Privacy Notice

1. Who we are and scope of this notice

This Privacy Notice explains how Serpents Capital Solution (trading as "Meikigo", Registration No. 202603217394 / 003880138-D) collects, uses, and safeguards personal data under Malaysia’s Personal Data Protection Act 2010 ("PDPA").

Registered office: F-0203, Emporis Duplex, Psn Surian, Jalan Teknologi, Sek 3, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia. Email: support@meikigo.com.

2. Personal data we collect

From you directly at signup: Full name, verified email address, mobile phone number, and account password (or third-party Google authentication profile details).

From your use of the platform: Outlets, staff, and services viewed; queue tickets and bookings; counter transaction and purchase history; loyalty points and referral activity; and submitted star ratings.

From a shop at the counter: If a shop creates a customer profile for you or imports past customer records, your contact info and visit history may exist before you create an app account. When you register with that matching phone number, your account connects to those past records.

3. Why we process your data

We process your data to operate your account and authenticate logins, display your queue and booking status to shops, maintain loyalty and referral balances, record transaction receipts for statutory tax accounting, deliver transactional notifications (receipts, booking reminders, verification codes), and send promotional marketing messages (only with your separate consent).

4. Marketing consent

Marketing consent is strictly optional, requested through an unticked checkbox at signup, and is never bundled with terms acceptance. You can withdraw consent at any time via your account settings or unsubscribe links with immediate effect.

If a shop imported your contact details from past records and declared you consented to marketing, we record that attribution. You may still unsubscribe or opt out at any time.

Essential transactional messages (receipts, reminders, security codes) are not marketing and continue regardless of marketing opt-out status.

5. Who can see your data and internal access controls

Shops only see customer and visit data for their own outlets; they cannot see visits to other shops or who submitted star ratings.

Meikigo staff cannot view customer personal data without entering a documented, genuine business reason first. All staff access is logged and regularly audited.

Meikigo support staff may access a shop account to troubleshoot issues upon request. On the PRO subscription tier, every support action is shown on the merchant’s own audit log for full visibility.

6. Trusted service providers and overseas data storage (Singapore)

We work with a small number of trusted technology vendors who are bound by confidentiality obligations and cannot use your data for their own purposes:

• Supabase (Database & Authentication): Production servers are hosted in Singapore. This cross-border transfer complies with Section 129 of the PDPA based on: (1) your explicit consent given during registration and booking, and (2) binding contractual and technical safeguards ensuring data protection standards equivalent to Malaysian law.

• CHIP (Payment Processing): Processes counter card and DuitNow QR payments. Meikigo never sees or stores your card details.

• Brevo: Sends verification codes, booking reminders, receipts, and approved marketing emails.

• Vercel Analytics: Cookieless, privacy-friendly analytics for our public marketing site only.

We do not sell, rent, or trade personal data to third parties.

7. Anonymous reviews and ratings

Star ratings submitted after completed visits are 100% anonymous in both directions. Neither the shop nor the barber can see who submitted a rating, and ratings are never displayed alongside customer names.

8. Data retention and account deletion

Sales and counter transaction records are retained for at least 7 years in compliance with Malaysian Inland Revenue Board (LHDN) statutory tax requirements.

Marketing consent records are retained for 12 months after account deletion or cancellation. Customer support tickets are retained for 3 years.

If you delete your account, your login is closed and your loyalty points are wiped. However, historical sales receipts stay on file because the law requires businesses to keep financial records.

9. Automated daily backups

We perform automated daily database backups retained for 30 days with point-in-time recovery. This describes our standard operational safeguards, not a legal guarantee against unexpected data loss.

10. Your rights under Malaysia’s PDPA

Under the Personal Data Protection Act 2010, you have the right to request access to and correction of your personal data, withdraw your consent to data processing, and request that we stop processing data likely to cause you damage or distress under Section 42 of the PDPA.

You also have the right to file a complaint with Malaysia’s Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi / JPDP): Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Presint 4, 62100 Putrajaya | Tel: 03-7456 3888 | Email: aduan@pdp.gov.my | Web: daftar.pdp.gov.my/p_aduan.

11. Contact us

To exercise any of your data rights or for privacy questions, please email support@meikigo.com, or write to Serpents Capital Solution, F-0203, Emporis Duplex, Psn Surian, Jalan Teknologi, Sek 3, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia.