Legal
Privacy policy
What personal data Shopayla collects, why, who we share it with, and what you can ask us to do about it. Written to be read, not skimmed past.
Last updated 21 October 2026
The short version
Selling your data
We never do
And we do not use personal data for advertising.
Card details
Never on our side
A shopper pays the gateway directly. We never see the card.
Your customers
Your records
You decide what happens to your orders. We hold them for you.
Your rights
See, fix, withdraw
Write to us and we answer within the period the Act allows.
Notis Bahasa Malaysia
Notis ini disediakan dalam Bahasa Malaysia dan Bahasa Inggeris, seperti yang dikehendaki oleh seksyen 7(3) Akta Perlindungan Data Peribadi 2010. Versi Bahasa Inggeris yang penuh di bawah adalah rujukan utama bagi terma undang-undang.
Data peribadi yang kami kumpul
Nama dan alamat e-mel anda, kata laluan yang disimpan dalam bentuk hash, nama dan alamat kedai anda, senarai produk, serta butiran pesanan yang pelanggan anda buat dalam kedai anda termasuk nama, e-mel, nombor telefon dan alamat penghantaran mereka. Kami juga merekod halaman mana yang dibuka melalui Google Analytics, supaya kami tahu bahagian mana platform ini yang digunakan. Butiran penuh ada di seksyen 7 di bawah.
Sumber data
Kami menerima data ini daripada anda semasa anda mendaftar dan menggunakan platform, daripada Google jika anda memilih untuk mendaftar masuk dengan Google, dan daripada pelanggan anda apabila mereka membuat pesanan di kedai anda.
Sebab kami mengumpulnya
Untuk membuka dan mengendalikan akaun serta kedai anda, memproses pesanan, mengira dan mengenakan fi transaksi kami, menjaga keselamatan platform, dan menjawab pertanyaan anda.
Kepada siapa kami mendedahkannya
Kepada pembekal perkhidmatan yang kami gunakan untuk mengendalikan platform: DigitalOcean (penghosan), Cloudflare (DNS dan perlindungan rangkaian), Google (pendaftaran masuk, jika anda memilihnya), Google Analytics (mengira lawatan halaman, supaya kami tahu bahagian mana yang digunakan), dan gerbang pembayaran yang anda sambungkan sendiri. Sebahagian daripada mereka menyimpan data di luar Malaysia. Kami tidak menjual data peribadi anda.
Adakah ia wajib diberikan
Memberikan nama, alamat e-mel dan kata laluan adalah wajib untuk membuka akaun, kerana kami tidak boleh menyediakan perkhidmatan tanpa maklumat itu. Maklumat lain, seperti gambar produk dan butiran pilihan, adalah secara sukarela. Jika anda tidak memberikan maklumat yang wajib, kami tidak dapat membuka akaun atau menjalankan kedai anda.
Hak anda
Anda berhak untuk melihat, membetulkan, mengehadkan penggunaan, atau menarik balik persetujuan anda terhadap penggunaan data peribadi anda. Hantar permintaan anda ke [email protected].
Jika berlaku pelanggaran data
Jika berlaku pelanggaran data peribadi yang menyebabkan atau berkemungkinan menyebabkan kerugian atau kesusahan yang ketara, kami akan memberitahu Pesuruhjaya Perlindungan Data Peribadi dan individu yang terjejas dalam tempoh yang ditetapkan oleh undang-undang.
Who we are, and what we hold
01
Who we are
Shopayla is an ecommerce platform for Malaysian shops, operated by RICH CORE MEDIA (002271243-U). We provide the storefront, the order management and the wallet a shop uses to pay our transaction fee. We are the data controller for the account you create with us, and a data processor for the orders your customers place with you.
Contact for anything on this page: [email protected], or by post to Garden Square, Bandar Gamuda Gardens, 48050 Rawang, Selangor Darul Ehsan, Malaysia.
02
Two roles, and why the difference matters
When you sign up and run a shop, we decide how your account data is used. You are the seller, and you decide what to do with the orders your customers place. We hold that order data on your behalf and follow your instructions. If a customer asks you to correct or delete their details, you are the one who answers them, and we will help you do it.
03
What we collect
- Account: your name, email address, and a password hash. If you sign in with Google, we receive your name, email address, profile picture and Google's identifier for you. We do not receive your Google password.
- Shop: the shop name, its address on shopayla.co, the products you publish, their prices and photographs, and the theme you choose.
- Orders: for each order placed in your shop, we hold the customer's name, email address, phone number, delivery address, what they bought and what they paid. This is your customer data.
- Wallet and fees: top-ups, the fee charged on each sale, and any adjustment made to your account. This is a financial record, and we keep it.
- Technical: IP address, browser type, and the times you sign in. We use this to keep the platform working and to notice abuse.
- Usage: which pages were opened, when, roughly where the request came from, and what kind of device made it, through Google Analytics. Section 7 says exactly what that records and what it does not.
We do not collect your customers' payment card details. When a shop is connected to a payment gateway, the customer pays the gateway directly.
04
Where it comes from, and whether you must give it
We receive account data from you, and from Google if you choose to sign in with Google. Order data comes from the customer placing the order. Giving your name, email address and a password is obligatory to open an account, because we cannot provide the service without them; everything else, such as product photographs or a chosen theme, is voluntary. If you decline to provide what is obligatory, we cannot open the account or run the shop.
How we use it
05
Why we collect it
- To create and operate your account and your shop.
- To publish your shop and process the orders placed in it.
- To calculate and charge our transaction fee, and to keep records of it.
- To keep the platform secure, and to detect fraud or abuse.
- To answer you when you contact us.
- To understand which pages are used, so we know what to improve.
Under the Personal Data Protection Act 2010, we rely on your consent, on the need to perform our agreement with you, and on our legitimate interest in keeping the platform secure and operating. We do not sell personal data, and we do not use it for advertising.
06
Who we share it with
We use a small number of service providers, and they may only use the data to provide their service to us:
- DigitalOcean: hosting, including the database that holds your shop.
- Cloudflare: DNS and network protection for Shopayla.
- Google: sign-in, when you choose to use it.
- Google Analytics: counting visits to the pages we serve.
- Payment gateways: where a shop has connected one, so the customer's payment can be taken and confirmed.
We may also disclose data where the law requires it. Some of these providers operate outside Malaysia, so your data may be transferred and stored abroad; we choose providers that apply comparable protections.
07
Cookies and local storage
We use a session cookie to keep you signed in while you work in the portal, and we store an access token in your browser's local storage so your phone does not ask you to sign in every time you open it.
We also count visits with Google Analytics, which sets its own cookies and records which pages were opened, when, roughly where the request came from, and what kind of device made it. It covers the pages open to everyone and the portal alike. It records the address of a page, never the contents of what you type into it, and we do not send it your name or your email address. It is not used to advertise to you, and it does not follow you to other websites.
Your rights, and our duties
08
How long we keep it
- Account and shop data: while your account is open, and for a period afterwards in case you return.
- Orders and wallet records: kept as financial records, because the fee we charged has to remain explainable.
- Technical logs: a short period, then deleted.
If you close your account, we will tell you what we are keeping and why, and delete everything we are not required to keep.
09
Your rights
Under the Personal Data Protection Act 2010 you may ask to see the personal data we hold about you, ask us to correct it, limit how we use it, or withdraw your consent to us using it. Write to [email protected] and we will respond within the period the Act allows. Withdrawing consent for something we must do to run your shop may mean we can no longer run it.
10
If there is a breach
If a personal data breach causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected, within the period the law allows. We would rather tell you early and plainly than quietly.
11
Security
Traffic is encrypted in transit. Passwords are stored as hashes, never in a form we can read. Access to production data is limited to those who need it to operate the platform.
12
Children
Shopayla is for people running a business. It is not intended for children, and we do not knowingly collect their data.
13
Changes
If this policy changes in a way that affects you, we will tell you in the portal before the change takes effect.
Questions, answered.
Do you sell my data, or my customers’ data?
No. We do not sell personal data, and we do not use it for advertising. The providers we use may only use it to provide their service to us.
Who answers when one of my customers asks about their data?
You do, because you are the seller and the order data is yours. We hold it on your behalf and will help you see, correct or delete it.
Do you see my customers’ card numbers?
No. When a shop takes card payments, the customer pays the payment gateway directly, so card details never reach us.
How do I see or delete what you hold about me?
Write to [email protected]. We respond within the period the Personal Data Protection Act 2010 allows, and if you close your account we delete everything we are not required to keep as a financial record.
Your shop. Your customers. Your pace.
RM 1.00 per successful sale on prepaid · first shop year included at signup · renew term in console (wallet debit — top-ups do not extend term) · or postpaid plan with no per-sale platform fee · no monthly platform subscription · growth rewards up to RM500 a month (prepaid)