Privacy Policy

1. Who we are

This policy explains how Fractal Digital Agency, which operates the Kilat Carwash Network platform, handles personal data, in line with Malaysia's Personal Data Protection Act 2010 ("PDPA"). It covers operators, their customers (data handled on the operator's behalf), and sales agents. For personal data of an operator's customers, the operator is the data user and Fractal Digital Agency acts as data processor, except where Fractal Digital Agency determines the purpose (security, fraud prevention, payment settlement).

2. What we collect

From operators: business name, owner/contact name, email, phone, business/billing address, bank account details for payment settlement, and account activity.

From customers (on the operator's behalf): vehicle plate and type, phone number (when phone-verified), ticket and wash history, loyalty balances, notification preferences, and — for online payments — the transaction record (amount, time, reference). Card and bank credentials are entered directly with our payment processor and are not seen or stored by us.

From sales agents: name, phone, email, national identity information (NRIC) and bank details required for KYC and commission payouts.

Automatically: IP address, device/browser type, and operational logs used for security, debugging, and abuse prevention.

3. How and why we use it

To provide the Service: queue and job management, billing, loyalty, marketing you initiate, commission tracking, and — for wash payments where we act as Merchant of Record — collecting payment from customers and remitting it to the operator.

To keep the platform secure and prevent fraud, to meet legal, tax and accounting obligations, and to improve the product using aggregated, de-identified data. We do not sell personal data.

4. Payment data

Online wash payments are processed by our licensed payment processor (currently toyyibPay). Fractal Digital Agency, as Merchant of Record, receives and stores transaction records (amounts, references, status) needed to settle funds to operators and to handle refunds and disputes. Sensitive payment credentials (card numbers, banking logins) are handled by the processor under its own security standards and are not stored by Fractal Digital Agency.

5. Where data is stored and how it is protected

Data is stored on Google Cloud infrastructure in the asia-southeast1 (Singapore) region. Access is enforced by per-tenant security rules — each operator can access only their own tenant's data — and platform administrators access data only as needed to provide support, ensure security, or meet legal obligations.

6. Who we share it with

Service providers who help us run the platform, under confidentiality obligations: Google Cloud (hosting), our payment processor (toyyibPay) and banks/DuitNow for settlement and payouts, and notification providers (Firebase Cloud Messaging, and, if enabled, WhatsApp/SMS providers). We also disclose data where required by law or to protect our or others' rights. We do not otherwise share personal data.

7. Cross-border transfer

Because our infrastructure and some processors are located outside Malaysia (including Singapore), your personal data may be transferred and processed outside Malaysia. Where we do so we take steps consistent with the PDPA to ensure a comparable level of protection.

8. Retention

We keep personal data for as long as needed to provide the Service and to meet legal, tax, and anti-fraud obligations. After an account is cancelled, associated data is retained for 90 days and then deleted, except records we are required or entitled to keep for longer.

9. Your PDPA rights

Subject to the PDPA, you may request access to and correction of your personal data, withdraw consent or limit processing, and, where applicable, request deletion. Customers of an operator should first contact that operator (the data user); we will assist as processor. To exercise a right or raise a concern, email hello@kilatcarwash.net.

You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

10. Cookies and local storage

The apps use local storage and IndexedDB for sign-in sessions and offline caching (e.g. loyalty data). We do not set third-party advertising cookies.

11. Changes and contact

We will notify material changes to this policy in-app and/or by email at least 30 days before they take effect. Privacy questions or requests: hello@kilatcarwash.net (Fractal Digital Agency).