Privacy Policy
1 · What we collect
- Checkout details — your name, email, shop name, WhatsApp number, and optional Instagram handle, collected by Stripe when you buy a package. We never see or store your card number.
- Campaign materials — shop details, offers, photos and messages you send us (mainly via WhatsApp) so we can produce your campaign.
- Basic site analytics — anonymous page-view metrics (Vercel Web Analytics). No advertising cookies, no cross-site tracking by us.
- Voucher Mode (merchants) — your brand name, WhatsApp number, optional logo, offer details and staff PIN (stored only as a salted hash) when you create a free DIY campaign.
- Voucher Mode (customers) — the phone number you enter to claim a DIY voucher, and whether/when it was redeemed. If you report a campaign, we also keep the report text and your IP address for abuse prevention.
2 · What we use it for
To deliver what you bought: process payment, design and publish your voucher or commercial, contact you for approvals, send your results report, keep required accounting records, and improve the site. That's it — we don't sell your data and we don't send third-party marketing.
3 · Who processes it with us
- Stripe — payment processing and receipts.
- Vercel — website hosting, anonymous analytics, and merchant logo storage (Vercel Blob).
- Neon — secure database where order and DIY campaign records are stored.
- Meta / Instagram & WhatsApp — campaign publishing and our communication channel with you.
Each processes data under its own safeguards; some are located outside Malaysia.
4 · Public campaign content
The point of a campaign is publicity: your shop name, offer, and approved creative are published on our channels. Ask us to take a campaign post down any time after it ends.
5 · Voucher Mode — who sees your number
When you claim a DIY voucher, your phone number is used to issue your voucher code and stop double claims. It is shown to one party only: the merchant running that campaign, so they can serve your redemption and follow up about their own offers. The merchant acts as an independent data user under the PDPA for that use — if you no longer want their messages, tell them to delete your number (and you can report abuse to us via the link on any voucher page). We never publish claimant numbers, never share them with other merchants, and never use them for our own marketing.
DIY merchant data (brand, WhatsApp number, logo, offer) appears on your public voucher page and images — that's the point of the campaign. Staff PINs are stored only as salted hashes and manage links only as one-way hashes — we cannot read either back.
6 · Retention & your rights
Order records are kept as long as Malaysian accounting law requires; campaign materials are kept while useful for your campaigns. DIY campaign records, including claim phone numbers, are kept for up to 12 months after the campaign ends (for redemption disputes and abuse prevention), then deleted or anonymised. Under the PDPA you may request access to or correction of your personal data, or ask us to delete data we're not legally required to keep.
7 · Contact
Privacy requests: WhatsApp +60 11-1797 1289. We respond fast — it's the same number that runs your campaign.