This Privacy Policy explains how Storesy (“Storesy”, “we”, “us”, “our”) handles personal data when you use www.storesy.my, the Storesy application, and related services (the “Service”). It should be read together with our Terms & Conditions.
1. Who we are
Storesy is an e-commerce platform built and operated in Malaysia. For data about merchants, invite applicants and website visitors, Storesy is the data controller. For data about a merchant’s customers and orders, the merchant is the controller and Storesy processes that data on the merchant’s behalf to provide the Service.
Our contact for privacy matters is hello@storesy.my.
2. What we collect
We collect the following categories of information:
Account and access
- Your name, email address and password (stored as a hash, never in plain text).
- Session records, including hashed session tokens, timestamps and expiry.
- Invite requests: your email, store or Instagram handle, and what you sell.
Your store
- Page content, product names, descriptions, prices, images and settings you add.
- The public link or slug for your store and pages.
- Integration details, such as a connected Gmail address, configuration, and encrypted credentials or tokens.
Orders and customers
When a customer checks out through your store, we store the details needed to show and fulfil the order: the customer’s name, email, phone number, shipping address, order contents, totals, status and timestamps. We also keep a customer profile (for example, order count and lifetime value) so you can see repeat buyers. This information is provided by your customers or created when they place an order.
Technical and usage data
- IP address, browser type, device information and request timestamps.
- Security and rate-limit counters, such as failed logins or requests per hour.
- Page-visit counts for your public sales pages.
- Cookie and local-storage values described in section 5.
Communications
- Messages you send us for support, feedback or legal requests.
- Emails we send through the Service, including their delivery status.
We do not collect or store full payment card numbers. Unless we expressly say otherwise, payments are handled by the merchant or the merchant’s payment provider.
3. How we use it
- To create and secure your account, sign you in, and keep sessions alive while you work.
- To publish your store and sales pages and display them to your customers.
- To validate and record orders, calculate totals, and show them in your dashboard.
- To send order and account emails you have configured, including through Gmail if you connect it.
- To prevent fraud, abuse, spam and attacks, and to enforce rate limits.
- To provide support and respond to your requests.
- To understand usage and improve the product during the beta.
- To comply with legal obligations and enforce our Terms.
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell personal data.
4. Our legal bases
Under the PDPA and comparable laws, we rely on: performance of a contract (running the Service you signed up for); legitimate interests (keeping the Service secure, preventing abuse, improving the product); consent (where we ask for it, such as optional communications); and legal obligation (tax, accounting, lawful requests). Where we process customer data for a merchant, we do so on the merchant’s instructions and the merchant is responsible for its legal basis.
5. Cookies and local storage
Storesy uses a small number of essential cookies and storage keys:
- Session cookie. HttpOnly and Secure in production, used to keep you signed in. It expires after 2 hours of inactivity.
- Gmail connection cookie. Short-lived (about 10 minutes), used only while you are completing a Gmail connection.
- Theme preference. Stored in your browser’s local storage so the app remembers light or dark mode.
- Checkout cart. A public sales page may keep a cart in local storage on the customer’s device so the cart survives a refresh.
We do not currently use advertising cookies or third-party analytics trackers. If we add non-essential cookies, we will update this policy and ask for consent where required.
6. Who we share with
We share personal data only with parties that help us run the Service:
- Cloudflare. Hosting, database, object storage, session and rate-limit infrastructure, and network delivery.
- Google. If you connect Gmail, Google processes the email you send and the authorisation you grant. Storesy requests only the send permission.
- Payment and delivery providers. Chosen by you as the merchant. Their own privacy policies apply.
- Professional advisers and authorities. Where necessary for legal advice, compliance, or a lawful request.
We may also share data as part of a reorganisation or sale of the business, subject to appropriate confidentiality. We do not sell personal data.
7. International transfers
Our infrastructure runs on Cloudflare’s global network, so data may be processed outside Malaysia. Where that happens, we take reasonable steps to ensure the data receives an appropriate level of protection, including contractual safeguards with our processors.
8. How long we keep it
- Account data. While your account is active, and for a reasonable period after closure for backups, disputes and legal obligations.
- Sessions. Until they expire (2 hours of inactivity) or are revoked.
- Pending Gmail connections. About 10 minutes; deleted if you cancel or the flow expires.
- Invite requests. Until the beta invitation process is complete and for a reasonable period after, unless you ask us to delete them sooner.
- Orders and customer records. For as long as the merchant needs them and as required by law. Merchants control their store data and may delete customers in the dashboard.
- Security logs and counters. Short periods, as needed to detect and prevent abuse.
9. How we protect it
We use technical and organisational measures appropriate to a beta service: passwords and session tokens are hashed, integration secrets are encrypted at rest with AES-GCM, session cookies are HttpOnly, sensitive integration fields are masked in the dashboard, and access to admin tooling is restricted. Traffic is encrypted in transit. No method is perfectly secure, so please use a strong, unique password and tell us immediately if you suspect a problem.
10. Your rights
Subject to applicable law, you may:
- request access to the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete data we no longer need;
- withdraw consent where we rely on it, without affecting earlier processing;
- object to or restrict certain processing; and
- request a copy of data you provided to us in a portable format.
To exercise a right, email hello@storesy.my. We may need to verify your identity before acting. If your request concerns a purchase from a merchant’s store, please contact that merchant first — they control the order data. You also have the right to complain to Malaysia’s Personal Data Protection Commissioner.
11. Email and marketing
During the beta we email you about your invite, your account, and the stores you run. We do not add you to a newsletter. If we ever introduce optional marketing emails, they will be opt-in and every message will include a way to unsubscribe.
12. Children
Storesy is a business tool for people aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us and we will delete it.
13. Changes to this policy
As the beta develops, we may update this policy. We will change the “last updated” date and, for material changes, give reasonable notice by email or in the product. The latest version always lives on this page.
14. Contact and complaints
Privacy questions or requests: hello@storesy.my. We will try to resolve your concern promptly. If you are not satisfied, you may contact the Personal Data Protection Commissioner in Malaysia.
Back to top ↑