Privacy Policy

All users

• Name
• Email address
• Phone number
• Password (stored in encrypted form; we never see or store your password in readable form)

Job seekers

• Profile details you choose to provide: headline, bio, location, skills, availability, preferred work types, preferred locations, salary expectation, right-to-work status
• Resume or CV files you upload
• Profile photo, if you upload one
• Applications you submit, including any cover message, your expected monthly salary for that role and whether it is negotiable, and the application's status history
• Messages employers send you when they make a decision (for example, the reason you weren't selected)

Recruiters and employers

• Company name, industry, description, website, location, company size, year founded
• Company logo and cover image, if uploaded
• Your SSM / business registration number, which is shown publicly on your company page
• The date you accepted the Replylah reply pledge
• Job listings you create, and the decisions and messages you send to applicants

Request for access

If you submit an access request through our form, we collect your company name, contact name, email address, phone number, company website and the reason for your request.

Waitlist and contact form

• If you join our launch waitlist, we collect your email address
• If you contact us through our form, we collect your name, email address, whether you are a job seeker or employer, the topic and your message

Automatically collected

• Authentication cookies required to keep you signed in
• Your IP address, used only briefly to limit repeated form submissions and protect the Platform from spam and abuse
• Aggregate, privacy-friendly analytics about page views and general usage (we use Vercel Analytics, which does not use tracking cookies or identify individuals)

We process your personal data to:

• Create and manage your account
• Allow job seekers to apply to listings and track application status
• Allow employers to receive, review and respond to applications
• Send transactional emails: account confirmation, password reset, updates when an employer changes the status of your application, reply reminders to employers, and notices when an application is closed automatically
• Show you in-app notifications about your applications
• Reply to messages you send us, and let waitlist members know when sign-ups open
• Calculate and display employer response rates
• Verify recruiter identity and eligibility to post listings
• Maintain the security and integrity of the Platform
• Comply with legal obligations

We do not use your personal data for advertising, and we do not sell it.

When you apply for a job, the employer who posted that listing receives your name, email address, phone number, profile details (including work experience, education, certifications, languages and skills), resume, cover message and expected salary for that role. This is the core function of the Platform. Once disclosed, that employer processes your data as an independent data controller and under their own privacy practices.

We also use the following service providers, who process data on our behalf:

We may disclose personal data where required by law, court order, or a lawful request from a regulatory authority. We do not sell, rent or trade your personal data.

Our infrastructure providers store and process data outside Malaysia, principally in Singapore and the United States. By using the Platform, you consent to this transfer. We select providers that maintain recognised security standards.

• Passwords are hashed and never stored in readable form
• All traffic is encrypted in transit using HTTPS
• Resume files are stored in a private bucket, accessible only through short-lived signed links
• Database access is governed by row-level security policies, so users can only access records they are entitled to
• Access to production systems is restricted

No system is perfectly secure. We cannot guarantee absolute security, but we take reasonable steps to protect your data against loss, misuse and unauthorised access.

If a personal data breach occurs, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it, and notify affected users without undue delay where the breach is likely to cause significant harm, as required under the PDPA.

We retain your personal data for as long as your account remains active.

You can delete your account at any time from your account settings, or by contacting us at the address below. When you do, we remove your personal data — including your name, email address, phone number, profile details and any uploaded resume files — from our active systems. Records that must be retained for legal or accounting purposes, or that are necessary to preserve the integrity of another party’s records, may be kept in anonymised form.

If you withdraw an application, it is removed and the employer can no longer see it. Waitlist emails are kept until we have told you sign-ups are open, or until you ask us to remove you. Records used to limit repeated form submissions are deleted after one day.

Backups are retained for a limited period and are overwritten in the ordinary course.

You have the right to:

• Access the personal data we hold about you
• Correct personal data that is inaccurate, incomplete or out of date
• Withdraw consent to our processing of your personal data
• Limit processing for direct marketing purposes
• Request deletion of your account and the personal data associated with it
• Request that your personal data be transmitted to another data controller, where technically feasible (data portability)

You can update most of your details and delete your account directly in your account settings. For anything else, including access requests, contact us at the address below. We will respond within 21 days as required under the PDPA.

Withdrawing consent or deleting your account means we can no longer provide the Platform to you, and your account will be closed.

The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will remove it.

We may update this policy from time to time. Material changes will be notified by email or through a notice on the Platform. The date above reflects the current version.

For any question about this policy, to exercise your rights, or to make a complaint about how we handle your personal data:

Email: support@replylah.com

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).