Privacy Policy

Introduction

Asmaraloka ("we", "us", "our") is committed to protecting the privacy of every customer and visitor of asmaraloka.my. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have about your information. By using our website, you agree to the practices described here.

Information we collect

Information you give us

• Account details — full name, email address, and password (stored hashed) when you create an account.
• Order details — shipping address, phone number, and the items you purchase.
• Communications — messages you send us by email or WhatsApp.
• Newsletter subscriptions — your email address if you opt in to our mailing list.

Information collected automatically

• Browser type, device type, and operating system
• Pages viewed and approximate time of visit
• Referring URL (where you came from) and IP-derived country

Information from third parties

• Payment processor (ToyyibPay) — we receive a confirmation that your payment succeeded, along with a reference number. We do not see or store your card number or banking credentials.
• Shipping partner (EasyParcel) — we receive tracking statuses for shipments associated with your order.

How we use your information

• To process and fulfil your orders, including arranging shipping and returns.
• To send you transactional emails (order confirmations, shipping notifications, refund updates).
• To send you newsletters, restock alerts, and promotional offers — only if you have subscribed.
• To respond to your enquiries by email or WhatsApp.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with our legal obligations under Malaysian law.

Sharing your information

We share your information only with the parties needed to run our store:

• ToyyibPay — to process payments.
• EasyParcel and the appointed courier — to ship your order.
• Supabase (our database provider) — to securely store account and order records.
• Resend — to deliver transactional and marketing emails.
• Government authorities — where required by Malaysian law.

We do not sell your personal information to advertisers or data brokers.

Cookies and tracking

We use small browser cookies to keep you logged in, remember your shopping cart, and measure basic anonymous traffic. You can clear cookies at any time from your browser settings, but doing so may sign you out and empty your cart.

Data retention

Account and order information is kept for as long as your account remains active and for a reasonable period afterwards to comply with tax and accounting obligations. If you delete your account, your profile is soft-deleted and removed from the newsletter list, and your login credentials are erased immediately.

Your rights

Under the Personal Data Protection Act 2010 (PDPA) of Malaysia, you have the right to:

• Access the personal data we hold about you;
• Request that we correct or update inaccurate information;
• Withdraw your consent to receive marketing communications at any time;
• Request deletion of your account.

To exercise any of these rights, please contact us using the details below.

Security

Passwords are stored as bcrypt hashes — we never see your plain-text password. Data is transmitted over HTTPS, and access to our database is restricted to authorised personnel. No system is ever 100% secure, but we work to apply industry-standard safeguards.

Children

Our website is not directed to children under 13. We do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated by email to registered customers.