Operator: NUST SYSTEM PLT. Privacy contact: hello@saksi.com.my.
What we collect and why
Saksi processes your authentication identifier, session information and, for phone sign-in, mobile number to provide your account; business details you enrol for a provider profile; firsthand review text and service context for moderation and approved publication; service prices for private checks and aggregated benchmarks; and case information and evidence for restricted case handling. Information comes from your submissions, authorised case participants and account activity. We do not offer a public customer blacklist.
Signing in
MyDigital ID is the planned primary sign-in service; SMS is the alternative. These options are awaiting activation. During the pilot, email sign-in and Google sign-in are temporary alternatives when enabled. Supabase processes your email address, or Google’s account identifier, email and basic profile information, to authenticate you. Google sign-in does not give Saksi access to your Gmail messages. When enabled, Supabase receives identity-provider identifiers to establish your account, or your mobile number to deliver an SMS code through Twilio. Connect future methods from your signed-in account after verifying control; your Saksi account ID stays the same. We request the minimum identity scope and do not copy raw MyDigital ID attributes into review records or the audit ledger. Phone sign-in establishes access to a number. Identity verification does not certify that a review or allegation is true.
Signed-in complaint record checks
Signed-in members with active accounts can search for free using a full name or exact identifier. Search and browsing frequency quotas are temporarily disabled for everyone, including guest previews. Browser checks, access permissions and bounded result pages remain enforced. An existence check states whether an active retained complaint matches. Disclosure consent is included in the complaint form. Submitting with consent creates the case and publishes the title, narrative, amount, incident date, requested resolution and the first part of the reporter’s saved profile name in one transaction after validation; there is no later publishing step. Moderators review accounts after posting and can take them down. Only a complete name or phone match reveals published accounts; registration and bank matches provide existence checks only. There is no complaint directory. Names are normalised for spacing, punctuation and case; partial names do not match. Names may belong to different people; reported numbers do not verify ownership. A complaint is a submitted report, not a finding of wrongdoing, and the case may have been resolved. Private case messages, original evidence, case IDs, account IDs and sign-in identity are not disclosed. Every member must save their real full name in Settings → Profile before using signed-in features. The full name stays private; new or revised complaints automatically display its first part. Email sign-in does not verify that name. Publication does not establish the truth of an allegation. Reporters can revise or withdraw their searchable account; valid revisions replace the previous version immediately. A moderator restriction remains in force until staff restore the account; editing, withdrawing or resubmitting cannot bypass it. Existing private cases are not automatically published. Readers may copy displayed information. Searchers can dispute an account or submit a privacy/correction concern for review. Optional phone, registration and bank account numbers are stored as keyed lookup tokens without their original values. Archived, disabled, purged and expired cases without an active hold are excluded. Guests cannot make these checks. The database check runs separately from AI; complaint results are not sent to model providers.
Guest preview and AI-assisted inquiry
Before sign-in, guest search checks only whether relevant approved business records may be available. It uses database matching and readable PDF text, with no AI or OCR. Images and scanned PDFs may be unreadable; this does not mean no records exist. Guests receive no profiles, review narratives, prices, customer identities or private case information.
When you choose to continue through sign-in, your question, file and chosen area are kept temporarily in this browser only. The draft expires after 30 minutes and is removed on the next visit to the search page or when you choose New chat. If all tabs are closed, the browser cannot guarantee deletion at that exact time; expired drafts cannot be restored. Drafts are removed from browser storage after a successful full inquiry, when the chat is cleared or after expiry. File and area sharing require fresh confirmation, with no automatic AI submission. URLs and sign-in requests contain neither your question nor your file.
When you select an AI model, your question, previous conversation context and permitted Saksi records are sent through Vercel AI Gateway to the selected model provider. Your selected broad area is used when you opt in; GPS and home addresses are not requested. An image or PDF is sent only after a separate confirmation. Remove unrelated personal details and only share material you are authorised to submit. We require provider routes that do not use content for model training. Providers may still retain content for safety and security under their service terms; zero retention is not guaranteed.
Saksi does not save or publish inquiry files, prompts or answers in its database or ledger. Conversation history stays in page memory until cleared or reloaded; the separate sign-in draft follows the browser retention described above. Record access uses short-lived account-bound permits. Search frequency counters and their cooldowns are paused; authentication abuse controls still use keyed network hashes. Old usage records are removed after two days. Vercel BotID performs background browser checks on search and sign-in requests; a signed, account-bound browser verification cookie lasts ten minutes. Search limits are separate from the AI operating budget. Exact business lookup identifiers are enrolled by an operator only after business ownership and specific lookup permission are confirmed. The lookup index stores keyed tokens rather than the original identifiers. Withdrawing publication permission or disabling the business stops those matches.
The AI can retrieve approved profiles, published experiences and eligible aggregates for free after sign-in. Premium access does not expose customer identities, private cases, original evidence or individual payment details. A matching name or area is a candidate, not identity confirmation. No match is not proof of safety.
Who can see it
Guests can check only whether relevant approved business information may be available. Signed-in active customers can read approved business profiles, full published review history, provider responses and eligible local price aggregates for free. Contributions and payments are not required for customer access. Browser checks and usage limits help prevent automated bulk collection. Business grants do not expose raw prices, identities or evidence. Raw evidence is restricted to its uploader and moderators unless explicitly shared with authorised case participants. Your account identity is not shown with public reviews.
Your choices
Account details are necessary to participate; optional reviews, price contributions, evidence and business enrolment are voluntary. Separate forms explain publication and processing permissions. A reviewer’s permission does not cover another person’s information. Do not submit unnecessary personal data, identity documents or sensitive allegations. Business owners can withdraw publication permission in their workspace. Use Privacy & account to request access, correction, consent withdrawal or a removal review. A minimal account summary is available for download; a full access request is reviewed separately.
Retention and changes
Archive and disable controls restrict use and discovery. They do not automatically erase content. Default review and price retention review dates are two years; case and evidence review dates are one year. These are review deadlines, not promises to retain all content for the full period. A moderator can remove content earlier when required. Retention deadlines and any justified holds must be reviewed by the operator. Operational action records are kept separately with limited actor context. Identifiable history still requires a justified retention period.
Service providers and overseas processing
We use Supabase for authentication, database and private file storage and Vercel for hosting. The configured Supabase project is in Japan. Hosting, authentication delivery, logs and backups may involve processing outside Malaysia. Cross-border safeguards and service-provider arrangements must be assessed before collecting higher-risk information. A displayed notice is not blanket consent for every use.
Requests and contact
Signed-in members can submit requests in Privacy & account. People without an account may raise a concern with the Personal Data Protection Commissioner. Account/business identity erasure, backup expiry and justified holds require an operator review.