Privacy Policy

01Who we are

FrintHub is a print-on-demand service based in Malaysia, offering business cards, flyers, stickers, banners, apparel, merchandise and related printing through a mobile application and this website.

FrintHub is operated by CONFIRM: registered company name (Company Registration No. CONFIRM: SSM registration number), with its registered address at CONFIRM: registered business address, Malaysia. In this policy, "FrintHub", "we", "us" and "our" refer to that company, which is the data controller (the "data user" under the PDPA) responsible for your personal data.

If you have any questions about this policy or about how your personal data is handled, contact us at info@frinthub.cloud.

02Information we collect

We collect only the information we need to provide the service. Depending on how you use FrintHub, this may include:

Account and profile information

• Your email address and full name, which you provide when you register. Your email is your login identity.
• Your password, which we store only in hashed form — we cannot see your actual password.
• An optional profile photo / avatar and a preferred language (English, Chinese or Bahasa Malaysia) if you set them.
• If you use student verification, a student email address and your resulting verified-student status.
• Account activity such as your last sign-in time and account status, used to keep your account secure.

Contact information

• Your phone number, if you choose to add it to your profile or to a delivery address. A phone number is optional and is not required to create an account.

Delivery addresses

• When you choose delivery, the recipient name, phone number, address lines, city, state, postcode and country you save. When you choose self-collection, we record the outlet you select instead.

Uploaded artwork and printing files

• The design files, artwork and/or links you upload for printing, together with the file's original name, type and size. These files are stored so we can produce your order.
• Please note: uploaded artwork and generated order documents (invoices and receipts) are stored as files that are accessible through a unique, non-public link. Anyone who has that exact link can open the file, so please treat these links as confidential and share them only with people you trust. CONFIRM: whether you want stronger access controls on uploaded files/documents before launch

Order and transaction information

• Details of your orders: order and receipt numbers, the products and print options you chose, quantities and prices, any vouchers, discounts or student discounts applied, the delivery method and chosen address or outlet, order status and timestamps, and your invoice and receipt documents.
• Payment references returned by our payment provider (see Payment processing). We do not receive or store your card number or banking credentials.

Loyalty, points and donations

• Your loyalty membership number and points activity (points earned, redeemed, expired, adjusted or donated), which are linked to your account.

Support communications

• If you contact us through in-app chat or by email, we keep your messages and any attachments so we can respond and support you.

Technical and device information

• To deliver and secure the service, our servers and our service providers may process basic technical data such as your IP address and device or browser type as a normal part of an internet request. See Device information, analytics & cookies for detail on what we do and do not do with this data.

03Why we collect it

In line with the PDPA's Notice and Choice principle, we use your personal data only for the following purposes:

• To create and manage your account and verify your identity (including password reset and, if you use it, student verification).
• To let you configure print jobs, upload artwork, and place and pay for orders.
• To produce, fulfil and deliver your orders, and to arrange delivery or self-collection.
• To issue invoices and receipts and keep proper business and accounting records.
• To operate the loyalty programme (points, vouchers and, where offered, donations).
• To send you service messages about your account and orders, and to respond to your support requests.
• To keep the service secure, prevent fraud and misuse, and troubleshoot problems.
• To comply with our legal obligations under Malaysian law.

We rely on your consent, the performance of our contract with you, and our compliance with legal obligations as the bases for processing your personal data. Where processing depends on your consent, you may withdraw it at any time (see Your rights & choices).

04Payment processing

Payments are processed by iPay88 (CONFIRM: iPay88 operating entity, e.g. Mobile88.com Sdn Bhd), a third-party payment gateway. When you pay, you are taken to iPay88's secure payment page, where you enter your card or banking details directly with iPay88.

To start a payment, we send iPay88 the information it needs to process the transaction: your name, email address and phone number, the order number, the amount and currency (MYR), and a short product description. We do not send iPay88 your artwork or delivery address.

iPay88 handles your card and banking details on its own systems under its own privacy policy. FrintHub does not receive or store your full card number, CVV or banking credentials. We store only the transaction records returned to us — such as the iPay88 transaction reference, the payment method used, the amount, status, and your receipt number — together with a log of each payment interaction for reconciliation and troubleshooting.

05Notifications & emails

We use OneSignal, a third-party messaging provider, to deliver emails and push notifications.

Emails

The emails we send are service (transactional) emails only — for example, password reset messages and one-time verification codes. We do not currently run marketing email campaigns. CONFIRM: if you plan to send marketing emails, we must add clear opt-in consent and an unsubscribe option

Push notifications

If you allow notifications, we send push notifications about your account and orders (for example, order paid, in production, ready and completed), replies to your support chat, and loyalty or donation updates. We may also send occasional announcements about FrintHub news and events.

To deliver push notifications, our systems identify you to OneSignal by your FrintHub member ID; the push "device token" itself is managed by OneSignal on your device. You can turn push notifications off at any time in your device's notification settings. CONFIRM: whether you want an in-app notification opt-out / preference setting — one does not exist today

06Device information, analytics & cookies

We have deliberately kept tracking to a minimum:

• This website does not use cookies and does not run advertising, analytics or third-party tracking scripts. It loads its fonts from Google Fonts; as a technical part of serving those fonts, Google receives your device's IP address.
• The mobile app and website sign you in using a secure token stored on your own device, not through tracking cookies.
• We do not record your IP address, device identifiers or browsing behaviour in our own systems to build advertising or behavioural profiles, and we do not sell your personal data.
• As with any internet service, our hosting servers and the third-party providers listed below may process technical data such as IP address and device or browser information in the ordinary course of delivering and securing the service.
• The mobile app may collect basic device information needed to run the app and deliver push notifications (for example, through the OneSignal notification component). CONFIRM: any additional SDKs, analytics or crash-reporting tools bundled in the mobile app — the app is built separately and is not covered by our inspection of the backend and website

07Third-party service providers

We share personal data with a small number of service providers, only to the extent needed to run FrintHub, and we require them to protect your data:

• iPay88 (payment gateway, Malaysia) — receives your name, email, phone number, order number and amount to process payments. See Payment processing.
• OneSignal (email and push notification delivery) — receives your email address to send service emails, and your FrintHub member ID to deliver push notifications.
• Google Fonts (web font delivery for this website) — receives your IP address when fonts are loaded.
• Our hosting provider — CONFIRM: hosting provider name and server/data-centre location — hosts our servers and database, where your data is stored.

We may also disclose personal data where required by law, by a court or by a regulator, or to protect our rights, users or the public.

Uploaded artwork, avatars and order documents are stored on our own servers, not with a third-party cloud storage provider.

08International data transfers

FrintHub is operated from Malaysia. Some of our service providers process data outside Malaysia — for example, OneSignal and Google Fonts operate from the United States. Where personal data is transferred outside Malaysia, we take reasonable steps to ensure it is protected to a standard consistent with the PDPA. CONFIRM: locations of your hosting/data storage and any additional cross-border transfers

09Data retention

We keep your personal data for as long as your account is active and for as long as we need it for the purposes described above. Order, invoice, receipt and payment records are kept longer to meet Malaysian legal, tax and accounting requirements — for example, business and financial records generally need to be kept for up to seven (7) years.

When personal data is no longer needed, we delete or anonymise it. Note that our system currently retains records rather than automatically deleting them, and closed accounts are handled on request (see Your rights & choices). CONFIRM: your specific retention periods for accounts, uploaded artwork, orders and logs

10Security

We take reasonable measures to protect your personal data, including:

• Encrypting traffic between your device and our servers using HTTPS/TLS.
• Storing passwords only as salted hashes, never in plain text.
• Protecting accounts with token-based sign-in, session refresh and sign-out controls.
• Leaving card and banking details to our payment provider, so they never reach our systems, and verifying the authenticity of payment notifications.
• Naming stored files with unique, non-sequential identifiers, and redacting sensitive fields (such as password hashes and security tokens) from our internal activity logs.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that affects you, we will act in accordance with applicable Malaysian law. CONFIRM: your internal breach-notification process and whether a Data Protection Officer has been appointed

11Your rights & choices

Under the PDPA, you have rights over your personal data. You can:

• Access and correct much of your information directly in the app — for example your name, phone number, avatar, preferred language and saved delivery addresses.
• Request access to the personal data we hold about you, or ask us to correct it where it is inaccurate or incomplete.
• Request deletion of your account and personal data. There is currently no self-service "delete account" button, so we handle deletion requests manually — email us and we will delete or anonymise your data, except where we must keep certain records to comply with the law.
• Withdraw consent or limit how we use your data, including turning off push notifications in your device settings.

To exercise any of these rights, email info@frinthub.cloud. We may need to verify your identity before acting on a request. If you are not satisfied with our response, you may contact Malaysia's Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

12Children's privacy

FrintHub is intended for use by adults and is not directed to children under the age of CONFIRM: minimum age, e.g. 18. We do not knowingly collect personal data from children below that age without appropriate parental or guardian consent. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to remove it. CONFIRM: how student verification interacts with users who may be minors

13Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our service or in the law. When we do, we will revise the "Last updated" date at the top of this page, and, for significant changes, we may notify you through the app or by email. Please review this page periodically.

14How to contact us

If you have questions, concerns or requests about this Privacy Policy or your personal data, contact us at:

• Email: info@frinthub.cloud
• Operated by CONFIRM: registered company name, Company Registration No. CONFIRM: SSM registration number
• CONFIRM: registered business address, Malaysia
• CONFIRM: support / data-protection contact phone number, if any