Privacy Policy

Last updated: on request. This policy is a template — please have it reviewed by a qualified lawyer. It is drafted with Malaysia's Personal Data Protection Act 2010 (PDPA) in mind.

Local Commerce OS ("we", "us") operates Local Commerce OS and respects your privacy. This policy explains what personal data we collect, why, and your rights.

1. Data we collect

• Identity & contact: name, phone/WhatsApp number, email, city/state.
• Account: login credentials (passwords are stored hashed).
• Membership & transactions: merchants you join, points, stamps, vouchers, coupon claims, orders and their contents.
• Usage: QR scans (time, approximate source), device/browser information, and IP address, for security and analytics.

2. How we use your data

To create and run your account and membership; to let merchants you join operate their loyalty programs and fulfil your orders; to send transactional messages (e.g. order and verification messages); to provide support; to keep the Platform secure; and, where you consent, to send offers.

3. Consent

By providing your data and using the Platform you consent to this policy. Where you tick a marketing/WhatsApp consent box, you agree to receive offers; you can withdraw consent at any time (see your rights below).

4. Who we share with

• Merchants you join or buy from — so they can serve you, honour rewards, and fulfil orders. Each merchant is responsible for its own use of your data.
• Payment provider — if you pay online, payment is processed by our gateway (e.g. ToyyibPay); we do not store your card details.
• Messaging provider — to deliver verification and notification messages.
• Service providers — hosting and similar, under confidentiality.

We do not sell your personal data.

5. Cookies & sessions

We use essential cookies to keep you logged in and to run the cart. Disabling them may break parts of the Platform.

6. Retention

We keep personal data only as long as needed for the purposes above or as required by law, then delete or anonymise it.

7. Security

We use reasonable technical and organisational measures (hashed passwords, prepared database queries, access controls). No system is perfectly secure.

8. Your rights (PDPA)

You may request access to or correction of your personal data, and you may withdraw consent to marketing. To exercise these rights, contact .

9. Children

The Platform is not intended for children under the age required to consent under local law.

10. Changes & contact

We may update this policy. For any privacy question or data request, contact us at .