Privacy Policy

Last updated: 30 September 2026

Who is responsible

PasarMalam is operated by Tanitooluwa Ventures, registration 202603072240 (AS0511875-M), at F-LG-R5, CBD Perdana 3, Jalan Perdana, Cyber 12, 63000 Cyberjaya, Selangor, Malaysia. This policy covers our marketplace website and buyer and seller app features.

Privacy requests: pasahmallam@gmail.com. You can also request account deletion online.

Information we handle

• Account and contact information: name, email, phone, login credentials, shop details and delivery or pickup addresses.
• Seller verification and payouts: identity information, business registration details and documents, and bank account details submitted by sellers.
• Purchases and fulfilment: items, quantities, prices, payment references and statuses, order history, delivery instructions, courier quotes and tracking, refunds and payout records. Payment providers handle payment authorisation on their own payment pages.
• Content: product listings and photos, uploaded search photos, reviews, buyer-seller messages, support requests and evidence supplied for disputes.
• Location: address searches and selected coordinates used for store branches, pickup and delivery. When you choose current location, your device asks permission to access location. You can instead enter an address manually.
• Technical information: session tokens, browser storage, IP addresses and request/error information processed by our hosting and service providers to operate and secure the service.

Why we use it

We use information to create and authenticate accounts, display listings, process orders and payments, arrange delivery, verify sellers, calculate payouts, communicate order updates, respond to requests, prevent misuse and meet applicable record-keeping obligations. Public listings, shop details and reviews are visible to other users. Do not put private documents, passwords or card details in public listings or chat.

Who receives information

Information necessary to fulfil an order is shared with the relevant seller, buyer, delivery operator and payment provider. Authorised administrators can review account, verification, order and support information. Depending on the feature used, our service integrations include:

• Render: hosting the website/backend and processing service requests and stored marketplace records.
• Cloudinary: storing and delivering photos uploaded through applicable marketplace features. Uploaded public image links can be accessible to others who have the link.
• Google Maps: address suggestions and location-related requests when these features are used.
• Billplz: checkout/payment processing using information required to create and reconcile a bill.
• Lalamove and EasyParcel: shipment quotation and available fulfilment services, using relevant addresses, contact and parcel details. PM Express is a separate fulfilment option.
• Resend: transactional emails, including verification and password-reset messages.
• OpenAI: processing prompts and selected product photos submitted to AI assistance features. Avoid submitting identity documents, bank details or other sensitive information to AI tools. AI suggestions require seller review.

Providers may process information outside Malaysia. Their own privacy terms apply to their services; legal obligations may require them to retain certain records independently. We may also disclose necessary information where required by law or to address fraud and disputes.

Your device and choices

Camera, photo selection and location are used for features you choose. You can decline permissions or change them in device settings. Session data in browser/app storage keeps you signed in; signing out removes the current session from that device but is not account deletion. Third-party payment and map services may use their own cookies or storage.

You can correct profile information in the app or contact us about access, correction or deletion of your data. Some information is necessary to provide checkout, delivery or seller services, so withholding it may prevent those features from working.

Retention and account deletion

We keep operational information while it is needed for your account, orders and related support. You can initiate deletion in Buyer Profile or Seller Settings through the account-deletion page. This covers the whole shared buyer/seller account and associated personal data, not merely suspension.

We complete deletion within 30 days after ownership verification, except records legally required to be retained, and provide completion confirmation by email. Necessary tax/accounting records are subject to the applicable statutory seven-year period; the applicable start date depends on the record and legal obligation. This is not a reason to retain an entire profile. Any additional legal retention is limited to the relevant records and purposes, with the reason and period explained to the requester.

Fulfilment includes reviewing uploaded content, service-provider copies and backups. We explain any records that must remain and their retention period. Requesting deletion does not itself cancel orders or issue refunds. Uninstalling the app does not delete your account.

Security and changes

We use measures such as encrypted web connections, password hashing and access controls. No service can guarantee complete security. Do not share passwords or verification codes. Contact us if you suspect unauthorised access.

We update this page when our practices change and show the revision date above. Material changes affecting your choices will be communicated through an appropriate account or service notice.