Privacy notice

Information we collect

We process your account email, authentication records, store name and settings, team invitations, roles, support correspondence and operational audit records. Our hosting, security and email providers also process technical information such as IP addresses, request details and delivery events. Never send us your password or payment card details by email.

Account and security information is necessary to provide access and protect your workspace. Optional store details can be left blank. Without the required account information, we cannot create or maintain your account.

How and why we use it

We use this information to authenticate users, manage store and team permissions, deliver account and service emails, respond to requests, investigate misuse, recover service after an incident and meet applicable legal obligations. Data comes from you, your authorised team members, your use of the service and delivery or security events from our providers.

We do not sell personal data. Transactional emails are used for account and service operations. Marketing emails require a separate choice; the current pilot does not send marketing campaigns.

Service providers and international processing

Our current providers include Supabase for database, authentication and file storage (projects in Singapore); Vercel for application hosting; Resend for email delivery (configured email region: Tokyo); Cloudflare for DNS; and GitHub for source code and deployment workflows. These providers may process operational or support data internationally. Google Fonts currently supplies fonts to the website and receives the technical information required to serve those requests.

Operational backups, when enabled, are encrypted before being uploaded to a private GitHub Actions artifact store. The recovery private key is kept separately. We restrict access to authorised operators and use providers only for their service purposes. We assess applicable safeguards for processing outside Malaysia. We may disclose information when legally required or necessary to investigate abuse and protect legal rights.

Cookies and advertising

Essential authentication cookies keep you signed in and help protect your session. Disabling them prevents account access. KlikLaku's current pilot does not load Meta Pixel, TikTok Pixel, Google Analytics or advertising cookies.

Before optional analytics or advertising integrations are enabled, we will update this notice and provide the applicable consent choices. A seller's future storefront will need its own notice and consent settings. Browser-level controls do not replace those choices.

Retention and security

We retain account and store information while your workspace is active, and where needed for a specific legal, security or dispute purpose. We review retention when an account is closed and handle access, export and deletion requests through support. Where deletion is appropriate, our operational target is to remove active copies within 30 days after verification; any longer legal retention will be explained.

The planned rolling backup retention is 30 days. Deleted data may remain in encrypted backups until their retention expires; if restored, approved deletions must be reapplied. We use access controls, transport encryption and restricted service credentials. These measures reduce risk but cannot guarantee that every incident will be prevented.

Your choices and requests

You can ask to access or correct your data, request an export or deletion, withdraw optional consent, limit optional processing, or make a privacy complaint using the contact details below. We verify identity proportionately before releasing or changing account data. Rights and any lawful exceptions are assessed under applicable Malaysian law. Withdrawing a choice needed for an optional feature may prevent that feature from working; it does not remove processing required by law.

Sellers are responsible for the customer information they collect through their own businesses. When KlikLaku later processes customer orders on a seller's instructions, requests about those orders should first go to that seller; we will assist within our role. Checkout and customer order processing are not yet available in this pilot.

Updates and contact

We will publish a new version when our data practices change and notify account holders of material changes where appropriate. Contact Shadow Stallion Technology at the email or postal address below for privacy requests and complaints.