Privacy policy

When you order (customers): your name, mobile number, what you order and any notes; for delivery, your address, map pin, unit and note for the rider; whether and when you said you paid, and any receipt you choose to upload; and when you agreed to share your details.

When you run a shop (sellers): your sign-in email (and your name and email from Google if you sign in with Google); your shop’s name, link, WhatsApp number, logo, menu, opening hours and description; your pickup address, map pin and contact number; your DuitNow QR and account name; your orders, sales, delivery credit and top-ups, with any receipts you upload; and, if you turn them on, your phone’s alert subscription.

Automatically: our servers record technical details such as IP address, browser and pages requested, to run the service and stop abuse. Error reports about crashes are set up not to include names, phone numbers or addresses.

On your own device only: your cart, your recent orders on that shop, your name and number if you tick “Remember my name and number”, and your language choice. These stay in your browser and you can clear them there.

• To pass your order to the seller and let them prepare it, contact you about it and confirm your payment.
• To work out delivery fees and arrange delivery.
• To show you your order’s status, and sellers their orders, sales and credit.
• To run sellers’ accounts, review new shops, and handle top-ups and charges.
• To prevent fake orders and abuse, keep the service secure, and fix problems.
• To answer your questions and complaints, and to meet our legal and accounting duties.

• The seller you order from receives your name, number, order, notes, address (for delivery) and any receipt you upload.
• Delivery partners. When a seller books a delivery partner’s rider for your order, we send the partner your name, mobile number, delivery address, map pin, unit and rider note, with the seller’s pickup details. Our delivery partner is Lalamove, which uses this data under its own privacy policy. When the seller’s own rider delivers, only the seller and their rider get it.
• Service providers who run OrderLokal for us, only as needed for their part: Supabase (database, file storage and sign-in; servers in Singapore), Vercel (website hosting; servers in Singapore and a worldwide network), Resend (emails to sellers and to us), Google (sign-in, for sellers who choose it), OpenStreetMap’s Nominatim and komoot’s Photon (address search and map pins: the place you search for or the pin’s position), OpenStreetMap (map images), Billplz (sellers’ online top-ups, when offered) and Sentry (error reports).
• Authorities, when the law requires it, or to protect someone’s safety or our rights.

We don’t sell personal data, and we don’t use advertising trackers.

Some of these providers store or process data outside Malaysia (for example in Singapore, Japan, the European Union or the United States). We use providers that protect it to a standard comparable to the PDPA.

We keep orders, receipts, and sellers’ credit and top-up records for as long as the seller’s shop is open and then up to 7 years, as business and accounting records. Seller account details are kept while the account is open. Server logs are kept for a short time. After that we delete data or remove what identifies you.

Data travels encrypted. Each seller can see only their own shop’s orders. Payment receipts are kept in private storage and opened only by the seller and our admins through links that expire within minutes. Your order page is reached through a long, hard-to-guess link: share it only with people you trust.

Under the PDPA you can ask us:

• for a copy of the personal data we hold about you;
• to correct data that is wrong or out of date;
• to stop using your data, or to delete it, where we don’t need to keep it for the reasons above.

Giving your name, number and (for delivery) address is required to order: without them the seller can’t prepare or deliver your order. To make a request, contact us with the order number or phone number it concerns. We answer within 21 days. The seller also holds your order details; you can ask them directly too.

We use a cookie to remember your language, and sellers’ sign-in cookies to keep them signed in. We don’t use advertising or tracking cookies.

We will update this page when our use of data changes, and change the date at the top. If the English and Bahasa Melayu versions differ, the English version applies.

Questions or requests about your data: email onemassenterprise@gmail.com or WhatsApp +60 17-299 7924.