1. Who controls your data
MTIS Sdn Bhd (registration number 884496-U / 200901041346), F-1-03 (A), Level 3, Block F, SetiaWalk, Persiaran Wawasan, Pusat Bandar Puchong, 47160 Puchong, Selangor, Malaysia, is the data controller for personal data collected through the MTIS app and website. Contact: info@mtis-malaysia.com.
2. What we collect
- Account data: name, email address, organisation, tier and subscription details.
- Case data: documents, photographs, audio recordings and descriptions you upload for a specific investigation, and the AI-generated clarification answers, diagnoses and reports produced from them. Audio recordings are transcribed to text and the transcript is added to your case description — see Section 5.
- Billing and entitlement data: invoices, quotations, payment confirmations and allowance history.
- Usage and audit data: login activity, API and AI usage against your allowance, and administrative actions taken on your account. See Section 8.
3. Why we collect it
- To operate your account and deliver the failure investigation service you request.
- To generate app reports and, where purchased, professional-service deliverables.
- To bill you and confirm payment.
- To enforce fair use and tier limits. See the Fair Use Policy.
- To maintain an audit trail of account and case actions.
4. Who can see your case data
- You, and, where applicable, other verified, separately licensed named users within your organisation account, each using their own credentials.
- Authorised MTIS staff, where necessary for professional review or account administration. Staff access is role-controlled and every access is logged in an append-only audit record.
- Customers cannot see other customers’ cases under any tier.
5. AI processing of your data
Your uploaded case material is processed by an AI-assisted engine to generate clarification questions, diagnoses and reports. Clarification questions are generated from your own case evidence. MTIS’s internal proprietary knowledge base is never disclosed to you or derived from in a way that exposes its content.
What is sent for AI processing. The engine works from the text extracted from your documents. Photographs are additionally processed by an image step that records descriptions of what is visible; where this runs, a reduced-resolution copy of the photograph is sent to the AI service, and embedded metadata such as GPS coordinates, device identifiers and camera timestamps is removed before it is sent. Audio recordings are sent to a third-party speech-to-text service to be transcribed; the recording itself leaves MTIS systems for that purpose, and the resulting transcript is added to your case description, where it is visible to you and can be edited. Anything spoken in a recording — including names, employers, locations and third-party information — will therefore appear in the case text, so do not narrate anything you would not type. Material extracted from your uploads is handled as untrusted case data rather than as instructions to the AI.
AI processing uses more than one external service provider: a language model for diagnosis and image observations, and a separate speech-to-text provider for transcription, each with its own hosting arrangements and its own processing locations. Where AI processing involves an external AI service provider, MTIS will disclose that separately once the relevant provider and hosting arrangements are finalised. This staging notice does not state or imply that the provider, processing location or related cross-border arrangements have been finalised. See also the AI limitations page.
6. Retention and deletion
- Case data is deleted from the live system 90 days after the case’s last activity, where technically practical, with a warning sent to you 7 days beforehand.
- You may request an extension to this period directly from MTIS. Extensions are considered and quoted case by case; there is no self-service extension.
- Deleting a case from the live system removes your live uploads, AI outputs and reports from that system.
- MTIS keeps only the minimum billing, entitlement and audit records needed after a case is deleted — not your case content.
7. Backups — an important distinction
Deleting a case from the live system is not the same as permanent erasure everywhere. MTIS maintains secure, dated backups that may retain a copy of deleted case data for a longer period than the live system, for disaster-recovery purposes. Backups are not routinely searchable or accessible on demand.
If you need data recovered from a backup after live deletion, this is a separate, bespoke, paid, request-only, non-guaranteed restoration service. See Section 9.
8. Audit logging
MTIS keeps a separate, append-only audit log of case-related and account-related actions, recording the case number, actor, action, timestamp, result and old/new values where applicable. This log exists to protect you by allowing MTIS to detect and investigate misuse of staff access. It does not contain your case evidence or report content.
9. Restoration requests
If you need data restored after deletion from the live system, contact info@mtis-malaysia.com. You will need to demonstrate ownership of, or authority over, the case. Restoration is a bespoke paid service and MTIS cannot guarantee that restoration will be possible, depending on backup availability, elapsed time and technical feasibility.
10. Security — realistic statement
MTIS applies reasonable technical and organisational safeguards to protect personal and case data, including role-controlled staff access, audit logging, and validation of every uploaded file against its actual content signature. However, no online system can be guaranteed completely secure, and MTIS does not claim absolute confidentiality or guaranteed security for data submitted to the Service. You should consider this when deciding what to upload.
11. International transfers
The Service is operated from Malaysia. If any part of processing, such as AI processing by a third-party provider, involves transferring data outside Malaysia, MTIS will disclose this once the relevant provider and hosting arrangements are finalised. This staging notice does not state that international transfers will or will not occur, and does not present unresolved provider or cross-border details as final.
12. Your rights
Subject to applicable Malaysian law, you may request access to, correction of or deletion of your personal data by contacting info@mtis-malaysia.com. Deletion requests are subject to the minimum billing, entitlement and audit retention described in Section 6.
13. Policy acceptance and version history
- Before you first use the Service, you must explicitly accept this Privacy Notice, the Terms of Use, the Fair Use Policy, and a separate consent to external AI processing of your case data as described in Section 5.
- You are not required to re-accept later revisions of this notice. Section 14 explains how you are told about material changes instead.
- This notice may change from time to time. You should regularly review this designated policy page for the current version.
- MTIS records the version of this notice, and the other documents listed above, that you accepted and the timestamp of your first acceptance against your account.
14. Changes to this notice
MTIS may update this notice from time to time. Material changes will be notified via the app or by email before they take effect.
15. Contact
MTIS Sdn Bhd
F-1-03 (A), Level 3, Block F, SetiaWalk, Persiaran Wawasan, Pusat Bandar Puchong, 47160 Puchong, Selangor, Malaysia
Email: info@mtis-malaysia.com
Other public routes: Contact MTIS
Related information: Failure Investigation Assistant overview · Pricing and limits · Professional review services