabiz handles information, please contact us: