Privacy Policy

1. Who is responsible

Coforyou Sdn Bhd of A-02-02, Kompleks Perindustrian Emhub, Persiaran Surian, Seksyen 3, Taman Sains Selangor, Kota Damansara, 47810 Petaling Jaya, Selangor is responsible for the personal information described here. You can reach our data protection contact at privacy@coforyou.co, or through the contact form on this site.

2. What we collect

We collect what the service actually needs, and no more:

• Account details — your name, display name, email address, mobile number, Instagram username, language and country.
• Order details, when you buy on this site — what you ordered, what you paid, the delivery address you confirmed, and the outcome of the payment. WE DO NOT HOLD YOUR CARD DETAILS; those are entered on the payment gateway’s own page and never reach us. What we keep is the amount, the time, a reference and whether it succeeded.
• Claim information — the campaign, the channel you bought through, the purchase date and amount, and the receipt or order confirmation you upload. Receipts often contain more than the purchase itself; we use only what is needed to assess and reconcile the claim.
• Account activity — your points balance and history, membership tier, campaign entries, prize wins and reward redemptions.
• Prize collection details — the recipient name, verified mobile number and delivery address you confirm when you win.
• Messages you send us through the contact form, including any attachment.
• Technical information — device, browser and general location derived from your IP address, and how you use the site.

3. Why we use it

To operate your account, take and fulfil your orders, take payment and issue refunds, assess claims, credit points, run draws, deliver orders and prizes, answer your questions, keep the service secure, detect fraudulent claims, and meet our record-keeping obligations.

4. Winner announcements are public

This is the one place your information is deliberately shown to people who are not you. When you win, we publish a shortened form of your name and the last four digits of your member number on a public page, with the campaign, prize and draw date.

That page can be reached without signing in and may be indexed by search engines. Your full name, contact details, address and collection arrangements are never published.

You cannot win and stay unpublished. Publication is part of entering a draw, so if you would rather not appear, do not enter that campaign’s draw. Everything else about your account stays private either way.

5. Who we share it with

Payment gateways, when you pay. You are handed to the gateway’s own page to enter your card or banking details, so what reaches them comes from you, not from us. What we send is the order reference, the amount, and the contact details the gateway needs to send you a receipt. We currently use iPay88, with Billplz as an alternative on some orders.

Partner brands, for reconciliation — and only where you claimed a purchase made through that brand’s own channel. What passes between us is the TRANSACTION, not you: the order or receipt number, the purchase date, the amount paid, the channel, the items claimed, and a Coforyou claim reference. Not your name, email address, mobile number, home address or account identity.

Where a partner brand delivers a prize directly, they receive what delivery needs and nothing else: recipient name, mobile number and address.

Delivery partners, for orders and prizes, so they can deliver them — the recipient name, mobile number and address you confirmed.

Service providers who host the site, send our email and store uploaded receipts, under contract and only on our instructions.

Authorities, where the law requires it.

We do not sell personal information, and we do not share it with partner brands for their own marketing unless you have separately agreed to that.

6. Where it is processed

Coforyou is a Malaysian company and the service is run from Malaysia, but not every provider we use is. Our email is sent through a provider based outside Malaysia, so your email address and the contents of the messages we send you are processed there. Providers are engaged under contract, may only act on our instructions, and may not use your information for anything of their own.

7. How long we keep it

Account information is kept while your account is open. Order records, payment records and claim records are kept for one year, for audit and accounting — a claim can be reconciled, queried or reversed long after it is approved, and these are our accounting records as well as yours.

THE RECEIPT YOU UPLOAD IS DELETED SOONER, after 90 days. A receipt often shows more than the purchase you claimed, so we keep the image only as long as we might need to look at it again, and the claim record itself carries on without it.

Published winner records come off the public page after 90 days. Your own record of what you won stays in your account.

When you close your account we delete or anonymise what we no longer need, keeping only what we are required to retain.

8. Your rights

You can ask for a copy of the information we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Some of your account information you can see and correct yourself in your profile.

Where a request would remove something we need to keep — a claim record under reconciliation, for example — we will explain what we are keeping and why.

Ask us first, at privacy@coforyou.co — that is the fastest route and we would rather fix it ourselves. If you are not satisfied with how we have handled it, you can complain to the data protection authority in Malaysia.

9. Cookies and measurement

Cookies this site needs to work: one to keep you signed in, and one that remembers you have already followed a link out to a brand’s own store, so that a second visit is not counted as a second person. Your language is not a cookie — it is part of the address you are reading.

We count visits two ways. Cloudflare Web Analytics sets no cookies and does not follow you across other sites; it records the page address, the site you arrived from, and general details such as country, browser and device type.

We also use GOOGLE ANALYTICS 4, which DOES set cookies — named `_ga` and `_ga_` followed by our property id, first-party, lasting up to two years. They give you a random identifier so that several pages read in one visit are counted as one person rather than several, and so that a return visit next week is recognised as the same browser. They carry no name, email or member number, and we do not connect them to your account. Google processes this data as our service provider and may use your IP address to infer your general location, which it stores as a country or city rather than an address.

WE USE NO ADVERTISING PIXELS AND NO SESSION-RECORDING TOOLS. Nothing on this site records your screen, your typing or your mouse movements, and we run no Meta, TikTok or advertising tag of any kind.

You can refuse all of this. Every browser can block or delete cookies for a single site, and browser add-ons that block Google Analytics outright are widely available and work on this site; so does Google’s own opt-out add-on. Nothing on this site stops working if you do — measurement is not needed to shop, sign in or file a claim.

10. Security

We protect information in transit and at rest, restrict who can see uploaded receipts, and design screens so that private details stay behind sign-in. No system is perfectly secure, and we will tell you and the relevant authority if a breach affects you.

11. Changes to this policy

We update this policy when what we do changes. The date at the top of the page tells you when it last changed, and we will tell you directly about changes that materially affect you.