Privacy Policy

Last updated: 02 August 2026

This page explains what information DefexLog collects when you use our mobile app or the inspector dashboard at defexlog.com, how we use it, and who we share it with. We try to keep this plain English. No legalese unless we have to.

Who we are

DefexLog is a property-inspection tool used by professional inspectors in Malaysia to record defects, generate PDF reports, and bill their clients. The app is operated by Namel Solutions ("we", "us"). You can reach us at the contact details at the bottom of this page.

What we collect

When you create an account

• Name, email address, phone number: you provide these at sign-up.
• Password: stored as a one-way hash. Nobody, including us, can read your plaintext password.
• Google profile data (only if you sign in with Google): your name, email address, Google account ID, and whether Google has verified the email. We request only the email and profile OAuth scopes. We do not request access to your Drive, Gmail, Contacts, or any other Google data.

When you use the inspection features

• Inspection content: project title, property address, floorplan you upload, defect descriptions, defect locations on the floorplan.
• Defect photos: images you upload from the camera or your photo library.
• Generated PDF reports: produced from the above content for download and sharing.
• Business profile (Pro users only): business name, logo, contact email, used to brand your PDF reports.

When you pay

• Payment metadata: bill reference, amount, payment status, transaction ID returned by our payment processor.
• We never see or store your card or FPX banking credentials. Payment is handled entirely by an external payment processor. We only receive the result of whether the payment succeeded or failed.

Automatically

• Server logs: your IP address, the requests your app makes, error stack traces. Used for debugging and basic abuse detection.
• Device identifier: issued at login so you don't have to re-enter your password on every request.

We do not use any analytics SDKs and we do not serve ads.

How we use what we collect

• To run the service: create accounts, store your inspections, generate PDFs, process payments.
• To send transactional emails such as password reset codes, Google sign-in verification codes, and payment receipts.
• To support you when you contact us via WhatsApp or email.
• To detect and prevent abuse, fraud, and security incidents.
• To comply with applicable laws and respond to lawful requests from authorities.

We do not use your inspection content for our own purposes. We do not sell your data to anyone, ever. We do not send you marketing emails or promotional newsletters.

Who we share data with

DefexLog discloses personal data to third parties only where necessary to perform our contract with you, to comply with our legal obligations, or where you have given your explicit consent. Each disclosure is limited to the minimum data required for the stated purpose, and the recipient is obliged, by contract or by operation of law, to process the data solely for that purpose and to apply appropriate safeguards.

The categories of recipients with whom we share personal data are as follows:

We do not sell, rent, trade, or otherwise disclose your personal data to advertising networks, data brokers, marketing partners, or any third party not listed in the table above.

How long we keep your data

DefexLog retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal, regulatory, and tax obligations, and to establish, exercise, or defend legal claims. Retention periods are determined with reference to the Personal Data Protection Act 2010 (PDPA) of Malaysia and other applicable Malaysian statutes that prescribe minimum or maximum retention periods for specific categories of data.

The categories of data we hold and the corresponding retention periods are:

• Account data: retained for the duration of your active account.
• Inspection content, photographs, and generated reports: retained for the duration of your active account.
• Payment records: retained for a minimum of seven (7) years from the date of the transaction, in accordance with the record-keeping requirements of the Income Tax Act 1967 and the Companies Act 2016.
• Server logs: approximately thirty (30) days, retained solely for the purposes of security monitoring, abuse detection, and incident response.

Upon closure of your account, we will delete or irreversibly anonymise your inspection content, photographs, and generated reports within thirty (30) days, save where retention is required by law. Personal data contained within payment records will be retained for the statutory periods set out above and will not be used for any purpose other than fulfilment of those legal obligations. Anonymised data that no longer permits identification of any individual may be retained indefinitely for statistical and operational analysis.

Your rights

Under the Personal Data Protection Act 2010 (PDPA) of Malaysia, you have the following statutory rights in respect of personal data we hold about you:

• Right of access: to request confirmation of whether we process your personal data and to obtain a copy of that data.
• Right of correction: to request that we correct any personal data we hold about you that is inaccurate, incomplete, misleading, or out of date.
• Right to withdraw consent: to withdraw, in whole or in part, any consent you have previously given for the processing of your personal data, subject to the contractual and legal obligations that may continue to apply.
• Right to prevent processing likely to cause damage or distress: to require us to cease, or not to begin, processing your personal data for purposes likely to cause substantial damage or distress to you.
• Right to prevent direct marketing: DefexLog does not engage in direct marketing using your personal data. You may nevertheless exercise this right at any time.

You may exercise these rights directly within the Service:

• Access and review: your profile and complete inspection history are available in the mobile application and at defexlog.com.
• Correction: update your name, email address, telephone number, and business profile from the Settings screen in the mobile application or the inspector dashboard.
• Account closure: use the "Close Account" option located in the mobile application's Profile screen, or submit a written request to the email address provided in the Contact section below.
• Withdrawal of Google sign-in consent: visit your Google account at myaccount.google.com/permissions, locate DefexLog, and revoke access. Your DefexLog account will remain active. You will be required to sign in with your email and password (if one has been set) or to reconnect Google on subsequent visits.

To make a formal request to exercise any of the statutory rights set out above, please contact us using the details provided in the Contact section below. We will respond to your request within twenty-one (21) days, or within such other period as may be required by applicable law. We may, before complying with a request, require you to verify your identity to our reasonable satisfaction.

If you believe that we have failed to comply with your request, or that our processing of your personal data otherwise contravenes the PDPA, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

Children

DefexLog is designed for professional property inspectors. The Service is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has signed up, please contact us and we'll close the account.

Security

DefexLog implements technical, administrative, and organisational measures designed to protect your personal data against unauthorised access, disclosure, alteration, and accidental loss. These measures include encryption of data in transit, one-way cryptographic hashing of passwords, time-limited signed access links for stored files, server-side validation of all authentication tokens, and access controls that restrict employee and contractor access to personal data on a need-to-know basis.

We select third-party service providers that maintain security standards consistent with the standard of care we apply to your data, and we require them to process your personal data only for the purposes for which it was shared with them.

Although no method of electronic transmission or storage can be guaranteed absolutely secure, we maintain commercially reasonable safeguards aligned with the Personal Data Protection Act 2010 (PDPA) of Malaysia. In the event of a personal data breach that affects your information, we will notify you and the relevant regulatory authorities without undue delay, in accordance with the timeframes prescribed by applicable law.

You are responsible for safeguarding the credentials used to access your account, and for notifying us promptly of any suspected unauthorised use of your account.

Changes to this policy

If we materially change how we handle your data, we'll update this page and bump the "Last updated" date at the top. For significant changes (new third parties, new data types), we'll also email account holders before the change takes effect.

Contact