This Privacy Policy explains how UdarLink ("we", "us") collects, uses, discloses and protects personal data when you use our website and service. We handle personal data in line with the Personal Data Protection Act 2010 (PDPA) of Malaysia.
UdarLink is used by two groups of people: sellers, who create shops and receive orders, and customers, who place orders through a seller's shop link.
1. Our role
For seller accounts, we decide how personal data is used, so we are responsible for it. For customer orders, the seller decides what to do with the order details. We store and process those details on the seller's behalf so they can fulfil the order. If you are a customer and have a question about your order, please contact the seller first.
2. Data we collect
From sellers:
- Account details: name, email address, password (stored hashed, never in plain text) and an optional profile photo.
- When you verified your email address and when you accepted our Terms.
- Shop details: shop name, link, logo, WhatsApp phone number, products, prices, stock and photos.
- Payment gateway settings: Billplz API key, collection ID and X-Signature key, if you choose to accept online payments. These are stored encrypted.
- Subscription plan, Pro trial dates and billing status.
From customers:
- Order details: name, phone number, delivery address, notes and the items ordered.
- Payment status for the order. We do not receive or store card or online banking details; these are entered directly on the payment gateway's page.
From everyone:
- Messages you send through our contact form: your name, email address and message.
- Technical data such as IP address, browser type and pages visited, collected through server logs and session records.
- Performance and error data, such as which pages or background tasks were slow or failed. When you are logged in, it is linked to your account.
- Security check data: on sign-up and the contact form, Cloudflare Turnstile checks your browser to tell people from bots.
3. How we use your data
- To create and run seller accounts and shops.
- To take orders, pass them to the right seller and show them in the seller's dashboard.
- To alert sellers to new orders, payments and refunds in their dashboard and by email.
- To send account emails, such as email address confirmation, password resets, security alerts and Pro trial reminders.
- To create payment links and confirm payments with the payment gateway.
- To enforce plan limits, prevent abuse and keep the service secure.
- To find and fix errors and slow pages.
- To respond to support requests and send important service notices.
We do not sell personal data, and we do not use customer data for our own marketing.
4. Who we share data with
- The seller you order from receives your order details so they can contact you and deliver your items.
- Billplz, our payment gateway, receives the details needed to create a bill and process your payment.
- WhatsApp (Meta): when you send an order, UdarLink opens WhatsApp on your device with the order message filled in. You send it from your own WhatsApp account, and WhatsApp's privacy policy applies to that message. We do not send WhatsApp messages ourselves.
- Hosting, storage, email and security providers that run our servers, store uploaded photos, send our emails and protect the site from abuse, such as Hostinger and Cloudflare.
- Authorities, when the law requires it.
Some of these providers may process data outside Malaysia. When that happens, we take reasonable steps to make sure your data stays protected.
5. Cookies
We use essential cookies only: a session cookie that keeps you logged in and remembers your cart, and a security token that protects forms. Cloudflare, which protects the site, may also set strictly necessary security cookies. We do not use advertising or tracking cookies.
6. How long we keep data
We keep seller account data while the account is active. Order data is kept so sellers can view their order history, and for as long as needed for accounting, tax and legal purposes. Unpaid online-payment orders are cancelled automatically after a short period. Performance and error monitoring data is kept for 7 days, and server logs for up to 14 days. When a seller asks us to close their account, we delete the related data, except where we must keep it by law.
7. Security
We protect data with encrypted connections (HTTPS), hashed passwords, encrypted payment gateway keys and access controls so each seller sees only their own shops. No system is perfectly secure, but we work to keep your data safe and will act quickly if something goes wrong.
8. Your rights
Under the PDPA, you may:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct data that is wrong, incomplete or out of date.
- Withdraw consent or ask us to limit how we use your data.
Sellers can update most of their details in the dashboard. For anything else, send us a message through our contact page. We may need to verify your identity, and we may charge a fee allowed under the PDPA for access requests.
9. Children
UdarLink is not meant for children under 18. Sellers must be at least 18 years old and confirm this when they sign up. If we learn that a seller is under 18, we will close the account and delete its data.
10. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date. For major changes, we will notify sellers by email.
11. Contact us
Questions or concerns about this policy? Reach us through our contact page.