Privacy Policy

1. Who is responsible for your data

Praxor Studio (registration number SA0656426-A), is the data user responsible for the personal data described in this notice. You can reach us at enquiry@support.tinyorder.shop.

This document is published in English. Where any translation of it exists, the English version is the authoritative one and governs in the event of a conflict.

A shop that uses TinyOrder is separately responsible for the customer data it receives and uses in running its own business.

2. What we collect

If you run a shop: your name and email address, your shop's name, its storefront address, its settings, the payment instructions you choose to display to your customers, and — where you set one up — the pickup or delivery origin address you configure.

If you order from a shop: the name, contact number and, for a delivery, the delivery address you give at checkout, along with what you ordered, when, and the total. If you create an account, your email address and any delivery details you choose to save for next time. Your password is stored only as a cryptographic hash — we never hold it in a form anyone can read.

From everyone: basic technical data your browser sends, including your IP address, which we use to limit abuse of the parts of the service that cost us money to run.

We do not collect or store payment card numbers. Subscription payments are handled by our payment processor, and payments for food orders never reach us at all.

3. Why we use it

To operate the service: to show a shop its orders, to let a customer track an order they placed, to work out a delivery fee for an address, and to send order confirmations and alerts.

To bill shops for their subscriptions, and to handle trials, renewals and cancellations.

To keep the service working and safe: to diagnose faults, to prevent abuse, and to enforce our terms.

To contact you about the service where we need to — a trial ending, a failed payment, a material change to these documents.

We do not sell personal data. We do not use what a shop tells us, or what its customers order, for advertising.

On our own marketing pages we use a Meta advertising pixel to measure our own advertising, and it runs only if you accept it. It is never present on a shop's storefront.

4. Who we share it with

To the shop you ordered from. Placing an order sends the shop your name, contact number, what you ordered and, for a delivery, your address — because they cannot fulfil the order otherwise. Shops on our paid tier may also receive that order through a messaging service, which means those details are delivered into the shop's own messaging account.

To the service providers we run on. Each receives only what it needs, and we name them rather than describe them: Supabase hosts our database and handles sign-in, and so stores the data described above; Stripe processes shops' subscription payments; Resend delivers order confirmations and account email; Google Maps Platform receives a delivery address when a shop prices delivery by distance, and receives what you type when a shop uses address autocomplete; and Telegram delivers order alerts to shops that have enabled them.

To Meta, if you accept advertising cookies on our own marketing pages. Meta receives which of our pages you viewed and whether you created a shop. It does not receive your name, your email address, your contact number or any order. It receives nothing at all from a shop's storefront, and nothing at all if you decline.

Where the law requires it, or to establish, exercise or defend legal claims.

Some of these providers process data outside Malaysia. Where that happens we rely on the provider's own contractual protections.

5. Cookies and similar technologies

We use a small amount of storage in your browser to keep the service working — to keep you signed in, to remember the language you chose, and to remember a choice you made at a shop's checkout. These are necessary for the service to work and are not used for advertising.

We also measure how our pages are used. That measurement is done by our own systems, does not identify you, and does not follow you to other websites.

Advertising cookies are separate. Ours are only ever set on our own marketing pages, and never on a shop's storefront. We ask you before any of them are set, and we set none of them if you decline or if you do not answer. Your answer is remembered in your own browser, so a different browser or device asks you again.

A shop can also add its own advertising pixel to its storefront, run by that shop through its own advertising account. Where a shop has done so, its storefront asks you separately, sets nothing unless you agree, and your answer there applies to that shop alone. That tracking belongs to the shop and not to us — the shop is responsible for it, and its own privacy practices apply.

6. How long we keep it

Order records are kept for as long as the shop that received them is on the platform, because the shop needs its own trading history, and then for the period below.

Account data is kept while the account exists.

If a merchant cancels their subscription, or a shop closes for any other reason, we keep that shop's data — its account details, its menu and its order records — for two years from the date the subscription ends. We then delete it. Two years covers the period in which a billing question, a tax enquiry or a dispute about a past order can still arise, and a merchant who returns within that period finds their shop as they left it.

A shop can ask us to delete its data before those two years are up, and we will, except for what we must keep to meet a legal or accounting obligation. Write to enquiry@support.tinyorder.shop to ask.

Cached delivery distance lookups expire within thirty days.

7. Ordering as a guest

You can order without creating an account. If you do, the order is recorded against the shop but not against any account — including one you create later. This is permanent and cannot be undone: a guest order can never be attached to an account afterwards.

That means a guest order will not appear in an account's order history, and you track it using the order number and the contact number you gave.

It also means a guest order does not receive a confirmation email, because a guest gives no email address.

8. A note about email addresses

We do not verify a customer's email address when an account is created. A mistyped address therefore belongs to whoever actually owns it, and order confirmations sent to that account would reach them — including the order's name, items, total and delivery address.

We state this plainly because it is a real consequence of not requiring verification. Please check your address when you sign up.

9. Your rights

Under Malaysian personal data protection law you may ask for a copy of the personal data we hold about you, ask us to correct it if it is wrong or incomplete, ask us to limit how we process it, and withdraw consent where our use of it rests on consent.

To exercise any of these, write to enquiry@support.tinyorder.shop. We may need to confirm who you are before we act, so that we do not disclose your data to someone else. We will respond within the period the law allows.

If your request concerns data held by a shop rather than by us — the details attached to an order you placed with them — we will point you to that shop, which is responsible for it.

Withdrawing consent or asking us to delete data may mean we can no longer provide parts of the service to you.

10. Security

Each shop's data is separated from every other shop's, and a shop can only reach its own orders and customers. Traffic is encrypted in transit, passwords are stored only as cryptographic hashes and never in a readable form, and access to production data is limited to those who need it.

No system is perfectly secure, and we do not claim otherwise.

11. Changes to this notice

We may update this notice. The date at the top of this page shows when it last changed. Where a change materially affects you, we will tell you.

12. Contact

Questions, requests or complaints about your personal data go to enquiry@support.tinyorder.shop.