1. Who is responsible
Coforyou Sdn Bhd of A-02-02, Kompleks Perindustrian Emhub, Persiaran Surian, Seksyen 3, Taman Sains Selangor, Kota Damansara, 47810 Petaling Jaya, Selangor is responsible for the personal information described here. You can reach our data protection contact at privacy@coforyou.co, or by WhatsApp through the Contact page on this site.
2. What we collect
We collect what the service actually needs, and no more:
- Account details — your name, display name, email address, mobile number, Instagram username, language and country.
- Order details, when you buy on this site — what you ordered, what you paid, the delivery address you confirmed, and the outcome of the payment. WE DO NOT HOLD YOUR CARD DETAILS; those are entered on the payment gateway’s own page and never reach us. What we keep is the amount, the time, a reference and whether it succeeded.
- Claim information — the campaign, the channel you bought through, the purchase date and amount, and the receipt or order confirmation you upload. Receipts often contain more than the purchase itself; we use only what is needed to assess and reconcile the claim.
- 11.11 集章证明：你为完成任务上传的截图、贴上的小红书链接，以及你在「小宝真心话」里的回答。截图可能包含你的账号名称和屏幕上的其他内容，我们只使用核对任务所需的部分。
- 11.11 邀请记录：你使用的邀请码、邀请人、你通过链接还是手动输入邀请码，以及你是否为新顾客。为防止自我邀请和重复账户，我们也会在你注册及打开集章卡时保存加密后的信号：你的邮箱地址、网络地址（IP）以及浏览器类型和语言的加密形式。这些信号只用于互相比对，我们不会同时保存原始的邮箱、IP 或浏览器资料。
- 11.11 直播暗号与 Run Club：你输入过暗号的直播场次和时间；每次输错时，我们会保存输错的时间和你输入的内容，以便工作人员查看暗号哪里出错。这些记录会在 11.11 结束 12 个月后，与你的其他 11.11 记录一并删除。如你选择参加 Run Club，还包括你的邮政编码。
- Account activity — your points balance and history, membership tier, campaign entries, prize wins and reward redemptions.
- Prize collection details — the recipient name, verified mobile number and delivery address you confirm when you win.
- Messages you send us by WhatsApp or email, including any attachment.
- Technical information — device, browser and general location derived from your IP address, and how you use the site.
3. Why we use it
To operate your account, take and fulfil your orders, take payment and issue refunds, assess claims, credit points, run draws, deliver orders and prizes, answer your questions, keep the service secure, detect fraudulent claims, and meet our record-keeping obligations.
用于运作 11.11 集章活动：计算你的 Stamp 和消费金额、确定奖励名额，并核查邀请记录。邀请信号只用于提醒工作人员进一步查看，不会单独对你作出任何决定。
用于确保每人只有一个账号：你注册或更改邮箱、手机号时，我们会与其他账号进行比对。
If you agree to advertising measurement, to see how well our ads on Facebook and Instagram work and to show our ads to people likely to be interested in them, using Meta Pixel (see section 9).
4. Winner announcements are public
This is the one place your information is deliberately shown to people who are not you. When you win, we publish a shortened form of your name and the last four digits of your member number on a public page, with the campaign, prize and draw date.
That page can be reached without signing in and may be indexed by search engines. Your full name, contact details, address and collection arrangements are never published.
You cannot win and stay unpublished. Publication is part of entering a draw, so if you would rather not appear, do not enter that campaign’s draw. Everything else about your account stays private either way.
5. Who we share it with
Payment gateways, when you pay. You are handed to the gateway’s own page to enter your card or banking details, so what reaches them comes from you, not from us. What we send is the order reference, the amount, and the contact details the gateway needs to send you a receipt. We currently use iPay88, with Billplz as an alternative on some orders.
Partner brands, for reconciliation — and only where you claimed a purchase made through that brand’s own channel. What passes between us is the TRANSACTION, not you: the order or receipt number, the purchase date, the amount paid, the channel, the items claimed, and a Coforyou claim reference. Not your name, email address, mobile number, home address or account identity.
Where a partner brand delivers a prize directly, they receive what delivery needs and nothing else: recipient name, mobile number and address.
Delivery partners, for orders and prizes, so they can deliver them — the recipient name, mobile number and address you confirmed.
Service providers who host the site, send our email and store uploaded receipts, under contract and only on our instructions.
自动读取服务按我们的指示运作，用于读取你上传的收据和任务截图，协助工作人员核对。图片仅为此用途发送。工作人员可以复核并更改读取结果，你也可以要求由人工查看任何决定。
Meta（Facebook 和 Instagram），仅在你同意广告效果衡量时。Meta Pixel 会向 Meta 发送你正在浏览的页面地址和你来自的页面、你的浏览器资料和 IP 地址，以及简单的事件：查看活动、加入购物车、注册、开始结账、前往付款、完成购买（包括金额和我们的订单编号）、点击前往品牌官方商店或直播的链接、提交购买凭证、你完成的 11.11 步骤（上传任务截图、输入直播暗号、提交小宝真心话、获得 Stamp、选择奖励、分享邀请链接）、在帮助页面搜索、通过 WhatsApp、电邮或社交平台联系我们，以及同意接收我们的邮件。这些事件只包含我们自己的编号和金额，绝不包含你输入、上传或回答的内容。我们绝不发送你的姓名、电邮地址、手机号码、收货地址或所购产品的名称，也不会在带有私人登录或邀请链接的页面上运行 Pixel。在你的账户里，它只在总览、购买凭证提交页面和订单页面运行。与我们的其他服务商不同，Meta 也可能根据其自身的条款和隐私政策，将这些信息用于自身目的，例如改进其广告。
Authorities, where the law requires it.
We do not sell personal information, and we do not share it with partner brands for their own marketing unless you have separately agreed to that.
6. Where it is processed
Coforyou is a Malaysian company and the service is run from Malaysia, but not every provider we use is. Our email is sent through a provider based outside Malaysia, so your email address and the contents of the messages we send you are processed there. Providers are engaged under contract, may only act on our instructions, and may not use your information for anything of their own.
If you agree to advertising measurement, Meta processes the information described in section 5 in the United States and other countries.
7. How long we keep it
Account information is kept while your account is open. Order records, payment records and claim records are kept for one year, for audit and accounting — a claim can be reconciled, queried or reversed long after it is approved, and these are our accounting records as well as yours.
THE RECEIPT YOU UPLOAD BECOMES DUE FOR DELETION 90 days after it is uploaded. If you upload a replacement receipt, that new receipt has its own 90-day period from the replacement upload. Deletion is carried out through receipt-retention maintenance; failed deletions stay queued for retry. A receipt often shows more than the purchase you claimed, so the claim record carries on without the image after deletion.
你提交的 11.11 集章证明截图，会在工作人员审核通过满 90 天后进入删除程序；未通过或未经审核的截图，会在 11.11 结束满 90 天后进入删除程序。删除未成功的，系统会继续重试。截图删除后，你提交证明的记录、审核结果，以及你贴上的小红书链接和「小宝真心话」回答仍会保留。
你在「小宝真心话」中附上的图片，会在提交满 90 天后进入删除程序。
你在 11.11 活动中提交的小红书链接、「小宝真心话」回答（包括未被接受的回答）、Run Club 邮政编码，以及提交和直播暗号记录，会在 11.11 结束后保留 12 个月。此后，我们只保留你获得的 Stamp，以及你已完成各项任务的记录。邀请信号会在 11.11 结束后保留 90 天，之后删除。
Published winner records come off the public page after 90 days. Your own record of what you won stays in your account.
When you close your account we delete or anonymise what we no longer need, keeping only what we are required to retain.
8. Your rights
You can ask for a copy of the information we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Some of your account information you can see and correct yourself in your profile.
Where a request would remove something we need to keep — a claim record under reconciliation, for example — we will explain what we are keeping and why.
Ask us first, at privacy@coforyou.co — that is the fastest route and we would rather fix it ourselves. If you are not satisfied with how we have handled it, you can complain to the data protection authority in Malaysia.
9. Cookies and measurement
本网站运作所需的 Cookie：一个用于保持你的登录状态；一个用于记住你已经点击过前往品牌官方商店的链接，这样再次访问不会被算作另一个人；还有一个用于记住你从链接带入的 11.11 邀请码的 Cookie，名为 `cfy_ref`，最长保留 30 天，让你注册时自动填写邀请码，该 Cookie 只保存邀请码。另有一个名为 `cfy_consent` 的 Cookie，用于记住你在 Cookie 通知中作出的选择，保留 12 个月，只保存这项选择。另有一个名为 `cfy_pay_lang` 的 Cookie，只在你从英文页面付款时设置。它会记住你正在使用英文，最长保留 1 小时，让你从支付网关返回时回到英文订单页面；你一返回，它就会被删除。语言设置不是 Cookie，而是你正在浏览的网址的一部分。
We count visits two ways. Cloudflare Web Analytics sets no cookies and does not follow you across other sites; it records the page address, the site you arrived from, and general details such as country, browser and device type.
We also use GOOGLE ANALYTICS 4, only if you agree to analytics, and it DOES set cookies — named `_ga` and `_ga_` followed by our property id, first-party, lasting up to two years. They give you a random identifier so that several pages read in one visit are counted as one person rather than several, and so that a return visit next week is recognised as the same browser. They carry no name, email or member number, and we do not connect them to your account. Google processes this data as our service provider and may use your IP address to infer your general location, which it stores as a country or city rather than an address.
WE USE ONE ADVERTISING TOOL, META PIXEL, AND ONLY IF YOU AGREE. On your first visit a notice asks whether you agree to measurement. Until you choose “Accept”, or allow advertising measurement in Preferences, the pixel isn’t loaded and Meta receives nothing from this site. If you agree, it sets first-party cookies named `_fbp` and, if you arrived from one of our ads, `_fbc`, each lasting up to 90 days, and sends Meta the events described in section 5. If you’re signed in to Facebook or Instagram in the same browser, Meta may link these events to your Meta account under its own terms. We use no session-recording tools: nothing records your screen, typing or mouse movements, and we run no TikTok or other advertising tag.
You can change your mind at any time from “Cookie settings” at the foot of every page, and you can also manage ads in your Facebook and Instagram settings. Nothing on this site stops working if you decline: measurement isn’t needed to shop, sign in or file a claim.
10. Security
We protect information in transit and at rest, restrict who can see uploaded receipts, and design screens so that private details stay behind sign-in. No system is perfectly secure, and we will tell you and the relevant authority if a breach affects you.
11. Changes to this policy
We update this policy when what we do changes. The date at the top of the page tells you when it last changed, and we will tell you directly about changes that materially affect you.