Privacy Policy

1. Who we are

Pautan ("we", "us") operates a link-in-bio and mini store platform for Malaysian sellers. This policy explains how we handle personal data, in line with the Personal Data Protection Act 2010 (PDPA).

2. Data we collect

Merchants: name, email address, password (stored as a one-way hash), WhatsApp number, page content, and — if you connect a store — your HitPay API credentials, which are stored encrypted (AES-256) and never displayed back or logged.

Buyers: when you place an order we collect your name, phone number, optional email, and order details, on behalf of the merchant you are buying from. Payment card or banking details are entered directly with HitPay — we never see or store them.

Visitors: we record page views and link clicks with an anonymised (hashed, daily-rotating) form of your IP address, referrer, and approximate country. This cannot be traced back to you and is used only to show merchants their page statistics.

3. How we use data

To operate the service: serving pages, processing orders, sending order updates via WhatsApp links, billing subscriptions, and showing merchants analytics about their own pages. We do not sell personal data, and we do not use it for third-party advertising.

4. Sharing

Buyer order details are shared with the merchant you bought from — that is the purpose of the order. Payment data is handled by HitPay under their own privacy policy. Our infrastructure providers (Cloudflare, Neon) process data on our behalf as hosting providers. We disclose data to authorities only where required by Malaysian law.

5. Storage and security

Data is stored in cloud infrastructure located in the Asia-Pacific region. Passwords are hashed with bcrypt; payment-provider credentials are encrypted at rest with AES-256-GCM; all traffic is encrypted in transit (HTTPS).

6. Retention

Account data is kept while your account is active. Order records are kept while the merchant's account is active, as merchants may need them for tax and consumer-protection purposes. Anonymised analytics are kept indefinitely.

7. Your rights (PDPA)

You may request access to or correction of your personal data, or withdraw consent to its processing (which may mean we can no longer provide the service to you). Buyers should direct requests about order data to the merchant they bought from; we will assist merchants in fulfilling such requests.

8. Cookies

We use only essential cookies: a session cookie to keep merchants signed in. We do not use third-party advertising or tracking cookies.

9. Changes and contact

We will post any changes to this policy on this page. Questions or PDPA requests: use the support link in the site footer. See also our Terms of Service.