- We collect what we need to run your account, your stores and your billing — nothing more.
- We don't sell your personal data, and we don't use advertising or tracking cookies.
- We share data only with service providers that help us run SantaiPOS (such as Google and Stripe), or when the law requires it.
- You can ask to access, correct or delete your data at any time by emailing [email protected].
1. Who we are
This Privacy Notice is issued by Merpati High Tech Enterprise (Registration No. 003460480-P) under section 7 of the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 (the "PDPA"). It applies to personal data we process as a data user when you visit our website, create an account, or use SantaiPOS.
When you, as a business, record personal data about your own staff or customers in SantaiPOS, you are the data user for that data and we process it on your behalf as a data processor, as described in our Terms & Conditions.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, password (stored only as a secure hash), profile photo and ID if you sign in with Google | You, or Google with your permission |
| Business | Business and outlet names, addresses, staff names, email addresses and roles | You and staff you invite |
| Billing | Subscription plan, invoices, payment status, card brand and last four digits | You and Stripe |
| Transactions | Sales, receipts, items and payment references recorded on your register | Your use of the Service |
| Technical | IP address, browser and device type, register device identifiers, sign-in times and security logs | Automatically, when you use the Service |
| Communications | Messages and support requests you send us | You |
We do not intentionally collect sensitive personal data (such as health, religious or political information) and ask that you don't enter it into SantaiPOS. Our Service is not intended for anyone under 18.
3. Why we use your personal data
- to create and secure your account, verify your identity and let you sign in;
- to provide the Service, including your registers, inventory, staff access and reports;
- to process subscription payments, issue invoices and e-Invoices, and meet tax and accounting obligations;
- to provide customer support and send you service messages, such as trial reminders, billing notices and changes to our terms;
- to detect, prevent and investigate fraud, abuse and security incidents;
- to maintain and improve the Service, using aggregated or de-identified information where possible;
- to comply with the law, court orders and lawful requests from authorities.
We will only send you marketing messages if you have agreed to receive them, and you can opt out at any time using the link in the message or by contacting us.
4. Is providing your data obligatory?
Your name, email address and password (or Google sign-in) are required to create an account, and billing details are required to subscribe to a paid plan. If you don't provide them, we won't be able to provide the Service to you. Other information, such as a profile photo or phone number, is voluntary.
5. Who we share it with
We don't sell or rent your personal data. We disclose it only to the following classes of third parties, and only as needed:
- Authentication: Google (Firebase Authentication), when you choose to sign in with Google.
- Payments: Stripe, to process subscription payments and the QR payments you accept from your customers.
- Infrastructure: cloud hosting, database, email delivery and content delivery providers that store or transmit data for us.
- Professional advisers: our auditors, accountants and lawyers, under a duty of confidentiality.
- Authorities: regulators, the Inland Revenue Board of Malaysia (LHDN), law enforcement or courts, where required or permitted by law.
- Business transfers: a buyer or successor if our business is reorganised or sold, subject to this Notice.
- Within your business: owners and staff of your business, according to the roles you assign.
Our service providers may only use your data to provide services to us and must keep it secure.
6. Where your data is stored and transfers outside Malaysia
Our servers and database are hosted in Malaysia. Some of our service providers, including Google and Stripe, also process data in Singapore, the European Union and the United States.
In accordance with section 129 of the PDPA, we only transfer personal data outside Malaysia to places that have laws substantially similar to the PDPA or that ensure an adequate level of protection, or where another condition under the PDPA applies, and we require recipients to protect it to a comparable standard.
7. How we protect it
We take practical steps to protect personal data from loss, misuse, unauthorised access, disclosure, alteration and destruction. These include encryption in transit (HTTPS), hashed passwords, role-based access, short-lived sign-in tokens, rate limiting and access logs. If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as required by the PDPA.
8. How long we keep it
- Account and business data: for as long as your account is active. To close your account, email [email protected]; we keep your data for 30 days after closure so you can recover or export it, then delete or anonymise it.
- Billing records and invoices: for 7 years, as required for tax and accounting purposes.
- Security and access logs: up to 12 months, unless needed longer to investigate an incident.
After that, we securely delete or anonymise the data.
9. Your rights and choices
Under the PDPA, you may:
- access the personal data we hold about you and receive a copy of it;
- correct personal data that is inaccurate, incomplete, misleading or out of date;
- withdraw consent to, or ask us to limit, processing of your personal data;
- object to processing that is likely to cause you damage or distress, and opt out of direct marketing;
- ask us to transfer your personal data to another data user, where technically feasible and permitted by the PDPA.
You can update most account details yourself in SantaiPOS. For other requests, email [email protected]. We will respond within 21 days, as required by the PDPA, and may need to verify your identity first. We may charge a fee permitted by the PDPA regulations for access requests. Withdrawing consent for essential processing may mean we can no longer provide the Service to you.
If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia (www.pdp.gov.my).
11. Language
This notice is available in English and Bahasa Malaysia. If there is any inconsistency between the two versions, the English version prevails to the extent permitted by law.
12. Changes to this notice
We may update this Privacy Notice from time to time. We will post the new version here with a new effective date, and tell you by email or in the Service if the changes are significant.
13. Contact us
For questions, requests or complaints about your personal data, contact our data protection officer:
Data Protection Officer, Merpati High Tech EnterpriseJD854, Jalan BSJ P1/4, Bandar Scientex Jasin Presint 1, 77300 Merlimau, Melaka, Malaysia
Email: [email protected]
Phone: 01126715005