This notice explains how Ofdast Network (Business Registration No. 002908949-X) (“LokalFlow”, “we”, “us”) collects, uses, shares and protects personal data, and what rights you have. It is issued under the Personal Data Protection Act 2010 (“PDPA”) and is available in English and Bahasa Malaysia. If the two versions differ, the Bahasa Malaysia version prevails.
01Two different roles
LokalFlow handles personal data in two separate roles, and it matters which one applies to you.
- If you are a seller using LokalFlow to run your business, we are the data controller of your account data. This notice tells you what we do with it.
- If you are a customer who placed an order or sent a message to a business that uses LokalFlow, that business is the data controller and we are only its data processor. We handle your data on that business's instructions, to run their ordering system. For questions about your order, or to ask for your data to be corrected or deleted, contact the business you ordered from. You may also contact us and we will pass it on.
02What we collect
From sellers
- Account details — business name, email address, phone number, password (stored as a one-way hash, never in readable form).
- Business content — logo, brand colours, product names, descriptions, photos, prices, delivery zones, DuitNow QR image, subdomain requests.
- Billing details — plan, subscription status, credit balance, payment history and a customer reference held by our payment processor. We never receive or store your full card number.
- WhatsApp connection data — the session credentials created when you link your number, and connection status.
- Support correspondence — the tickets and emails you send us.
From sellers' customers
- Name, phone number or WhatsApp identifier, delivery address or delivery zone, the contents of order and enquiry messages, order details and totals, and payment status.
Automatically
- IP address, browser type, pages visited, timestamps, and error and security logs — used to keep the service working, apply rate limits and detect abuse.
We do not intentionally collect sensitive personal data (such as health, religious or political information). Please don't put it into a message or a product description.
03Why we use it, and our lawful basis
| Purpose | Basis under the PDPA |
|---|---|
| Creating and running your account; providing the dashboard, order pages and messaging features | Performance of a contract with you |
| Reading, classifying and drafting replies to customer messages using AI; working out order contents | Performance of a contract; your consent given when you connect WhatsApp |
| Generating marketing copy and videos from what you supply | Performance of a contract |
| Taking payment for your plan and credits; issuing receipts | Performance of a contract; legal obligation |
| Sending service emails — confirmation, trial reminders, payment and support notices | Performance of a contract |
| Security, rate limiting, fraud prevention, debugging, backups | Our legitimate interests in keeping the service safe and available |
| Keeping financial and tax records | Legal obligation |
| Product news and marketing emails | Your consent — you can withdraw it at any time |
You are required to give us the account and billing details marked as needed at sign-up; without them we cannot provide the service. Everything else is optional.
We do not sell personal data, and we do not use your customers' data to market to them ourselves.
04AI processing
Message content, order text, product names and photos you submit to AI features are sent to Google's Gemini and Veo APIs for processing, and are handled under Google's terms for those APIs. AI output can be wrong — check it before you rely on it or send it to a customer.
05Who we share it with
We share personal data only with the suppliers we need to run the service, and only as much as they need:
| Who | What for |
|---|---|
| Google (Gemini, Veo) | Reading messages, drafting replies, parsing orders, generating copy and video |
| Cloudinary | Storing and serving images and video |
| Stripe | Taking payment for LokalFlow plans and credits |
| Billplz | Creating payment links on a seller's own gateway account, where the seller has connected one |
| Hostinger | Web hosting, database, outgoing email |
| WhatsApp / Meta | Delivering messages to and from your WhatsApp number |
We may also disclose personal data where the law requires it, to a regulator or court, to enforce our terms, to protect someone's safety, or to a buyer if the business is sold — in which case this notice continues to apply.
06Transfers outside Malaysia
Some of the suppliers above process data on servers outside Malaysia. Where that happens we rely on the transfer conditions in section 129 of the PDPA — including that the receiving place has laws substantially similar to the PDPA or offers an adequate level of protection, the transfer is necessary to perform our contract with you, or you have consented. We assess each supplier's protections before using them.
07How long we keep it
- Account and business data — while your account is open, and for up to 90 days after you close it, so it can be restored if you change your mind.
- Orders and messages — while the seller's account is open, or until the seller deletes them.
- Financial records — 7 years, as required by Malaysian tax law.
- Security and error logs — up to 12 months.
- WhatsApp session credentials — deleted when you disconnect your number.
After these periods we delete or anonymise the data.
08How we protect it
We use HTTPS across the site, hash passwords, store connected gateway keys encrypted, use parameterised database queries, verify payment webhooks by signature, apply rate limits, and restrict administrative access. No system is perfectly secure, but if a breach happens that is likely to cause significant harm we will notify the Personal Data Protection Commissioner and, where required, the people affected, within the time limits set by the PDPA.
09Your rights
Under the PDPA you may ask us to:
- Access the personal data we hold about you.
- Correct data that is inaccurate, incomplete or out of date.
- Withdraw your consent to processing, including marketing emails.
- Limit processing, or stop processing that causes you distress.
- Stop processing for direct marketing.
- Receive a copy of your data in a portable format, or have it transmitted to another provider where technically feasible.
Email hi@lokalflow.my to make a request. We may ask you to confirm your identity, and we will reply within 21 days. A small fee may apply to an access request, as allowed by the PDPA. Withdrawing consent may mean parts of the service stop working.
If you are a customer of a business that uses LokalFlow, send your request to that business — they control your data. If you can't reach them, contact us and we will help.
10Cookies
We use only what the site needs to work: a session cookie to keep you logged in, and a cookie remembering your language choice. We do not use advertising or cross-site tracking cookies. Blocking cookies will stop you being able to log in.
11Children
LokalFlow is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child's data has reached us, email us and we will remove it.
12Changes to this notice
We may update this notice. The date at the top shows the current version, and we will email account holders about any significant change.
13Contact and complaints
Ofdast Network (Business Registration No. 002908949-X)
Email: hi@lokalflow.my
Web: lokalflow.my
If you are unhappy with how we have handled your personal data, please tell us first. You also have the right to complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia — pdp.gov.my.