Legal

Privacy Policy

Last updated 5 October 2026

This policy explains what personal data kedai.store collects, why, who we share it with, and what you can ask us to do about it. It is written to be read, not to be skimmed past.

1. Who we are

kedai.store is an ecommerce platform for Malaysian shops. We provide the storefront, the order management and the wallet a shop uses to pay our transaction fee. We are the data controller for the account you create with us, and a data processor for the orders your customers place with you.

Contact for anything on this page: [email protected], or by post to Gamuda Square, Bandar Gamuda Garden, 48050 Rawang, Selangor Darul Ehsan, Malaysia.

2. Two roles, and why the difference matters

When you sign up and run a shop, we decide how your account data is used. You are the seller, and you decide what to do with the orders your customers place. We hold that order data on your behalf and follow your instructions. If a customer asks you to correct or delete their details, you are the one who answers them, and we will help you do it.

3. What we collect

• Account: your name, email address, and a password hash. If you sign in with Google, we receive your name, email address, profile picture and Google's identifier for you. We do not receive your Google password.
• Shop: the shop name, its address on kedai.store, the products you publish, their prices and photographs, and the theme you choose.
• Orders: for each order placed in your shop, we hold the customer's name, email address, phone number, delivery address, what they bought and what they paid. This is your customer data.
• Wallet and fees: top-ups, the fee charged on each sale, and any adjustment made to your account. This is a financial record, and we keep it.
• Technical: IP address, browser type, and the times you sign in. We use this to keep the platform working and to notice abuse.
• Usage: which pages were opened, when, roughly where the request came from, and what kind of device made it, through Google Analytics. Section 6 says exactly what that records and what it does not.

We do not collect your customers' payment card details. When a shop is connected to a payment gateway, the customer pays the gateway directly, on the shop's own gateway account.

3A. Where it comes from, and whether you must give it

We receive account data from you, and from Google if you choose to sign in with Google. Order data comes from the customer placing the order. Giving your name, email address and a password is obligatory to open an account, because we cannot provide the service without them; everything else, such as product photographs or a chosen theme, is voluntary. If you decline to provide what is obligatory, we cannot open the account or run the shop.

4. Why we collect it

• To create and operate your account and your shop.
• To publish your shop and process the orders placed in it.
• To calculate and charge our transaction fee, and to keep records of it.
• To keep the platform secure, and to detect fraud or abuse.
• To answer you when you contact us.
• To understand which pages are used, so we know what to improve.

Under the Personal Data Protection Act 2010, we rely on your consent, on the need to perform our agreement with you, and on our legitimate interest in keeping the platform secure and operating. We do not sell personal data, and we do not use it for advertising.

5. Who we share it with

We use a small number of service providers, and they may only use the data to provide their service to us:

• DigitalOcean: hosting, including the database that holds your shop.
• Cloudflare: DNS and network protection for kedai.store.
• Google: sign-in, when you choose to use it.
• Google Analytics: counting visits to the pages we serve, so we can see which parts of the platform are used and which are not.
• Payment gateways: where a shop has connected one, so the customer's payment can be taken and confirmed.

We may also disclose data where the law requires it. Some of these providers operate outside Malaysia, so your data may be transferred and stored abroad; we choose providers that apply comparable protections.

6. Cookies and local storage

We use a session cookie to keep you signed in while you work in the portal, and we store an access token in your browser's local storage so your phone does not ask you to sign in every time you open it.

We also count visits with Google Analytics, which sets its own cookies and records which pages were opened, when, roughly where the request came from, and what kind of device made it. It covers the pages open to everyone and the portal alike. It records the address of a page, never the contents of what you type into it, and we do not send it your name or your email address. It is not used to advertise to you, and it does not follow you to other websites.

7. How long we keep it

• Account and shop data: while your account is open, and for a period afterwards in case you return.
• Orders and wallet records: kept as financial records, because the fee we charged has to remain explainable.
• Technical logs: a short period, then deleted.

If you close your account, we will tell you what we are keeping and why, and delete everything we are not required to keep.

8. Your rights

Under the Personal Data Protection Act 2010 you may ask to see the personal data we hold about you, ask us to correct it, limit how we use it, or withdraw your consent to us using it. Write to [email protected] and we will respond within the period the Act allows. Withdrawing consent for something we must do to run your shop may mean we can no longer run it.

8A. If there is a breach

If a personal data breach causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected, within the period the law allows. We would rather tell you early and plainly than quietly.

9. Security

Traffic is encrypted in transit. Passwords are stored as hashes, never in a form we can read. Access to production data is limited to those who need it to operate the platform.

10. Children

kedai.store is for people running a business. It is not intended for children, and we do not knowingly collect their data.

11. Changes

If this policy changes in a way that affects you, we will tell you in the portal before the change takes effect.