Privacy Notice

Version 1.1 · Last updated 14 November 2026 · Issued under the Personal Data Protection Act 2010 (Malaysia)

1. Who is responsible for your data

Big Domain Sdn Bhd (Company No. 1255428-V), Malaysia, operates WAPP.MY and is the data controller for the personal data described here. Contact details are in §10.

2. What we collect

Category	Examples	Why
Account data	Name, email address, password (hashed), profile photo, WhatsApp number, dial-code country, referral code	To create and secure your account and let people reach you
Content data	Your bio text, links, buttons, vCard fields, uploaded images, Marketplace listing details	To publish the page or card you asked for
Technical data	IP address, approximate country, device class, browser, operating system, user-agent, referring page	To route and secure the Service, and to prevent abuse
Usage data	Link created, click, copy, QR download, share, page view, onboarding progress	To show you statistics and to operate the Service
Billing data (where a paid feature is used)	Name, contact, invoice and payment reference	To process payment and meet tax obligations
Moderation data	Reports received, our findings, action taken, evidence snapshot	To enforce the Terms and to answer regulators and brand owners

3. What we do not collect or keep

We do not store the contents of a WhatsApp conversation — a WhatsApp link hands the conversation to WhatsApp.
We do not store card numbers; payments are handled by the payment provider.
We do not buy or rent personal data from third parties.

4. The basis on which we process

We process your personal data because it is necessary to perform our contract with you (providing the Service), because we have a legitimate interest in keeping the Service secure and free of abuse, to comply with a legal obligation, or because you have consented (for example, marketing email, which you can opt out of at any time).

5. Who we share it with

Service providers who host, deliver, back up or secure the platform, and who send transactional email — bound to use the data only for us.
Authorities, where required by law or where we believe in good faith that disclosure is necessary to investigate unlawful activity (for example a gambling, scam or phishing report to the Royal Malaysia Police or MCMC).
A brand owner or rights holder, in limited form, when a page is impersonating them, so they can pursue their own complaint.
A successor, if the business or the platform is transferred.

We do not sell personal data.

6. Where it is stored

Data is stored on servers located in Singapore and is accessed from Malaysia. Where personal data moves outside Malaysia, we take reasonable steps to ensure it receives a standard of protection comparable to the PDPA, as required by section 129 of the Act.

7. How long we keep it

Account and content data: while the account is open, then up to 90 days after closure for backup and dispute purposes.
Click and view metadata: retained in aggregate; identifiable technical logs are kept up to 24 months and then deleted or anonymised.
Moderation and enforcement records: kept up to 7 years, because they may be needed for a legal claim, a regulator's request or to prevent a repeat breach. Suspended content may be retained in snapshot form even after the page is removed — this is disclosed in the Terms so that it is not a surprise.

8. Cookies and similar technology

We use strictly necessary cookies to keep you signed in and to protect forms against cross-site request forgery. We use analytics that records page and click activity in aggregate. We do not use advertising cookies to profile you across other websites.

9. Your rights

Subject to the PDPA, you may ask to: access the personal data we hold about you; correct it; withdraw consent for marketing; limit how we process it; or have your account and content deleted. Write to the address in §10 — we aim to respond within 21 days. If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia.

Note: a deletion request does not override a legal obligation to retain a moderation or enforcement record (§7).

10. Contact

Privacy contact — write to abuse@wapp.my with the subject line “Privacy request”. Every message is logged and tracked. General enquiries: hello@bigdomain.my.
Registered address — Big Domain Sdn Bhd (1255428-V), 45-2, Level 2, Setia Sentral, Lorong Setia Sentral 1, 13600 Perai, Pulau Pinang, Malaysia.
Telephone — +60 11-5581 8160

11. Changes

If we change how we handle personal data in a material way, we will publish a new version here with a new date and notify account holders by email.

This notice is provided in English; a Bahasa Malaysia version is available on request. In case of conflict, the English version governs.