1. Conversion measurement

Completed registrations, checkout starts and Stripe-confirmed payments are recorded in our internal reporting. With your advertising-cookie consent, an anonymous browser identifier links visits to conversions and Meta Pixel plus the Meta Conversions API measure completed registrations, checkout starts, subscriptions and purchases. Meta receives an SHA-256 hashed browser visit identifier, Meta browser/click cookie identifiers when available, browser user-agent information, event time and event ID, and actual MYR payment value. No name, email, phone number, birthday or IP address is attached by our server integration. Server-tracking consent and browser context expire after 30 days. Delivery status is stored to prevent duplicates; temporary failures can retry on subsequent payment processing or dashboard receipt checks. Declining advertising cookies disables browser attribution and Meta tracking. This conversion payload does not contain your name, email, phone number or date of birth. Internal business records remain available for operating and reconciling the service. You can change your cookie choice using Cookie preferences.

2. Feedback and internal product research

Feedback is linked to your signed-in account. Members choose Choplah support or their current community merchant as the recipient; merchants send platform feedback to Choplah support. Do not include passwords, codes, card details or another person’s information. Feedback messages stay in our database and are not sent to AI. Messages older than 180 days are removed when feedback history is opened; member deletion also removes their feedback. Choplah may use grouped activity counts across the platform for internal product and behaviour research with OpenAI after at least five member profiles exist. Names, contact details, birthdays, account identifiers, payment details and free-text feedback are excluded. Research findings stay in the backend and are not presented as member or merchant recommendations. They do not change accounts, points, rewards or payments. AI requests disable Responses API application storage, but provider safety or legal retention may still apply. OpenAI may process these limited inputs outside Malaysia. AI findings can be incomplete or inaccurate.

3. Who we are

Choplah is operated by Bluepeak Consultant Sdn Bhd. This notice covers members, merchants and visitors. Your participating merchant or event organiser also manages its own loyalty programme and is responsible for its own collection and use of customer information. Contact us at customersupport@choplah.com. Registered business address: pending confirmation.

4. What we collect and where it comes from

Members provide their name, phone number, email and date of birth. We keep an authenticated member wallet linking the communities you join. Scanning a new merchant can reuse your saved details after you confirm joining; existing memberships under an email are linked only after email verification. We record consent, community memberships, points, chops, campaign scans and claims, reward redemptions, event RSVPs, selected stops, category interests and last activity. Merchants provide company details, registration number, contact information and address when completing their profile. Information also comes from staff-verified purchases, your use of the app, and the sign-in and payment providers you choose. Security records may include IP address, request and device/browser information, authentication attempts and session identifiers.

5. Sign-in and payments

We store password hashes rather than readable merchant passwords, and use verification codes, recovery credentials and session records for account security. If you choose Google sign-in, we receive your Google account identifier, verified email and basic profile information; we do not receive your Google password or access your mailbox. Stripe processes merchant payments. We record Stripe identifiers, subscription status, invoicing and charge information. Full card numbers and security codes are entered directly with Stripe, not stored in Choplah’s customer database.

6. Why we use information

We use this information to create and secure accounts, administer loyalty programmes and merchant subscriptions, verify purchases, prevent duplicate or fraudulent claims, issue rewards, support customers and resolve billing or programme disputes. Date of birth supports the 18+ rule and birthday rewards. Activity and category choices help personalise recommendations and rewards. Choplah studies grouped usage counts in the backend to improve the service. Individual member profiles are not sent to OpenAI and AI recommendations are not offered in the member or merchant interface. Joining does not subscribe you to SMS, WhatsApp or promotional email marketing. Separate permission is required for optional marketing.

7. Required information and your choices

Signup fields marked required are needed to establish and verify membership or the merchant account. If you do not provide them or withdraw permission for essential programme processing, we may be unable to maintain that membership or deliver its rewards. Optional advertising cookies can be declined without losing membership. You can choose whether to use Google, password or the available email verification flow. Providing information about someone else requires their permission or another lawful basis.

8. Who receives information

Authorised personnel of the merchant or community you join can access information needed to run that programme, including customer profiles, activity and reward records. It is not a public member directory. Bluepeak and service providers supporting hosting, database storage, authentication, email delivery and billing process information for those purposes. Our services use Sites hosting infrastructure, Cloudflare, Resend and Stripe; OpenAI processes limited grouped inputs for internal research when configured; Google is involved when you choose Google sign-in. Meta receives consented advertising page views and server-confirmed conversion information only after you allow advertising measurement. We do not sell your personal information. Information may also be disclosed where required by law or needed to investigate fraud, protect accounts or resolve a dispute.

9. International processing and security

Service providers may process information outside Malaysia. Overseas processing must be assessed against applicable data protection requirements and appropriate safeguards. We use access controls, protected sessions and hashed credentials; no online service can guarantee absolute security. Merchants must protect exports and staff access. Please do not send passwords, verification codes, full card details or sensitive documents to support unless specifically required through an appropriate secure process.

10. Retention and deletion

Our member retention rule is to remove inactive member profiles after 12 months of inactivity, subject to necessary legal or dispute records. The current app flags these profiles for merchant review and manual removal; deletion is not yet an automatic scheduled process. Members can request deletion sooner through their profile. Deletion removes membership and associated points and reward records. Merchant account, billing, fraud and dispute records are retained only as needed for the service and applicable obligations; they may need to remain after account closure. Backup or provider copies, where present, may expire separately and must not be used to restore a deleted active profile without a valid reason.

11. Your rights and requests

You can request access, correction, withdrawal of consent, deletion and cessation of direct marketing. Other rights, including objection to processing likely to cause damage or distress, apply where provided by Malaysian law. Use your member profile to edit details, download the profile and recent points history, or delete membership; that download is not a complete export of every record held by every provider. Email customersupport@choplah.com for a fuller request or contact the merchant for records it holds separately. We may verify your identity and explain any lawful restriction. You may raise a complaint with Malaysia’s Personal Data Protection Commissioner.

12. Notifications, nearby shops and sponsored content

Notifications are off until you turn them on in your member profile. When you do, your browser gives us a notification address and encryption keys for that device; we keep them with your member wallet only to tell you when a shop adds a chop or points, or when a reward is ready, and we delete them when you turn notifications off or the address stops working. If you choose “Email me when a reward is ready”, we use your member email only for that alert, and you can turn it off in your profile. We do not use your phone’s GPS. To show shops near you, we use the area of the shop where you last scanned or collected a chop in the past 14 days, the area of your own shop, or an area you choose; this uses information we already hold about your visits. Shops can pay to feature their offers in the member app. These are always labelled “Sponsored”. We count how many members see and tap them, and whether a member who tapped later joined that shop, and we report only these totals to the shop.

13. Cookies and advertising

Member sign-in uses a persistent browser cookie refreshed when the wallet opens, with up to one year of validity. Signing out revokes the browser session; clearing cookies, switching browsers or a security reset may require sign-in again. Essential cookies maintain login sessions and security; browser storage saves preferences and some onboarding drafts. Optional Meta Pixel and Meta Conversions API measure page views and confirmed conversions after an explicit Allow choice. Existing advertising consent is requested again when server tracking is introduced. Withdrawal removes the saved server advertising context and stops future delivery; it does not recall events already sent. We retain a minimal record of your declined choice to prevent delayed requests from restarting tracking. Our Pixel integration does not attach member profile fields to those events. Meta may receive browser/cookie identifiers and page information and process them under its own policy. Use the Cookie preferences button to change your choice; withdrawal stops future tracking and does not erase information already received by Meta. See the Web App Policy for more information.

14. Age, updates and contact

Membership is for people aged 18 or older. We may update this notice when the service or its data handling changes and will seek fresh permission where required. The updated date identifies this version; existing consent records remain intact. Privacy enquiries: Bluepeak Consultant Sdn Bhd, customersupport@choplah.com. Registered business address: pending confirmation.

BAHASA MALAYSIA

Polisi Privasi

Dikemas kini 14 Oktober 2026 · Notis pengukuran penukaran