Delete your account

Delete your Bolehlah account

You can request deletion of your Bolehlah Member account and the personal data we hold for you at any time. Here's exactly what happens and how to do it.

The two-minute path

1Email hello@bolehlah.ai from the email address registered on your Bolehlah account, with the subject line “Account deletion request”.
2We'll reply within 2 business days with a secure verification link. Open it on the device where you have the Bolehlah Member app installed, complete the same Face ID / eKYC check you used at sign-up, then confirm. This step prevents a stolen device or a hostile party from triggering deletion against your wishes.
3Once verified, we begin deletion immediately. Most of your data is wiped within 7 days. A small set of records with statutory retention obligations (loan ledger entries, completed AKAD agreements, audit-trail evidence) is kept under encryption for the period required by Malaysian law (typically 7 years per BNM / PDPA Schedule 4) and then deleted. While those records exist they are not used for any other purpose and are not visible inside the app.

What we delete

Your name, NRIC, email, phone number, address, and any other personal identifiers we hold.
Your account credentials (password hash, biometric / Face ID enrolment, TOTP secret, recovery codes).
eKYC artifacts (IC scan, selfie, liveness video) once retention windows pass.
Chat history with B and any member-portal personalisation data.
Device identifiers and push tokens linked to your account.
Bolehlah Points balance and reward history (you forfeit any unredeemed points on deletion).
Mobile-app pairing entries (linked devices, QR-pairing tokens).

What we're required to keep (and for how long)

Malaysian financial-services law requires some records to be retained even after a customer relationship ends. For accounts that have ever held a loan with a partner lender on Bolehlah, the following are kept under encryption for the legally required period and then deleted:

Loan ledger and repayment history — kept by the lender of record (your koperasi or licensed lender) for as long as their regulator (typically BNM / SKM) requires, usually 7 years from the closing date of the loan.
Signed AKAD agreement — kept for the statutory retention period (Contracts Act 1950 / Stamp Act).
Audit-trail entries — append-only hash-chained evidence of every action taken on your account; required for dispute resolution and regulatory inspection.

PII inside these records is scrubbed or pseudonymised wherever the underlying obligation allows; the rest stays encrypted until its retention window closes and is then permanently deleted.

Partial deletion (without closing your account)

If you want to remove a specific piece of data without closing your account — for example, a phone number you no longer use, or your chat history with B — open the Bolehlah Member app, go to Profile → Privacy, and tap the item you want to remove. Most partial-deletion requests complete instantly in-app. For anything that can't be removed from the in-app controls, email hello@bolehlah.ai.

What if I have an active loan?

If you have an active loan with a partner lender, your in-app experience (chat, score, payment reminders) will be deactivated on the day we receive your verified request, but your loan obligation to the lender of record continues. You can still pay the lender directly. Once the loan closes, the retention clock starts and the remaining data is purged on the schedule above. We'll never continue to chat or message you on a deactivated account.