Privacy Notice

1. Introduction

1.1 Garaj is currently operated by Eugene Koh Vee Jin, trading as "Garaj" ("Garaj", "we", "us" or "our"). We respect your privacy and are committed to protecting your personal data.

1.2 This Privacy Notice explains how we collect, use, disclose, store and otherwise process your personal data when you use the Garaj mobile application, website and related services (collectively, the "App").

1.3 By using the App, you acknowledge that your personal data will be collected, used, disclosed, stored and otherwise processed in accordance with this Privacy Notice and applicable law.

1.4 Where we process personal data based on your consent, you may withdraw your consent at any time by contacting us using the details in Section 11. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal and may affect our ability to provide certain features or services.

1.5 References in this Privacy Notice to a "vehicle" include any type of vehicle supported by the App from time to time, which currently includes cars and motorcycles. The categories of vehicle-related personal data described in Section 2 apply equally to any vehicle type the App supports.

1.6 The App is intended for people aged 18 or over. Please do not use the App or give us personal data if you are under 18. If we learn that we have collected personal data from a person under 18 without any parental or guardian consent required by law, we will delete it. We ask for your date of birth when you create your account to help us check this.

1.7 BeBo Labs PLT, a limited liability partnership, is being registered in Malaysia to operate Garaj. When it is registered, Eugene Koh Vee Jin will transfer the operation of the App, and the personal data held for it, to BeBo Labs PLT, which will then be responsible for your personal data under this Privacy Notice. We will tell you through the App or by email when this happens. The transfer will not reduce your rights under this Privacy Notice.

2. Personal Data We Collect

2.1 We may collect and process the following types of personal data:

2.2 Account Information

2.2.1 Name

2.2.2 Email address

2.2.3 Username and login credentials

2.2.4 Contact details you provide, such as your phone number (optional)

2.2.5 Your date of birth, which you give us when you create your account (see 3.1.12 and 3.1.13).

2.3 Vehicle Information

2.3.1 Vehicle make, model and year

2.3.2 Vehicle registration number

2.3.3 Mileage information

2.3.4 Service and maintenance records

2.3.5 Road tax and insurance expiry information

2.3.6 Vehicle modifications and configuration information

2.4 Area and Usage Information

2.4.1 The area (state and town) you choose to give us, and the mileage, trip, track and usage records you enter into the App;

2.4.2 Information generated through your use of the App and vehicle-related features; and

2.4.3 Information relating to your interactions with workshops, insurers, fleet operators, marketplaces or other third-party service providers.

2.4.4 The App does not currently collect your device's GPS or other precise location and does not currently ask for location permission. If that changes, we will ask for your permission first and update this Privacy Notice.

2.5 User Content

2.5.1 Photographs

2.5.2 Documents

2.5.3 Notes

2.5.4 Service history records

2.5.5 Other information uploaded or entered into the App; and

2.5.6 Photographs of workshop receipts, which we keep with the related service entry so that you can view them later.

2.6 You should not upload personal data relating to another person unless you are authorised to do so and have provided any notices or obtained any consent required by applicable law.

2.7 Depending on the features you use, Garaj may also process vehicle identifiers and ownership-related information, service invoices or documents, diagnostic trouble codes or scan information, vehicle configuration and modification information, performance information, track or usage records, and information contained in photographs or uploaded documents.

2.8 Technical Information

2.8.1 Device information, including a push notification token if you turn on push notifications

2.8.2 IP address

2.8.3 App usage information

2.8.4 Diagnostic and performance data, including crash reports

2.9 The provision of certain personal data may be necessary for Garaj to create your account, provide the App and deliver particular features or services. Other information may be provided voluntarily. If you do not provide information that is necessary for a particular purpose, Garaj may be unable to create your account, provide the relevant feature or respond to your request.

2.10 If you use an in-app question-and-answer or AI assistant feature (such as "Ask garaj"), Garaj collects and stores the text of your question and the response provided, together with related technical metadata such as which categories of your vehicle information the response drew on. To answer, Garaj sends your question and a snapshot of the relevant vehicle record (for example service and maintenance records, component status, diagnostic codes and modifications) to an AI service provider. The snapshot does not include your email address, phone number or vehicle registration number. Your question is sent as you typed it, so please do not put personal details in it. You can report an answer you think is wrong, offensive or unsafe using the report option shown with each answer. When you do, we keep the question, the answer and the reason you give, so that we can review it and improve the feature.

2.11 If you use the receipt-scanning feature, the photograph you take or choose is sent to an AI service provider so that it can read the receipt and suggest details for you to check. The photograph may show information such as the workshop name, a customer name, a vehicle registration number, dates and amounts. Nothing from a scan is saved to your records until you confirm it. If you confirm, the photograph is kept as described in 2.5.6.

2.12 If you join our launch list on our website, we collect your email address and a record of your consent, and use them only to send the launch updates you agreed to.

3. How We Use Your Personal Data

3.1 We may use your personal data to:

3.1.1 create, verify and manage your account;

3.1.2 provide, operate, maintain and personalise the App;

3.1.3 store and display vehicle information, records and documents;

3.1.4 provide maintenance reminders, notifications, summaries and recommendations, by email, push notification and, where available and where you have chosen to receive them, WhatsApp or SMS;

3.1.5 process payments and support transactions, where applicable;

3.1.6 respond to enquiries, provide customer support and communicate with you;

3.1.7 improve, develop, test and enhance the App and its features;

3.1.8 monitor performance, security and reliability, detect abuse and prevent fraud;

3.1.9 comply with applicable legal and regulatory requirements;

3.1.10 establish, exercise or defend legal claims and protect our rights and interests;

3.1.11 show you suggestions that are relevant to the area you gave us, such as nearby workshops;

3.1.12 confirm that you are 18 or over; and

3.1.13 if you have separately agreed to receive marketing, send you a greeting on your birthday.

3.2 Garaj may use rules, algorithms or artificial intelligence to organise information, estimate maintenance timing, identify patterns, generate summaries or provide recommendations. These outputs are provided for general informational purposes only and may not be complete or accurate. They are not a substitute for professional automotive, mechanical, safety or other technical assessment. You should obtain appropriate professional advice before relying on any recommendation that may affect the safety, maintenance or operation of a vehicle.

3.3 Unless otherwise stated, these processes do not make decisions producing legal or similarly significant effects about you. Where applicable law requires additional notice, consent, human review or other safeguards for automated decision-making or profiling, Garaj will implement those requirements.

3.4 Maintenance reminders are service messages that you have asked for. They are not marketing and will not contain promotions. We will send you marketing messages only if you have separately agreed to receive them, and you can withdraw that agreement at any time. Not agreeing to marketing does not affect your reminders.

3.5 We use your phone number only for the reminders you have chosen (including switching on WhatsApp reminders for you when they become available) and to respond to you if you contact us. We do not use it for marketing unless you have separately agreed.

3.6 We use your date of birth only to confirm that you are 18 or over and, if you have separately agreed to marketing, to send you a birthday greeting. We do not use it for any other purpose, and we delete it when you delete your account.

4. Disclosure of Personal Data

4.1 We may disclose your personal data to:

4.1.1 Service providers who help us operate the App;

4.1.2 Cloud hosting and technology providers;

4.1.3 Professional advisers, auditors and insurers;

4.1.4 Regulatory authorities, law enforcement agencies or government bodies where required by law; and

4.1.5 Any other party with your consent or as otherwise permitted by law.

4.2 Garaj does not sell your personal data, and does not share your phone number or area with workshops, brands or other third parties for their own marketing.

4.3 Where Garaj provides shared-vehicle, family, fleet, workshop, insurance, marketplace, diagnostic or other third-party functionality, your personal data may be disclosed to the relevant users, service providers or third parties to the extent reasonably necessary to provide that functionality, subject to applicable law and any required permissions or consents. We may also disclose personal data to a purchaser, investor, successor or other relevant party in connection with a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, subject to applicable law.

4.4 If you choose to generate and share a paid vehicle history report, Garaj will disclose the personal data and vehicle information contained in that report — which may include service and maintenance history, mileage records and plausibility indicators, receipts, and workshop information — to the recipient(s) you choose to share it with. Generating and sharing a report is at your own initiative; Garaj does not control who you share a report with or what a recipient does with the information in it.

4.5 Garaj may in the future offer a feature allowing vehicle history information to be shared with a vehicle dealer or similar business in connection with the sale of a vehicle, so that a prospective buyer sourced through that dealer has access to the vehicle's history. If and when such a feature is introduced, Garaj will provide further information about what data is shared, with whom, and on what basis.

4.6 Third-party services may have their own privacy practices. Where you interact directly with a third party, that third party's privacy notice and terms may apply.

4.7 If you invite another person to a vehicle as a driver or viewer, that person can see the vehicle's records, and they will see your name or a partly hidden version of your email address as the owner. You can remove people you have shared with at any time, and a person you have shared with can leave.

4.8 If you transfer a vehicle to a buyer using a transfer code, the buyer, once they accept, receives a copy of the vehicle details (including its registration number), mileage readings, service and maintenance history (what was done, when and at what mileage), modifications and any open warning-light or fault-code issues. Receipts, photographs, notes, costs and workshop names are not transferred. After the transfer, the vehicle in your account becomes a retired, read-only record that cannot be reactivated, and it stays in your account until you delete it or your account. If you enter a sale price, Garaj stores it with the transfer record and may use it, together with other owners' sale prices, in an aggregated or de-identified form to understand vehicle market pricing. It is not disclosed to the buyer or any other individual user.

5. Third-Party Services and Cross-Border Processing

5.1 The App may contain links to or integrate with third-party products and services. If you use or interact directly with a third-party service, that third party may collect and process your personal data independently. The third party's privacy notice and terms may apply to that processing.

5.2 Garaj may use service providers, cloud infrastructure, analytics providers, authentication providers, payment providers, communications providers and other technology providers that process personal data in Malaysia or other countries. These providers may access or process personal data from locations outside Malaysia.

5.3 Where personal data is transferred or made accessible outside Malaysia, Garaj will take reasonable steps to ensure that the transfer is carried out in accordance with applicable law and that appropriate contractual, technical or organisational safeguards are in place.

5.4 At the date of this version, our main service providers are: Supabase (database, sign-in and file storage, hosted in Singapore); Google (AI processing through the Gemini API, and crash reporting through Firebase Crashlytics); Resend (sending reminder emails); and Expo (delivering push notifications through Apple's and Google's push services). Apple and Google also handle app downloads and, when subscriptions are offered, payments, under their own terms.

5.5 Garaj uses a paid tier of Google's Gemini API for its AI features. Under Google's published terms for paid services, Google does not use the prompts or responses to improve its products and logs them only for a limited period to detect and prevent misuse.

6. Data Security

6.1 We take reasonable technical and organisational measures to protect personal data from unauthorised access, use, disclosure, alteration or destruction. However, no method of electronic storage or transmission is completely secure, and Garaj cannot guarantee the absolute security of personal data.

6.2 Garaj maintains procedures for identifying, assessing, managing and responding to personal data breaches and will notify the relevant authorities and affected individuals where required by applicable law.

7. Data Retention and Deletion

7.1 We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Notice, comply with legal obligations, resolve disputes and enforce our rights. We may delete or anonymise personal data when it is no longer required.

7.2 You can delete your account at any time in the App (Profile → Delete account). This deletes your account and the vehicles you own in the App, together with their records, photographs and documents. If you cannot use the App, you can ask us to delete your account by following the instructions at garaj.my/delete-account or by emailing hello@garaj.my from the email address registered to your account. Deletion may be subject to verification and may not result in immediate deletion of every copy where retention is reasonably necessary for legal obligations, security, fraud prevention, dispute resolution, accounting, enforcement of rights or other lawful purposes. Vehicles you have already transferred to a buyer stay with the buyer as described in 4.8.

7.3 Different categories of personal data may be retained for different periods depending on the purpose for which they were collected, applicable legal and regulatory requirements, and the need to establish, exercise or defend legal claims. Garaj maintains retention and disposal practices designed to ensure that personal data is not retained longer than necessary.

7.4 Question and response data collected through an in-app AI assistant feature, and the details read from scanned receipts, are retained; after 90 days, Garaj removes information that could identify you or your vehicle from that data (such as account, user and vehicle identifiers and any identifying details within the question or response text itself), and the remaining aggregated or de-identified data may be retained indefinitely.

7.5 If you report an answer from an in-app AI assistant feature, we keep the report (the question, the answer and the reason you gave) for as long as we need it to review the report and improve the feature, and in any case we remove information that could identify you from it on the same basis as in 7.4.

8. Your Rights

8.1 Subject to applicable law, you may request:

8.1.1 access to your personal data;

8.1.2 correction of inaccurate or incomplete personal data;

8.1.3 withdrawal of consent where processing is based on your consent;

8.1.4 deletion of your account or personal data, subject to applicable retention requirements; and

8.1.5 where applicable, transfer of your personal data to another data controller, subject to technical feasibility, compatibility and other applicable requirements.

8.2 Depending on applicable law and the circumstances, you may have additional rights or remedies, including rights relating to objection, restriction or withdrawal of consent.

8.3 Requests should be submitted to the contact details in Section 11. Garaj may need to verify your identity before processing a request. Requests will be handled subject to applicable legal exceptions, requirements, fees and time limits. We aim to respond to access and correction requests within 21 days. Withdrawal of consent or deletion of personal data may affect Garaj's ability to provide certain features or services.

9. Analytics and Tracking Technologies

9.1 Garaj may use cookies, device identifiers, software development kits, analytics tools, crash-reporting tools and similar technologies to operate, secure and improve the App, understand how users interact with the App, monitor performance, detect abuse and prevent fraud.

9.2 We may also use aggregated, statistical or anonymised information that does not identify you for analytics, reporting, research, product development and service improvement purposes.

9.3 Where the App uses precise location, background location or similar tracking technologies, the relevant permissions and consent choices will be presented through the App or your device settings. You may disable certain permissions, but doing so may affect the availability or functionality of certain features.

9.4 Where optional consent controls are required by applicable law, they will be presented through the relevant product interface.

9.5 At the date of this version, the App uses crash-reporting tools (Firebase Crashlytics, provided by Google) and device identifiers to operate, secure and improve the App. The App does not currently use advertising services and does not track you across other companies' apps or websites.

10. Changes to this Privacy Notice

10.1 We may update this Privacy Notice from time to time. Any updated version will be made available through the App or by other reasonable means and will state its effective date. Where an update materially affects how Garaj uses personal data, Garaj will provide additional notice or obtain consent where required by applicable law. Your continued use of the App after the effective date of an updated Privacy Notice will constitute acknowledgement of the update, to the extent permitted by law.

11. Contact Us

11.1 If you have any questions about this Privacy Notice, wish to make a privacy request or have a concern about Garaj's handling of personal data, please contact:

11.2 Email: hello@garaj.my

11.3 Operator: Eugene Koh Vee Jin, trading as Garaj. Postal address available on request by email.

11.4 Garaj may appoint or designate a Data Protection Officer where required by applicable law.