1. Who is responsible
Coforyou Sdn Bhd of A-02-02, Kompleks Perindustrian Emhub, Persiaran Surian, Seksyen 3, Taman Sains Selangor, Kota Damansara, 47810 Petaling Jaya, Selangor is responsible for the personal information described here. You can reach our data protection contact at privacy@coforyou.co, or by WhatsApp through the Contact page on this site.
2. What we collect
We collect what the service actually needs, and no more:
- Account details — your name, display name, email address, mobile number, Instagram username, language and country.
- Order details, when you buy on this site — what you ordered, what you paid, the delivery address you confirmed, and the outcome of the payment. WE DO NOT HOLD YOUR CARD DETAILS; those are entered on the payment gateway’s own page and never reach us. What we keep is the amount, the time, a reference and whether it succeeded.
- Claim information — the campaign, the channel you bought through, the purchase date and amount, and the receipt or order confirmation you upload. Receipts often contain more than the purchase itself; we use only what is needed to assess and reconcile the claim.
- 11.11 stamp proof — the screenshots you send to prove a task, any Xiaohongshu link you paste, and your Honest thoughts answer. A screenshot can show your account name and whatever else was on your screen; we use only what is needed to check the task.
- 11.11 referrals — the invite code you used, who invited you, whether you came by link or typed the code, and whether you were a new customer. To spot self-referrals and duplicate accounts we also keep hashed signals from when you sign up and when you open your stamp card: a scrambled form of your email address, your network address (IP) and your browser type and language. A hash can be compared with another hash, but we don’t keep the original email, IP or browser details alongside it.
- 11.11 live codes and Run Club — which lives you entered a code for and when, and for each wrong try, when you made it and what you typed, so our staff can see where a code went wrong. These records are deleted with your other 11.11 records 12 months after 11.11 ends. If you opt in to Run Club, your postal code.
- Account activity — your points balance and history, membership tier, campaign entries, prize wins and reward redemptions.
- Prize collection details — the recipient name, verified mobile number and delivery address you confirm when you win.
- Messages you send us by WhatsApp or email, including any attachment.
- Technical information — device, browser and general location derived from your IP address, and how you use the site.
3. Why we use it
To operate your account, take and fulfil your orders, take payment and issue refunds, assess claims, credit points, run draws, deliver orders and prizes, answer your questions, keep the service secure, detect fraudulent claims, and meet our record-keeping obligations.
To run the 11.11 stamp collection: to count your stamps and spend, decide reward places, and check referrals. Referral signals are only a prompt for our staff to look more closely. They don’t decide anything about you on their own.
To keep to one account per person: we compare your email address and mobile number with other accounts when you sign up or change them.
If you agree to advertising measurement, to see how well our ads on Facebook and Instagram work and to show our ads to people likely to be interested in them, using Meta Pixel (see section 9).
4. Winner announcements are public
This is the one place your information is deliberately shown to people who are not you. When you win, we publish a shortened form of your name and the last four digits of your member number on a public page, with the campaign, prize and draw date.
That page can be reached without signing in and may be indexed by search engines. Your full name, contact details, address and collection arrangements are never published.
You cannot win and stay unpublished. Publication is part of entering a draw, so if you would rather not appear, do not enter that campaign’s draw. Everything else about your account stays private either way.
5. Who we share it with
Payment gateways, when you pay. You are handed to the gateway’s own page to enter your card or banking details, so what reaches them comes from you, not from us. What we send is the order reference, the amount, and the contact details the gateway needs to send you a receipt. We currently use iPay88, with Billplz as an alternative on some orders.
Partner brands, for reconciliation — and only where you claimed a purchase made through that brand’s own channel. What passes between us is the TRANSACTION, not you: the order or receipt number, the purchase date, the amount paid, the channel, the items claimed, and a Coforyou claim reference. Not your name, email address, mobile number, home address or account identity.
Where a partner brand delivers a prize directly, they receive what delivery needs and nothing else: recipient name, mobile number and address.
Delivery partners, for orders and prizes, so they can deliver them — the recipient name, mobile number and address you confirmed.
Service providers who host the site, send our email and store uploaded receipts, under contract and only on our instructions.
An automated reader, working on our instructions, reads the receipts and proof screenshots you upload, to help our staff check them. Images go to it only for that. A person can review and overturn what it finds, and you can ask for a person to look at any decision.
Meta (Facebook and Instagram), only if you agree to advertising measurement. Meta Pixel sends Meta the address of the page you are on and the page you came from, your browser’s details and IP address, and simple events: viewing a campaign, adding to cart, signing up, starting checkout, going on to payment, completing a purchase (with its amount and our order reference), following a link to a brand’s own store or to a livestream, submitting a purchase claim, the 11.11 steps you complete (uploading a proof, entering a live code, sending Honest thoughts, earning a stamp, choosing a reward, sharing your invite link), searching the help page, contacting us by WhatsApp, email or social media, and agreeing to receive our emails. Events carry only our own reference numbers and amounts, never what you type, upload or answer. We never send your name, email address, mobile number, delivery address or the names of the products you buy, and we don’t run the pixel on pages that carry private sign-in or invite links. In your account it runs only on the overview, the claim form and your orders. Unlike our other providers, Meta may also use this information for its own purposes, such as improving its ads, under Meta’s own terms and privacy policy.
Authorities, where the law requires it.
We do not sell personal information, and we do not share it with partner brands for their own marketing unless you have separately agreed to that.
6. Where it is processed
Coforyou is a Malaysian company and the service is run from Malaysia, but not every provider we use is. Our email is sent through a provider based outside Malaysia, so your email address and the contents of the messages we send you are processed there. Providers are engaged under contract, may only act on our instructions, and may not use your information for anything of their own.
If you agree to advertising measurement, Meta processes the information described in section 5 in the United States and other countries.
7. How long we keep it
Account information is kept while your account is open. Order records, payment records and claim records are kept for one year, for audit and accounting — a claim can be reconciled, queried or reversed long after it is approved, and these are our accounting records as well as yours.
THE RECEIPT YOU UPLOAD BECOMES DUE FOR DELETION 90 days after it is uploaded. If you upload a replacement receipt, that new receipt has its own 90-day period from the replacement upload. Deletion is carried out through receipt-retention maintenance; failed deletions stay queued for retry. A receipt often shows more than the purchase you claimed, so the claim record carries on without the image after deletion.
SCREENSHOTS YOU SEND AS 11.11 STAMP PROOF BECOME DUE FOR DELETION 90 days after our staff approve them. Screenshots that are rejected or never reviewed become due for deletion 90 days after 11.11 ends. Failed deletions stay queued for retry. The record that you sent proof and the decision on it carry on without the images, as do any Xiaohongshu link and Honest thoughts answer you gave.
Pictures you add to an Honest thoughts answer become due for deletion 90 days after you submit.
Your 11.11 Xiaohongshu link, Honest thoughts answers, including ones our form did not accept, Run Club postal code and the record of your proof and live codes are kept for 12 months after 11.11 ends. After that we keep only the stamps you earned and that you completed each task. Referral signals are kept for 90 days after 11.11 ends, then deleted.
Published winner records come off the public page after 90 days. Your own record of what you won stays in your account.
When you close your account we delete or anonymise what we no longer need, keeping only what we are required to retain.
8. Your rights
You can ask for a copy of the information we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Some of your account information you can see and correct yourself in your profile.
Where a request would remove something we need to keep — a claim record under reconciliation, for example — we will explain what we are keeping and why.
Ask us first, at privacy@coforyou.co — that is the fastest route and we would rather fix it ourselves. If you are not satisfied with how we have handled it, you can complain to the data protection authority in Malaysia.
9. Cookies and measurement
Cookies this site needs to work: one to keep you signed in, one that remembers you have already followed a link out to a brand’s own store, so that a second visit is not counted as a second person, and one that remembers the 11.11 invite code from a link you followed, named `cfy_ref`, for up to 30 days, so the code is filled in when you register. It holds only the code. Another, named `cfy_consent`, remembers the choice you made in the cookie notice, for 12 months. It holds only that choice. One more, named `cfy_pay_lang`, is set only when you pay from the English pages. It remembers that you were reading in English, for at most an hour, so you come back from the payment gateway to the English order page, and it is removed as soon as you are back. Your language is not a cookie — it is part of the address you are reading.
We count visits two ways. Cloudflare Web Analytics sets no cookies and does not follow you across other sites; it records the page address, the site you arrived from, and general details such as country, browser and device type.
We also use GOOGLE ANALYTICS 4, only if you agree to analytics, and it DOES set cookies — named `_ga` and `_ga_` followed by our property id, first-party, lasting up to two years. They give you a random identifier so that several pages read in one visit are counted as one person rather than several, and so that a return visit next week is recognised as the same browser. They carry no name, email or member number, and we do not connect them to your account. Google processes this data as our service provider and may use your IP address to infer your general location, which it stores as a country or city rather than an address.
WE USE ONE ADVERTISING TOOL, META PIXEL, AND ONLY IF YOU AGREE. On your first visit a notice asks whether you agree to measurement. Until you choose “Accept”, or allow advertising measurement in Preferences, the pixel isn’t loaded and Meta receives nothing from this site. If you agree, it sets first-party cookies named `_fbp` and, if you arrived from one of our ads, `_fbc`, each lasting up to 90 days, and sends Meta the events described in section 5. If you’re signed in to Facebook or Instagram in the same browser, Meta may link these events to your Meta account under its own terms. We use no session-recording tools: nothing records your screen, typing or mouse movements, and we run no TikTok or other advertising tag.
You can change your mind at any time from “Cookie settings” at the foot of every page, and you can also manage ads in your Facebook and Instagram settings. Nothing on this site stops working if you decline: measurement isn’t needed to shop, sign in or file a claim.
10. Security
We protect information in transit and at rest, restrict who can see uploaded receipts, and design screens so that private details stay behind sign-in. No system is perfectly secure, and we will tell you and the relevant authority if a breach affects you.
11. Changes to this policy
We update this policy when what we do changes. The date at the top of the page tells you when it last changed, and we will tell you directly about changes that materially affect you.