Privacy Policy

1. Introduction & Scope

A privacy policy is basically a promise: what we collect, why, and what control you have over it. We take this seriously because you're trusting us with real personal information. This policy is governed by Malaysia's Personal Data Protection Act 2010 (as amended in 2024), and throughout it, "Dap IN," "we," "us," and "our" mean DAP IN ENTERPRISE.

2. What Information We Collect

When you create your Dap IN account, we collect:

Account details: Name, email, profile photo, pulled from Google Sign-In
Profile info: Age, area, one-liner, interests, photos, prompts, Instagram handle
Session & activity data: Activity type, skill level, preferences, attendance history
Payment information: Transaction reference, amount, status, via Billplz. We never see your card or bank login
Host payout details: Bank account info, collected to process withdrawals
Referral data: Who referred you, or who you referred
Usage data: Features used, how often you return
Device information: Device type, OS, browser, IP address

Most profile fields can be edited anytime from your settings; a few, like your name and date of birth, are locked in once you sign up. Keeping the rest accurate is on you. For your own safety, leave sensitive details (phone number, email, banking info) out of your bio and one-liner. Need help with your profile? Reach out to team.dapin@gmail.com.

3. How We Use Your Information

Here's what we do with it:

Help hosts curate circles: interests, archetype, activity level, area, and your track record are visible to hosts when building groups
Run sessions: process bookings, manage waitlists, track attendance
Process payments and payouts: Billplz for what you pay, bank transfer for what hosts earn
Administer the referral program: track who referred whom, trigger rewards
Send transactional messages: confirmations, reminders, receipts, host broadcasts
Keep the platform safe: basic fraud and security monitoring
Improve the app: using anonymised, aggregated usage data

4. Who We Share Your Information With

Here's who we share with:

Google: for account sign-in (name, email, profile photo)
Billplz: to process payments (transaction details, your email)
Hosts: session-relevant profile and activity data, for circle curation and session management. Any sponsorship arrangement a host makes directly with a brand is the host's own, outside Dap IN's control.
Other circle members: your public profile (name, photo, interests) when you're in a session together
Legal process: if legally required (court order, subpoena, or other valid legal process), we may have to disclose your data, including to Malaysian authorities
Business transfers: if Dap IN is ever acquired, merged, or sold, your data may transfer as part of that deal, but stays covered by this policy (or its successor)
Brand sponsors: Dap IN only shares anonymised, aggregated data, never your name or contact details

We don't sell your personal data to anyone.

5. Data Storage, Security & Cross-Border Transfers

Security measures: Encryption, access controls, and secure payment processing across the platform
Hosting & infrastructure: We rely on third-party cloud/hosting vendors to run Dap IN's technical infrastructure; provider not yet finalised, so we can't confirm yet whether data sits on Malaysian servers or overseas
Technical logs: We keep basic server and activity logs to help run and secure the platform
Cross-border transfers: If data does move outside Malaysia, it only happens where the destination country has data protection laws as strong as PDPA's, or where you've given clear consent after being told who's receiving it and why
No system is fully secure: We take reasonable steps to protect your data, but can't guarantee complete security

6. Data Retention

Payment & transaction records: At least 7 years, for legal and tax compliance
Account & session data: Kept while your account stays active
Marketing data: Deleted when you unsubscribe or delete your account
Account deletion: Request it anytime, though some records may still be kept where law requires it

7. Cookies

Our website uses cookies, small files stored in your browser, for basic functionality, like keeping you logged in and remembering simple preferences. We don't use cookies for advertising or tracking. Most browsers let you block or delete cookies through their settings, though some features may not work properly without them.

8. Your Rights Under PDPA 2010

You have the right to request a copy of the personal data we hold about you, and to ask us to correct anything that's inaccurate. You can withdraw your consent for non-essential processing, or ask us to limit how your data is used, at any time. Where technically feasible, you may also request that your data be transferred directly to another service provider. You can request deletion of your account and associated data, though we may need to retain certain records where required by law, and you can opt out of marketing communications at any time. To exercise any of these rights, email team.dapin@gmail.com, and we aim to respond within 21 days, as required under PDPA 2010.

9. Privacy Contact & Data Breach Notification

Any privacy question or concern goes straight to our team at team.dapin@gmail.com. If a data breach ever creates a risk to your personal data, we'll notify Malaysia's Personal Data Protection Commissioner within 72 hours of finding out, and let you know directly within 7 days if there's a real risk of harm to you.

10. Age Requirement & Children's Data

Dap IN is for users aged 18 and above. You confirm you're 18+ when you register, and we don't knowingly collect data from anyone younger. If a university club host's membership includes anyone under 18, getting any necessary parental consent is the host's responsibility, not Dap IN's, and we don't take on liability for host-managed participation by minors.

11. Changes to This Policy

We may update this Policy as Dap IN, our partners, or the law evolves. Updates will be posted here with a new "Last Updated" date, and where a change is material, we'll let you know directly, by email or an in-app notice.

12. How to Reach Us

For any question, concern, or request about your personal data, reach us at team.dapin@gmail.com. If you're not satisfied with our response, you can lodge a complaint with Malaysia's Personal Data Protection Commissioner at pdp.gov.my.

Dap IN does not currently meet the size or sensitive-data thresholds under PDPA 2010 (as amended) that require a formally appointed Data Protection Officer. Until then, team.dapin@gmail.com is your single point of contact for any privacy question or concern. We'll appoint and register a formal DPO with the Personal Data Protection Commissioner if our user base or data processing activity crosses the legal thresholds.