Privacy Policy

The JoySaves shopping app, JoySaves Seller, Agent tools and related websites are operated by JoySaves Sdn Bhd. We are the data controller for the personal information you provide through these services. This policy explains what we collect and what we do with it, in line with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

Depending on how you use the service, we collect:

• Account information — email address, hashed password, phone number, display name, profile photo, linked social-login identifier and account status.
• Customer and transaction information — delivery and billing addresses, cart, wishlist, orders, payments, vouchers, loyalty activity, reviews and service bookings.
• Identity & verification documents — uploaded IC / passport, SSM certificate, bank statement, business licence, etc.
• Product & catalogue information — listings, prices, photos, certifications.
• Location information — an address or coordinates you enter, pin on a map or choose to share for nearby merchants, delivery and merchant-address features.
• Communications — support requests, customer and merchant chat, friend or group messages, reports and other content you submit.
• Device and usage data — IP address, device or session identifier, operating system, app version, notification token, diagnostics, pages viewed and actions taken.
• Camera, photo and file content — documents, catalogue images, QR or barcode scans, and feedback screenshots that you choose to capture or upload.
• Feedback data — comments, contact details, page context and technical details sent through the JoySaves feedback service.

We use your information to:

• Create, secure and administer your customer, Seller or Agent account and review applications.
• Provide shopping, delivery, payment, payout, loyalty, local-lifestyle, merchant and support features.
• Publish approved shops, services and catalogue content in the JoySaves marketplace.
• Send service messages such as order, application, security, password-reset and notification updates.
• Respond to feedback, support communications, disputes and safety reports.
• Detect and prevent fraud, abuse and security incidents, meet legal duties and improve service reliability.

We share information only when needed:

• Customers, merchants and delivery or service partners — only the information needed to fulfil a transaction, booking or support request.
• JoySaves marketplace services — approved seller applications, catalogue data and transaction records flow between JoySaves systems to provide the service.
• Service providers — hosting and file storage, email and push notifications, maps and geocoding, payment processing, authentication, analytics and feedback handling. They may process data only for the contracted service.
• JoiData feedback service — feedback text, optional screenshots and related technical context when you submit in-app feedback.
• Authorities or professional advisers — when required by law, court order, legal claims, audit, or to protect rights and safety.

Account and application data are kept while your account is active, then only as long as needed for the purpose collected and for legal, fraud-prevention, dispute, audit and tax duties. Financial and transaction records may need to be retained for the period required by Malaysian law, which can be up to 7 years.

Identity documents are restricted and kept only as long as needed for verification or a legal requirement. When an account is deleted, data that is not required to be retained is deleted or anonymised through our verified deletion workflow.

Under the PDPA you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent (note: this may end your ability to use the service).
• Lodge a complaint with the Personal Data Protection Commissioner.
• Request deletion of your account and personal data, subject to records we must legally retain.

To exercise these rights, use Delete account in the relevant app or visit the JoySaves account-deletion page. You may also email privacy@joysaves.com.

We use industry-standard measures: TLS-encrypted connections, hashed passwords (bcrypt), HttpOnly cookies for sessions, role-based access controls and audit logs. No system is perfectly secure, but we take it seriously.

Our websites use cookies and our apps use secure device storage or software-development kits for authentication, preferences, security, notifications and service measurement. You can control non-essential cookies, notifications and device permissions through browser or device settings.

If we make material changes we'll notify you by email or an in-app banner. The "last updated" date at the top reflects the most recent revision.

The apps request a permission only when the related feature needs it. You can deny or later revoke a permission in device settings, although that feature may then be unavailable.

• Location — coordinates may be sent to JoySaves and a maps or geocoding provider when you pin an address, request nearby results or use another location-based feature.
• Camera, photos and files — content is accessed only when you scan a code, upload a document or image, or choose to attach a screenshot.
• Biometrics — Face ID, fingerprint or other biometric checks are handled by your device operating system for local app unlock. JoySaves does not receive your biometric template.

A deletion request remains pending while we verify and complete the deletion and legally required retention work. We revoke active mobile sessions when the request is accepted and do not describe the account as deleted until the workflow is complete.

For privacy questions or requests, use the in-app account controls, visit the account-deletion page, or email privacy@joysaves.com.