Privacy Policy
Effective date: 21 October 2026 · Last updated: 6 October 2026 · Version v1.6
Compliant with Malaysia's Personal Data Protection Act 2010 (PDPA)
What changed in this version
- We now list all the data we collect, including brand business and tax details, job agreement records, event check-in, direct messages, self-reported audience stats and time spent on the Platform.
- We name every service provider, where it processes data, and which ones are outside Malaysia, including our AI provider DeepSeek.
- Corrected: our database is hosted in South Korea, not in the EU or US.
1. Data Controller
MY-INFLUENCE ("we", "us", "the Platform") is operated by MYINFLUNCE TECHNOLOGY (registration no. 202603137753 (TR0343103-V)), D4,26-06 1, JLN RAZAK MANSION SUNGAI BESI, 57100 KUALA LUMPUR, WILAYAH PERSEKUTUAN. We are the data controller responsible for the personal data you provide when using our services at myinfluencekl.com.
Contact: support@myinfluencekl.com
2. Personal Data We Collect
We collect the following categories of personal data:
Account Data (all users)
- Full name (collected at registration for account identification)
- Email address
- Password (stored as a bcrypt hash — never in plain text)
- Phone number
- State/Region (Malaysian state)
- Preferred language
- Referral code, and who referred you (if you signed up through a referral link)
- Your consent record: when you agreed to our Terms and this Policy, and which version
Creator Profile Data (KOL/KOC accounts)
- Social media handles (TikTok, Instagram, Facebook, Xiaohongshu)
- Publicly available follower counts and engagement metrics (scraped from public profiles)
- Profile photo (uploaded voluntarily)
- Portfolio URLs (uploaded voluntarily)
- Service pricing
- Category and skill tags
- Self-reported audience statistics (optional): audience country, age range and gender split, follower count and engagement rate. Shown to Brands marked as "self-reported", not verified.
- Analytics screenshot (optional) that you upload to support your self-reported statistics. It is stored privately: only you can view it, and our staff may review it to check your figures.
- Job agreements: when you apply for a job, we record the agreed terms (the MOA), the date and time, and the IP address you agreed from, as evidence of the agreement.
- Event check-in: for on-site event jobs, your device's location is read once, when you tap check-in, to confirm you are at the venue. We store only that you checked in and when, not your location.
Brand Profile Data
- Company or brand name
- Brand logo (uploaded voluntarily)
- SSM business registration number, submitted for business verification
- Tax Identification Number (TIN), SST registration number (if any) and billing address, used on your invoices
- Job postings, including event venue details where relevant
Direct Messages
- Messages you send to and receive from other users through the Platform, stored so both sides can see the conversation
- Our staff do not routinely read messages. We may review them to resolve a dispute, investigate fraud or a report of abuse, or where the law requires it.
Transaction & Financial Data
- Order amounts and payment history
- Wallet balances (pending and available)
- Cashout requests: bank name, account number, account holder name
- Payout and refund records
- Card payments are entered directly with Stripe. We never see or store your full card number; we keep only Stripe's payment and refund references.
Usage Data
- Login activity: the number of days you have logged in and your last login date
- Time spent on the Platform, counted in one-minute intervals while you are signed in and the Platform is open
- Profile view counts
- Platform activity logs (for fraud detection purposes)
- IP address and browser type, used briefly to limit repeated requests and protect the Platform from abuse
Creators We May Invite (non-users)
- If you are a creator who has not joined, we may hold details from your public social media profile (username, display name, bio, follower range) so we can invite you to join. Email us to have these removed.
3. How We Use Your Data
- Platform operation: To create and manage your account, match Creators with Brands, and facilitate campaigns.
- Payment processing: To manage escrow funds, process payouts to Creators, and handle refunds to Brands.
- Transactional notifications: To send emails about order status changes, payment confirmations, dispute updates, and cashout approvals.
- Business verification and invoicing: To verify Brands through their SSM registration and to issue invoices with the correct business and tax details.
- Agreement records: To keep evidence of the job agreements (MOA) between Creators and Brands, including event check-in confirmation.
- AI features: Our AI assistant on public pages answers questions about the Platform, and our staff use AI to draft invitation messages to Creators. See Section 4 for what the AI provider receives.
- Security and abuse prevention: To limit repeated requests (for example, many sign-ups from one network) and keep the Platform available.
- Fraud detection: To monitor follower growth patterns and detect artificial inflation (e.g., sudden spikes >300% within 7 days).
- Platform analytics: Aggregated, non-identifiable analytics are used by platform administrators to improve the service.
- Legal compliance: To comply with Malaysian law, including tax obligations and lawful requests from authorities.
4. Third-Party Data Processors
We share your data with the following third-party processors, only as needed for the purpose listed. Each processes data under its own terms and data protection commitments:
Transfers outside Malaysia
As listed above, some of your data is processed outside Malaysia, including in South Korea, Japan, China and the United States. We transfer data abroad only where it is needed to provide the service you use, and only to the providers listed. By using the Platform you consent to these transfers. Please do not type personal details (such as phone numbers, addresses or bank details) into the AI assistant.
We do not sell your personal data to third parties for advertising or marketing purposes.
5. Data Retention
- Account data: Retained while your account is active. Upon account deletion request, personal data is removed within 30 days, subject to the exceptions below.
- Transaction records: Retained for 7 years after the transaction date to comply with Malaysian tax and financial record-keeping requirements under the Income Tax Act 1967.
- Bank/cashout details: Retained for 7 years for financial record-keeping purposes.
- Dispute records: Retained for 3 years after resolution.
- Job agreement (MOA) records, including the IP address they were agreed from, and Brand billing and tax details shown on invoices: retained for 7 years, like transaction records.
- Direct messages: Retained while your account is active and removed with your account, except messages that form part of a dispute record.
- Analytics screenshots: Replaced when you upload a new one; removed with your account.
- Request-limiting counters (IP addresses): expire automatically within one hour.
- AI assistant questions: Not stored by us. DeepSeek handles them under its own retention terms.
6. Your Rights Under the PDPA 2010
Under Malaysia's Personal Data Protection Act 2010, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right of correction: Request correction of inaccurate or incomplete personal data.
- Right to withdraw consent: Withdraw consent to the processing of your personal data. Note that withdrawal may affect your ability to use certain platform features.
- Right to limit processing: Request that we limit how we use your data in certain circumstances.
- Right to erasure: Request deletion of your personal data, subject to legal retention requirements (Section 5).
To exercise any of these rights, contact us at support@myinfluencekl.com. We will respond within 21 days of receiving your request.
7. Cookies
- We use session cookies only — these are required for authentication and keeping you logged in.
- We do not use advertising cookies, third-party tracking pixels, or behavioural analytics cookies.
- Vercel Analytics (used for platform performance monitoring) does not use cookies and collects only anonymised, aggregate data.
8. Security
- All data is transmitted over HTTPS/TLS encryption.
- Database access is protected by Row-Level Security (RLS) — users can only access their own data; admin access is controlled by server-side role verification.
- Passwords are hashed using industry-standard bcrypt and are never stored or transmitted in plain text.
- Bank details provided for cashout requests are accessible only to platform administrators.
- Analytics screenshots are kept in private storage and shown only through short-lived links.
- If a data breach is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner and affected users as required by the PDPA.
- We conduct periodic security reviews and take prompt action to address vulnerabilities.
9. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to all registered users at least 14 days before the new policy takes effect. Continued use of the Platform after the effective date constitutes acceptance.
10. Contact Us
For privacy-related enquiries, data access requests, or to exercise your PDPA rights, contact our data team at: support@myinfluencekl.com
MYINFLUNCE TECHNOLOGY (202603137753 (TR0343103-V)), operator of MY-INFLUENCE, myinfluencekl.com
D4,26-06 1, JLN RAZAK MANSION SUNGAI BESI, 57100 KUALA LUMPUR, WILAYAH PERSEKUTUAN