Privacy Notice

Who we are

DigitalPasar is operated by FAEZ MURSHIDI BIN ADNAN (FaezLabs), SSM 202403148374 (003608911-X), a business registered in Malaysia. This notice explains how we handle personal data under the Personal Data Protection Act 2010 (PDPA).

Questions about this notice: email orders@digitalpasar.xyz, or the Help form on any of our pages.

What we collect

Sellers: your email address and password (stored as a hash, never plain text), your business and shop names, your answers about the business, the logo and images you upload, and bank details for payouts.

Buyers: name, email address, orders and payment method — what is needed to deliver the product and keep a record of the sale. A buyer’s bank details are asked for only when a refund has to be transferred straight to their account, and are used for that alone.

Complaints: what you write in the Help form, kept so we can answer it.

Singapore waitlist: your email address, and what you sell if you tell us. We use it for one thing: to tell you once when Singapore shops open.

Signing in with Google

If you choose to sign in with Google, we receive your name, email address and profile picture from Google. We use them for one thing only: creating and signing you in to your DigitalPasar account.

We request no other access, read nothing else in your Google account, and write nothing to it.

Cookies and analytics

On our own site: your sign-in session, an anonymous visitor id, and campaign links sellers create.

On the home page, we record how far you scroll and which buttons you press. On the signup and shop-setup screens, we record how you move through them: which fields you open, whether they are filled, which buttons you press, when you leave, and the kind of device (phone, computer or in-app browser). We never record what you type. The purpose is one: find the confusing parts and fix them.

Our marketing pages and account screens also load the Meta (Facebook) pixel. It sets Meta cookies so we can tell which ads bring new sellers. It runs on our pages only.

When you sign up, fill in your shop details, press pay and finish paying, our server tells Meta. We send your email and account ID as a hash, with your IP address and browser type. The IP address and browser from when you pressed pay are kept until the payment is reported, 30 days at most.

Our Meta pixel never loads on a seller’s shop. A seller’s buyers are not ours to measure.

A seller can connect their own Meta pixel to their shop. Without that, the shop has no pixel, no advertising cookies and no ad tracking.

When a seller connects one, that shop loads Meta’s image pixel and sets Meta cookies (_fbp, and _fbc when you arrive from an ad) for 90 days.

When you open that shop, press buy and finish paying, our server also tells that seller’s Meta dataset. We send your email as a hash, your IP address, browser type, the Meta cookies, and the product and price you bought.

This data goes to that shop’s seller only, to measure their ads. It is never sent to our dataset or to any other shop. The IP address and browser from checkout are kept until the purchase is reported, 3 days at most.

Shop analytics count visitors, checkouts and sales for that shop’s seller. From the page that referred a visitor, we keep the host name only — never the full URL.

Processors we use

The platform runs on these providers, which process data on our behalf: Supabase (database and sign-in), Vercel (hosting, and analytics for our own site), HitPay (payments), Resend (email), Anthropic and trigger.dev (shop page writing), TypeSafe (product listing and shop page checks, sorting support messages, and pricing design reviews), Cloudflare (storage for pictures, video and product files), Meta (ad measurement), and BetterPicture (Pictures & video).

When you make a picture or clip in Pictures & video, we send BetterPicture one picture your shop already has, with your shop and product names and descriptions. BetterPicture runs the models through Replicate — models from Black Forest Labs, Google, Kuaishou and ByteDance — and stores the results with Cloudflare. We copy the result into your shop’s Media. BetterPicture deletes the result, and the names and descriptions we sent, within eight days. The copy in your shop’s Media stays until you delete it.

Some of these processors operate outside Malaysia — mainly Singapore, where our database lives. We send only what each task needs.

Card numbers and buyer payment credentials are handled by HitPay and never pass through our servers.

What we do not do

We do not sell your data and we do not run ads.

One shop’s buyer data is never given to another shop. API keys for page writing carry no buyer emails at all.

How long we keep it

Order and ledger records are kept for as long as tax and accounting law requires. Complaints are kept for three years. The waitlist is deleted once we have told you, or sooner if you ask. Raw analytics data is deleted after roughly 90 days; only daily totals remain.

Your rights

Under the PDPA you have the right to access and correct your personal data. Send a request through the Help form or by email.

You can close your account at any time. Any unpaid balance remains yours and can still be requested.

Changes to this notice

If this notice changes, we update this page and the date above. Significant changes are announced to sellers by email.