← Back to home

Privacy Policy

Last updated: May 2026

1. Introduction

VoucherBless MY ("we", "us", "our") is committed to protecting your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). This Privacy Policy explains what data we collect, why we collect it, and your rights regarding your data.

2. Data We Collect

  • Identity data: Full name, as provided during registration.
  • Contact data: Mobile phone number, email address.
  • Transaction data: Voucher purchases, redemptions, lucky draw entries, payment references.
  • Technical data: IP address, browser type, session tokens (collected automatically).
  • Merchant data: Business name, registration number, category, contact person, uploaded documents.

3. Purpose of Processing

  • Account creation and authentication (SMS OTP verification).
  • Processing voucher purchases and payments.
  • Delivering vouchers and confirming transactions by email.
  • Operating lucky draws and notifying winners.
  • Merchant onboarding, approval, and settlement.
  • Customer support and dispute resolution.
  • Compliance with legal obligations.

4. Third-Party Services

We share data with trusted third-party processors only as necessary to operate the Platform:

  • Xendit — payment processing. Your payment details are handled directly by Xendit.
  • isms.com.my / Twilio — SMS OTP delivery.
  • Resend — transactional email delivery.
  • Cloudflare R2 — secure storage of uploaded documents and images.
  • Railway / Vercel — database and application hosting.

We do not sell your personal data to third parties.

5. Data Retention

Financial and transaction records are retained for 7 years in accordance with Malaysian financial regulations. Account data is retained for as long as your account is active. You may request deletion of your account; financial records required by law will be retained regardless.

6. Your Rights Under PDPA

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate data.
  • Withdrawal of consent: Withdraw consent to processing where consent is the legal basis (note: this may prevent us from providing services to you).
  • Deletion: Request deletion of your account and associated data (subject to legal retention requirements).

To exercise your rights, email support@voucherbless.com. We will respond within 21 days.

7. Security

We use industry-standard security measures including HTTPS, encrypted storage, and access controls. Passwords are hashed and never stored in plain text. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

8. Contact

For privacy-related enquiries or to exercise your rights:

See also our Terms of Service.