Last updated: 30 October 2026
1. Who we are
fred.my is operated by Freddie Aziz Jasbindar, Parit, Perak, Malaysia. This policy explains how we collect, use and protect personal data under the Malaysian Personal Data Protection Act 2010 (PDPA).
2. Data we collect
- Account: name, email, password (stored as a hash), profile photo, country, time zone, language.
- Sign-in: device sessions, IP address and browser type for security.
- Apps: data you enter, e.g. BizHub company records & documents, Chatlane numbers & contacts, Fredo devices.
- Payments: amount, currency, status and transaction reference. Card details are processed by Stripe/Billplz and never stored by us.
- Help: support tickets and help chat questions (to improve answers).
- In-browser tools: QR Generator, Invitations and parts of Sticker Studio process files in your browser; we do not receive them.
3. How we use it
- To provide and maintain the Services and single sign-on.
- To process payments, invoices and receipts.
- To send important emails (verification, password reset, receipts, deadline reminders).
- For security, fraud prevention and usage limits.
- To improve the Services using feedback and anonymous statistics.
4. Public display
Only if you choose: your name and profile photo on the Friends wall, and public donors' names and messages. You can withdraw at any time.
5. Wachap staff location and website live chat
Staff can opt in to sharing their current location, including while the phone app is in the background. Sharing requires consent and phone permissions and can be stopped from Profile. Only workspace owners/admins can view staff locations. We store only the latest coordinate, not travel history; expired coordinates are hidden after 2 minutes and cleared from location records on the next check. OpenStreetMap or a map app you open may receive the selected coordinates.
The live chat widget stores visitor names, messages and image/audio/video attachments for the website support team. Visitors can optionally supply a phone number and email for follow-up; these details are self-reported and unverified. A random browser-storage token lets a visitor reopen their conversation; visitor access tokens expire after 30 days. Support messages are retained while the workspace is active, subject to the account deletion policy.
6. Cookies & storage
FREDMY_AUTH— sign-in session shared by every app.FMY_UI— form & security session (CSRF).fm_lang,fm_cur, theme — language, currency and display preferences.- The help chat keeps the conversation in your browser's sessionStorage only. We do not use advertising cookies.
7. Sharing with third parties
We never sell your data. It is shared only with the processors we need: hosting provider (Malaysia), Stripe and Billplz (payments), Google (if you sign in with Google) and email providers — or when required by law.
8. Retention
Data is kept while your account is active. After account deletion it is removed within 30 days, except records we must keep (e.g. payment records for tax, up to 7 years).
9. Security
HTTPS connections, hashed passwords, AES-256 encrypted secrets, sign-in rate limits and role-based access control. No system is 100% secure; tell us immediately if you suspect misuse.
10. Your rights
- Access and correct your data in My account › Edit profile.
- Request a copy or deletion of your data via a support ticket.
- Withdraw consent for public display or marketing emails (if any).
- Complain to the Malaysian Personal Data Protection Department.
11. Children
The Services are not directed at children under 13. Users under 18 need permission from a parent or guardian.
12. Changes
We may update this policy; the update date is shown above.
13. Contact
Privacy officer: hi@fred.my.