JomBeli

Privacy policy

Last updated: 22 October 2026

JomBeli lets sellers ("merchants") create online stores where customers prepare orders that are sent to the merchant on WhatsApp. This policy explains what we collect and why, in line with Malaysia's Personal Data Protection Act 2010.

Merchants

  • Account: your email address and a password (stored by our authentication provider, Supabase; we never see your password).
  • Store content you add: store name, logo, products, photos, prices, pickup settings and your WhatsApp number.
  • Billing for PLUS/PRO: handled by Stripe. We store your Stripe customer and subscription IDs and the plan status. We never receive or store card numbers.

Customers of a store

  • Your name, phone number and note are placed only into the WhatsApp message you choose to send. We do not store them.
  • We keep the order contents (items, quantities, prices, pickup time) for up to 90 days so the merchant can see basic statistics. These records contain no name or phone number.
  • To limit abuse we keep a one-way hash of your network address and browser, not the address itself.
  • Your cart and the language you chose are kept in your own browser.

Payments between customers and shops

Customers pay shops directly, for example with the shop's own Touch 'n Go eWallet. JomBeli never receives this money. A shop's payment QR, payee name and optional TNG number are shown to its customers. For each order we keep its payment status (awaiting payment, customer says paid, confirmed by the shop, cancelled) and when it changed. We do not collect payment screenshots or card details.

Advertising

Stores on the FREE plan show clearly labelled JomBeli ads. We count how often ads are shown and clicked per day. We do not use third-party ad trackers and do not collect personal data for ads.

Where data is kept

Supabase (database, authentication, image storage), Cloudflare (website hosting) and Stripe (payments). These providers process data on our behalf.

Your rights

Merchants can export their store data and request deletion from the dashboard. A deleted store goes offline at once and its data is removed after a short grace period. For any other request, reply to an email sent by JomBeli.