Privacy Policy

Last updated: 23 October 2026

This policy explains how CHANGE_ME ("we") handles personal data in the PlanKahwin app, in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

1. What we collect

• Your account: name, email address, password (stored only as a secure hash), language and email preferences, and when you last logged in.
• Your wedding planning: what you and the people you invite enter, such as event details, checklist, budget, vendors, hantaran, documents, gifts and photos.
• Your guests: names, phone numbers and other details you add for your guest list, and the RSVP answers guests give.
• Payments: payer name and email, amount, date and receipt number. Bank and card details are entered on the payment gateway's page (toyyibPay); we never see or store them.
• Technical data: cookies needed to keep you logged in, remember your language and protect forms, plus server logs used for security and fixing problems.

2. Why we use it

• To provide the app: your account, your shared wedding workspace and the RSVP pages for your guests.
• To send emails you need: account verification, password reset, invitations, reminders and receipts. You can turn reminders and summaries off in My account.
• To process payments and keep records required by law.
• To give support, keep the service secure and improve it.

We do not sell your data and do not use it for advertising.

3. Who can see it

• People in your workspace: your partner and the helpers you invite, limited to what their role allows.
• Your guests: only their own RSVP page.
• Our support staff: may access your account to answer your support request or investigate a problem. Every such access is recorded.
• Service providers acting for us: the payment gateway (toyyibPay), our email provider and our hosting provider, only as needed to run the app.
• Authorities: when the law requires it.

4. Your guests' data

You decide what guest details to add. Please only add what you need for your wedding, and make sure your guests are comfortable with you keeping their details here.

5. How long we keep it

We keep your data while your account and workspace exist. When a paid plan ends, the workspace becomes read-only and the data is kept so you can renew. A free trial that is never paid is deleted with all its data 30 days after it started, and accounts left without any workspace are deleted with it. The workspace owner can delete the workspace and everything in it at any time (Settings). To delete your account, email us. Payment records are kept as long as tax and accounting law requires. So that each person gets only one free trial, we keep a one-way code (hash) of your email address after the account is deleted; it cannot be turned back into your email.

6. Security

Connections are encrypted (HTTPS), passwords are hashed, and each wedding's data is kept apart from every other. No system is perfectly secure, so please use a strong password and keep it to yourself.

7. Your rights

Under the PDPA you may ask to see or correct your personal data, withdraw consent or ask us to delete it. Most details can be changed in the app; for anything else, email us and we will reply within 21 days.

8. Changes

We may update this policy. We will show the new date above and tell you in the app or by email about important changes.

9. Contact

Email [email protected].