Privacy Policy

Corefolio is a trading name of Amiera Nadzira binti Senon, a sole proprietorship registered in Malaysia under registration number 202403340122 (IP0603706-H), of 81 Jalan Lingkaran, Taman Sri Lambak, 86000 Kluang, Johor. This policy explains how we handle personal data under Malaysia’s Personal Data Protection Act 2010 (“PDPA”).

Corefolio holds two kinds of personal data, and our responsibility differs for each.

Business owners. When you sign up to run a site on Corefolio, we are the data user for your account information. This policy governs what we do with it.

Customers who order from a business. When someone orders from a shop built on Corefolio, that shop is the data user for their details — we only store and process them on the shop’s behalf, as its data processor. If you placed an order and want your information corrected or removed, contact that shop directly. You may also write to us and we will pass the request on.

From business owners:

• Your name, email address and password (stored only as a cryptographic hash — we never see the password itself).
• If you sign in with Google: your name, email address and profile picture, as supplied by Google. We do not receive your Google password.
• Your business name, web address, contact number, address, opening hours and social links.
• Your menu, photos, logo, design choices and DuitNow QR image.
• Your subscription status, payment dates and the records of payments made through ToyyibPay.

From customers placing an order (held for the shop, not for us):

• Name and contact number.
• Delivery address, where delivery is chosen.
• Order contents, date and total.
• The payment receipt image uploaded as proof of transfer. These often show bank details, so we restrict access to them and never use them for anything but showing the shop its own orders.

Automatically: basic technical information our hosting and security providers record, such as IP address and browser type, for keeping the service running and secure.

We do not knowingly collect sensitive personal data as the PDPA defines it, and ask that you do not upload any.

• To create and run your website and dashboard.
• To show you the orders your customers place.
• To take subscription payments and keep billing records.
• To send service messages — payment reminders, notices that your subscription is ending, and security or account alerts.
• To keep the service secure and to investigate misuse.
• To meet our legal and tax obligations.

We do not sell personal data, and we do not use your customers’ information for our own marketing.

We use a small number of providers to run Corefolio. Each sees only what its job requires:

• Supabase — database, login and file storage.
• Vercel — hosting and delivery of the websites.
• ToyyibPay — subscription payments. They handle your bank or card details directly; we receive only a payment reference and whether it succeeded.
• Google — only if you choose to sign in with Google.
• Our email provider — to deliver reminders and account notices.

We may also disclose personal data where the law requires it, or to establish or defend a legal claim.

Our database and files are hosted in Singapore, and our websites are delivered through servers in several countries. This means your personal data is transferred outside Malaysia.

By using Corefolio you consent to that transfer. We only use providers that apply recognised security standards and contractual protections to the data they hold for us.

• Account and business data: for as long as your account exists.
• Payment receipt images: deleted 90 days after an order is completed. The order itself — date, total, items and customer contact — is kept as the shop’s business record; only the uploaded image goes, since its purpose is proof while the order is being settled.
• If your subscription lapses, your data is kept — not deleted — so your site can be restored when you pay. If an account stays unpaid for an extended period, we may delete it after notifying you by email.
• After you ask us to delete your account, we remove your data within a reasonable period, except anything we must keep for tax or legal reasons.
• Payment and commission records are kept for as long as Malaysian tax law requires.

You may ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything inaccurate or out of date.
• Stop processing your data, or limit how we process it.
• Delete your account and the data in it.
• Withdraw consent you previously gave — though some processing is needed to run the service at all, so withdrawing it may mean closing your account.

Write to amieranadzira@gmail.com. We may need to verify your identity first, and we will respond within the period the PDPA allows. The PDPA permits a prescribed fee for data access requests.

Much of this you can do yourself: your business details and menu are editable from your dashboard at any time.

• All traffic is encrypted in transit (HTTPS).
• Passwords are stored as cryptographic hashes, never in readable form.
• Database access rules restrict each business to its own rows, so one business cannot read another's data.
• Billing fields can only be changed by our payment system, not by an account holder.

No system is completely secure. If a breach occurs that is likely to affect you, we will tell you and take the steps the law requires.

We use cookies and browser storage only to keep you signed in, to remember a shopping cart between pages, and to keep the service secure. We do not use advertising or cross-site tracking cookies.

Corefolio is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

We may update this policy. The date at the top shows when it last changed, and we will tell you about material changes by email or in your dashboard.

Privacy questions and data requests: amieranadzira@gmail.com

Everything else: amieranadzira@gmail.com