Skip to content

Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains how Lynx PMIS ("we", "us", "our") collects, uses, stores and protects your personal data when you use our website at lynxpmis.com and the Lynx PMIS mobile application. We comply with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

1. Who we are

Lynx PMIS is a project management software product developed by Hilwani Bin Shahimi, operating as a sole proprietor in Malaysia. Our contact for all privacy matters is lynxpmis.support@gmail.com.

Business registration (SSM) number: [to be added upon registration].

2. What personal data we collect

We collect only the data required to provide the service:

  • Account data — your name, email address, company name (optional) and password (stored encrypted).
  • Subscription data — your chosen plan (Basic, Professional or Enterprise), billing interval (monthly or yearly), and payment status. Payment card data is never stored by us; it is handled directly by Stripe, our payment processor.
  • Usage data — projects, tasks, subtasks and other content you create inside the app. This content is stored on your behalf so you can access it from your devices.
  • Technical data — device type, OS version, IP address and crash logs, used solely for reliability and security.

We do not collect data from third parties, run advertising trackers, or sell your data to anyone.

3. Why we collect it (lawful basis)

  • To provide the service — verifying your login, syncing your data, calculating subscription limits.
  • To process payments — sharing the minimum required data with Stripe to complete and renew your subscription.
  • To send service emails — welcome, login credentials, renewal reminders, security alerts.
  • To improve the product — aggregated, anonymised crash and performance data.

4. How long we keep your data

  • Account and subscription data — kept while your account is active and for 12 months after you cancel, so you can reactivate without losing your work.
  • Payment records — kept for 7 years as required by Malaysian tax and accounting law. Stripe stores the actual card data.
  • Crash and technical logs — kept for 90 days.
  • Deleted accounts — data is permanently erased within 30 days of deletion request, except payment records noted above.

5. Who we share it with

We share your data only with processors that are necessary to run the service:

  • Stripe — payment processing and subscription management.
  • Supabase — the hosted database and authentication service that stores your account and app data.
  • Google Firebase — crash reporting and push notifications.
  • Hostinger — hosting of this website.

All processors are bound by their own privacy and data-protection obligations. We never share your data with advertisers or unrelated third parties.

6. International transfers

Some of our processors (Stripe, Supabase, Firebase) may store data outside Malaysia. We use providers that offer industry-standard safeguards (including Standard Contractual Clauses and data-processing agreements) to protect your data during these transfers.

7. Your rights under the PDPA

You have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct any inaccurate data.
  • Withdraw consent and request deletion of your account and data.
  • Object to processing that isn't necessary to run the service.

To exercise any of these rights, email lynxpmis.support@gmail.com. We aim to respond within 21 days, in line with PDPA requirements. Account deletion is also available directly from inside the app (Profile → Delete Account).

8. Security

Your account is protected by a password that we store in hashed form. Communication between the app and our servers uses HTTPS. Data at rest is encrypted by our database provider. No system is 100% secure, but we follow industry practice and monitor for suspicious activity. If a data breach occurs that affects you, we will notify you and the relevant authorities as required by law.

9. Cookies

Our marketing site uses only essential cookies required for basic functionality. We do not use advertising or third-party tracking cookies. Our app does not use cookies.

10. Children

Lynx PMIS is a business tool and is not intended for users under 18. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy occasionally. Material changes will be announced by email and reflected in the "Last updated" date at the top of this page.

12. Contact

Questions about privacy? Email lynxpmis.support@gmail.com or write to: Hilwani Bin Shahimi, 16 Jalan Kasih 4, Taman Kasih, 43000 Kajang, Selangor, Malaysia.