At UP HUB, we are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, and safeguard your data when you use our platform.
Information We Collect
We collect information you provide directly to us, including your name, email address (UiTM student email), profile information, and any content you post on the platform (products, messages, reviews).
How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Process transactions and send related information
- Send you technical notices and support messages
- Respond to your comments and questions
- Monitor and analyze usage patterns to improve user experience
Who We Share Data With (Processors)
We use third-party service providers to operate UP HUB, each acting as a data processor on our behalf:
- Cloudflare R2 — stores uploaded images (listing photos, avatars).
- Better Auth / Turso (database) — stores your account, session, and authentication data.
- Resend — sends verification and transactional emails.
- Pusher — powers real-time messaging and notifications.
- Google Tag Manager / analytics (if enabled) — aggregate usage analytics.
We do not sell your personal data to third parties. [NEEDS REAL COPY: confirm complete processor list and whether any processors store data outside Malaysia, which affects PDPA cross-border transfer disclosure.]
Data Retention
We retain your account data for as long as your account is active. If you delete your account, we remove or anonymize your personal data within [NEEDS REAL COPY: retention period, e.g. 30/90 days], except where we are required to retain records for legal or fraud-prevention purposes.
Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
Your Rights Under the PDPA (Malaysia)
Under the Personal Data Protection Act 2010 (Malaysia), you have the right to: access the personal data we hold about you; request correction of inaccurate data; withdraw your consent to processing (which may limit your ability to use the platform); and lodge a complaint with the Personal Data Protection Commissioner if you believe your data has been mishandled.
Your Rights
You have the right to access, update, or delete your personal information at any time through your account settings. You may also contact us if you have questions about your data.
Data Requests & Contact
To exercise any of the rights above, or with questions about this Privacy Policy, contact us at [NEEDS REAL COPY: a monitored data-request email address — noreply@uphub.my is not appropriate for PDPA data requests since it implies no one reads replies].