Privacy Policy

The PopZ team runs PopZ and is responsible for your personal data. Contact us at support@popz.my.

• Account: your name, email address and password (stored only as a one-way hash). If you sign in with Google, Facebook or Apple, the account ID and email they share with us. Your profile picture, language, and what you use PopZ for (customer, business or seller).
• Vendor pages: what you add to a page, such as its name, category, photos, description, prices, catalog, schedule and places, WhatsApp number, social media links, and for an agent page your company, role and past companies.
• Reviews and activity: your reviews, star ratings, photos, replies, reports, disputes and appeals, and the vendors you follow.
• Location: your phone's location only when you scan a vendor's tag, when you tap "Open here now" for your stall, and when you use "nearby" or the map. Never in the background.
• Device and connection: an ID PopZ creates for your app installation or browser, the device type (for example Android or iPhone), a push notification token, your IP address, and when you sign in and use PopZ.
• Records: when you accepted which version of these documents, and actions our team takes on your account.

We don't ask for your IC number or bank details.

• to create your account, sign you in and send sign-in codes;
• to show your reviews with your name and picture, and vendor pages, to the public;
• to verify visits and stop fake reviews, by checking location, time, device and account against the vendor (for example, owners and staff can't review their own page);
• to detect fraud, spam and abuse, handle reports, disputes and legal requests, and keep PopZ safe;
• to send notifications you ask for, such as when a vendor you follow opens;
• to show what is nearby and open now;
• to improve PopZ using usage statistics;
• to comply with the law and respond to lawful requests from the authorities.

We don't sell your personal data, and we don't use it for advertising by others.

Public: your name, profile picture, reviews and their photos, and vendor pages you create. A vendor's WhatsApp number is shown only if the owner turns on "Show on my page".

Never public: your email, phone number, location history and device details. Vendors never get customers' contact details from PopZ. A page owner sees the name and picture of the staff they add.

Service providers that process data for us under contract, only to run PopZ:

• Supabase: database, sign-in, email codes and file storage;
• Cloudflare: website hosting;
• Google Firebase Cloud Messaging: push notifications;
• Google Maps Platform: maps and place search (the place you search for or pick);
• Google, Facebook and Apple: only when you choose to sign in with them.

We also share data when the law requires it (for example a court order or a request from the police or MCMC), to protect users or PopZ from fraud or harm, or with a buyer if PopZ is sold, who must keep this policy.

Our service providers may store or process data in other countries, such as Singapore or the United States. We only use providers that protect personal data to a standard comparable to the PDPA, as section 129 of the PDPA allows.

• Account data: until you delete your account.
• Scan location and IP address: 12 months, then deleted or turned into statistics that don't identify you.
• Reviews: they stay after you delete your account, shown as "Former PopZ user" without your name or picture, so vendor ratings stay fair.
• Device records and hashed sign-in identifiers: kept after you delete your account, no longer linked to your details, so the rules against self-reviews and resetting reviews keep working. A hash is a one-way code: it can recognise the same email or ID again, but can't be turned back into it.
• Vendor pages: a deleted page is hidden with its reviews, not erased. When you delete your account, your agent page loses your name, photos and contact details.
• Consent, moderation and legal records: as long as needed for disputes and legal claims, at most 7 years.

You can delete your PopZ account and its personal data at any time, in the app or by email.

In the app: open PopZ, go to Profile → Delete account, type DELETE and confirm. It takes effect straight away and signs you out on every device.

Without the app (for example, if you have uninstalled it): email support@popz.my from the email address on your account, with the subject "Delete my PopZ account". If you signed in with Google, Facebook or Apple, write from the email address that account uses, or tell us which one you used. We may ask you to confirm the request, then delete the account within 7 to 14 working days and reply when it is done.

• Deleted: your profile, name, email address, profile picture, sign-in methods and settings, the vendors you follow, and your push notification tokens. Sign-in with Apple is disconnected from PopZ.
• Your agent page: it is hidden and loses your name, photos and contact details. A business page you own is hidden with its reviews.
• Kept: your reviews, shown as "Former PopZ user" without your name or picture; device records and hashed sign-in identifiers, no longer linked to you; scan location and IP address for up to 12 months; consent, moderation and legal records for up to 7 years.

You can also delete individual reviews, replies, posts and pages without deleting your account. Details of what we keep and why are under How long we keep it.

Under the PDPA you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong, incomplete or out of date (you can edit most of it yourself in Profile);
• withdraw your consent or ask us to limit how we use your data, though PopZ may then not be able to provide some features: for example, reviewing needs location;
• ask us to stop processing that is likely to cause you damage or distress;
• ask for your data in a form you can move to another service, where the law provides for it.

Email support@popz.my. We reply within 21 days. We may need to confirm who you are, and may charge the fee the law allows for a copy of your data. You can also complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

An account needs a name and an email address, or sign-in with Google, Facebook or Apple. Reviewing needs your location at the time of the scan, to verify the visit, and "nearby" needs your current location. Everything else is optional. Without the required data we can't provide that part of PopZ.

You can turn location off at any time in your phone's settings; Profile shows whether it is allowed. The camera is used to scan QR codes and take photos, and photos are uploaded only when you choose. You can turn notifications off in your phone's settings.

We use only the cookies the website needs: to keep you signed in, to remember your language, and a browser ID for visit checks and fraud prevention. No advertising cookies and no tracking across other websites.

Data is encrypted in transit (HTTPS), passwords are stored only as hashes, and only authorised team members can see personal data, with their actions logged. No system is perfectly secure. If a breach is likely to harm you, we will tell you and the Commissioner as the law requires.

PopZ is for people aged 13 and over; under-18s need a parent or guardian's consent. If we learn that a child under 13 has an account, we delete it.

We may update this policy. For important changes we ask you to accept the new version before you continue. The date at the top shows the current version. If the English and Bahasa Melayu versions differ, the English version applies.