Kad.Digital

Draft template. Fill in the highlighted details and have a Malaysian lawyer review this notice before you take real orders. The periods shown match the defaults in Admin › Settings; if you change them there, change them here too.

Privacy Notice

Last updated: [DATE] · Issued under the Personal Data Protection Act 2010 (PDPA)

In short

  • We collect only what we need to make your card, contact you about your order, and show your guests' RSVPs to you.
  • We do not sell your data, show ads, or use tracking or advertising cookies.
  • Personal data is deleted automatically after your card's live period ends. Payment records are kept for accounting.
  • You can ask to see, correct or delete your data at any time.

1. Who we are

Kad Digital is a small business run by [YOUR FULL NAME][, SSM registration no. if registered], who is the data controller for the personal data described here. Data Protection Officer / contact: [NAME], [EMAIL], WhatsApp [+60 XX-XXX XXXX].

2. What we collect

From you, when you design or order a card

  • Order details: your name, WhatsApp number, email (optional), event date, and the time you agreed to this notice and to being contacted on WhatsApp.
  • Card content: what you type or upload into the card, such as the couple's names, the hosts' names, event date and venue, contact names and phone numbers, photos, a music link, and bank details for gifts (salam kaut).
  • Payment records: the amount, date, bank reference and, if you send one, a screenshot of your transfer.
  • Messages: what you send us on WhatsApp.

From your guests, when they reply to your card

  • Name, whether they are attending, number of people, and their wishes message.

Collected automatically

  • A one-way scrambled ("hashed") version of your internet address, used to stop spam and abuse. We cannot turn it back into your address.
  • Basic technical logs kept by our hosting provider for security.

Name, WhatsApp number and event date are required to place an order. If you do not provide them, we cannot process your order. Everything else is optional.

Other people's data: if you add family members' names, phone numbers or photos to your card, please make sure they agree to this.

3. Why we use it

  • To build, save, publish and host your card, and to let you continue a saved draft on another device.
  • To contact you on WhatsApp about your order, price, payment and card links.
  • To verify payments and keep accounting records.
  • To show your guests' RSVPs and wishes to you, and wishes on the card if you turn that on.
  • To keep the service secure and prevent spam and abuse.
  • To meet our legal obligations.

We do not use your data for advertising and we do not send marketing messages unless you separately agree.

4. Who we share it with

We do not sell or rent personal data. We share it only with:

  • Our team, who need it to handle your order (each person has their own login).
  • Service providers that run the website for us: Cloudflare (hosting, photo storage, security and bot protection) and Supabase (database). They process data only on our instructions.
  • Your guests, who see what you put on the public card.
  • Authorities, when the law requires it.

Some features connect to other companies only when used: page fonts are loaded from Google Fonts; buttons for WhatsApp, Google Maps, Waze and Google Calendar open those services when you or your guests tap them; and a music link plays from wherever it is hosted. Their own privacy policies apply.

5. Where your data is stored

Our database is hosted in Singapore, and our hosting provider serves pages from data centres around the world. This means your data may be transferred outside Malaysia. We choose providers with strong security and contractual safeguards so that your data is protected to a standard comparable to the PDPA.

6. How long we keep it

DataHow long
Saved drafts ("Save for later")[30] days after the last change, then deleted
Unpaid or cancelled ordersOrder expires after [7] days unpaid; personal data deleted [90] days after it expires or is cancelled
Published cards, RSVPs and wishesLive until [60] days after the event; card photos are deleted 14 days after that; other personal data, RSVPs and payment screenshots are deleted [180] days later
Payment records (amount, date, bank reference, order reference)[7] years, for accounting and tax
Hashed internet address for spam protection24 hours (on orders: deleted with the order's personal data)
Data saved in your own browserUntil you delete the card or clear your browser data

Deletion runs automatically every day.

7. Cookies and browser storage

We do not use advertising or tracking cookies, or analytics. Your browser stores your card drafts, your language choice (EN/BM) and whether you paused animations, so the site works for you. This stays on your device. Our staff portal uses one security cookie to keep staff signed in.

8. How we protect it

  • All connections are encrypted (HTTPS).
  • The database is not publicly accessible; only our server can read it.
  • Staff passwords are stored scrambled, and staff sign in with their own accounts.
  • Order, draft and manage links use long random codes that cannot be guessed. Please keep them private.

If a data breach is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner and you, as required by law.

9. Your rights

Under the PDPA you can:

  • access the personal data we hold about you;
  • correct data that is inaccurate or out of date;
  • withdraw consent or ask us to stop processing, and ask us to delete your data;
  • ask us to send your data to you or another organisation in a common format (data portability); and
  • refuse direct marketing.

Contact us using the details in section 1. We will reply within 21 days. We may need to confirm your identity first, for example by asking you to message us from the WhatsApp number on your order. Some data, such as payment records, may need to be kept for legal reasons even if you ask us to delete it.

Your guests can contact us too. We will usually work with you, as the couple, on requests about your guest list.

10. Children

Our service is for adults. We do not knowingly collect data from children, except where a parent or guardian adds a child's name to their own family's card.

11. Changes to this notice

We may update this notice. We will show the date of the latest update at the top of this page, and tell existing customers about important changes.

12. Questions and complaints

Contact us first: [EMAIL] or WhatsApp [+60 XX-XXX XXXX]. If you are not satisfied, you can complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.

This notice is provided in English and Bahasa Melayu.