Privacy Policy

SiniSlot is owned and developed by SINI SLOT SOLUTION 202603072528 (NS0320440-X), a registered business in Malaysia.

SINI SLOT SOLUTION is the platform operator referred to as SiniSlot, "we", "us", or "our" in this Policy. For questions about this Policy or the platform operator's handling of personal data, contact support@sinislot.shop. The respective data-handling roles of the platform and participating SMEs are described below.

SiniSlot is a booking and business-management platform for Malaysian SMEs. This Policy applies to sinislot.shop, SiniSlot dashboards, public booking pages, WhatsApp booking flows, payment-related receipts, customer support, and the SiniSlot chatbot.

For business account, platform billing, support, security, and product-analytics data, SiniSlot determines why and how the data is processed. For customer information submitted to an SME for a booking, the SME also determines how that information is used to provide its services. Customers should read the SME’s own privacy notice and contact that SME first about its use of booking information.

• Account and business data: name, email address, authentication identifiers, business name, business profile, public username, services, operating hours, staff permissions, subscription tier, and settings.
• Booking and customer data: customer name, phone or WhatsApp identifiers, appointment date and time, selected services, booking reference, custom-form answers, notes, status, source, and communication language.
• Booking payment data: amount, currency, payment status, payment method category, refund status, receipt number, payment provider transaction references, and timestamps. SiniSlot does not store complete card numbers, card security codes, online-banking passwords, or one-time payment codes.
• Payout data: the payout bank, account number, account holder name, the account holder name the bank returns when we check the account, and payout and refund transfer records. For businesses that previously used Stripe, the connected-account identifier and status.
• Fee and payout records: SiniSlot and Billplz fees, courier charges, payouts, and refunds in the payout balance, and past Pitis and subscription records kept for accounting.
• E-Invoice data: taxpayer identification and registration details, business classification, customer or supplier details, invoice line items, tax values, MyInvois credentials or identifiers, submission status, validation results, and document references where the feature is used.
• Communications: contact-form submissions, support messages, feedback, chatbot prompts and recent conversation context, and records of booking or notification delivery.
• Device and usage data: IP-derived security or rate-limit information, the country an IP address belongs to (unless analytics is turned off; the address itself is not stored for this), browser and device data, page and feature usage, referral source, UTM source, push-subscription details, cookies or similar identifiers, and diagnostic logs.

We collect data directly from users, from SMEs acting for their customers, through public and WhatsApp booking flows, from browsers and devices, and from service providers such as Billplz, Stripe, Fiuu, Meta WhatsApp, Supabase, Google, and LHDN MyInvois. Please provide only data that is accurate, relevant, and lawful to share.

• Create and secure accounts, authenticate users, apply staff permissions, and provide subscribed features.
• Check availability, prevent duplicate bookings, create and manage appointments, and maintain booking records.
• Create payment checkouts, verify signed payment events, confirm paid bookings, reconcile payment, payout, and refund status, check payout bank accounts, pay businesses out, and provide private receipts.
• Calculate and record SiniSlot and Billplz fees, courier charges, payouts, and platform billing records.
• Send WhatsApp messages, dashboard notifications, Web Push notifications, appointment confirmations, reminders, receipts, and operational alerts.
• Support E-Invoice preparation and transmission when configured by an eligible SME.
• Answer product questions through the chatbot and respond to support or privacy requests.
• Measure product and marketing performance, diagnose faults, prevent abuse and fraud, enforce our terms, and protect users, SiniSlot, our payment providers, and participating SMEs.
• Meet accounting, tax, regulatory, dispute-resolution, law-enforcement, and other legal obligations.

Customer booking payments are collected by SiniSlot through Billplz, which processes FPX online banking payments under its own terms and privacy policy (published at https://main.billplz.com/terms) and may conduct fraud and compliance checks. SiniSlot receives the transaction status and limited identifiers needed to operate the booking, and pays the SME out to its checked bank account. Past payments made through an SME’s connected Stripe account remain processed by Stripe.

A private SiniSlot receipt link can be sent after payment. The link is designed not to expose full payment credentials or public payment provider identifiers, but anyone who obtains the link may be able to view the receipt. Recipients should not publish or forward it unnecessarily.

Amounts awaiting payout to an SME are the SME’s money, less the fees described in the Terms. The SME manages its payout bank account in SiniSlot Payments.

Before SiniSlot pays out money collected for a business, it verifies the identity of the business owner. Staff and customers are never asked for identity documents. The owner types their name and MyKad or MyPR number, photographs the front and back of the card, and takes a short selfie while turning their head as prompted. SiniSlot also records technical details of the check (time, device type, and results).

Face images are biometric data, which is sensitive personal data. SiniSlot collects them only with the owner’s explicit consent, uses them only to confirm that the owner is the cardholder, does not create a stored faceprint, and never uses them for marketing or to train software. Software may compare the face with the card photo and check the card details, but only a trained SiniSlot staff member can decide that a verification has failed. An owner who prefers not to have their face checked by software can verify with our team by video call instead; no photos are stored for that route.

SiniSlot uses the verified identity to decide whether payouts can be made, to check that the payout bank account belongs to the owner or their registered business, to prevent fraud, and to keep records that may be needed for our payment provider, banks, authorities, or a court. The identity card number is encrypted, and images are encrypted before storage and shown only to authorised staff, with every view recorded.

Identity data is stored by Supabase in Singapore and processed on Google Cloud in the United States, under data protection terms. Extra photos are deleted within 30 days. The card photos and one face photo are kept while the account is active and for 12 months after it closes or after the verification is replaced. The name, card number, and result are kept for 6 years after the account closes, for legal claims. Verification is voluntary, but payouts cannot be made until it is complete. An owner may ask for access to or correction of their identity data, or withdraw consent, which stops payouts, by contacting support@sinislot.shop.

When a user interacts through WhatsApp, Meta and the relevant SME process identifiers, message metadata, form responses, and delivery information. WhatsApp availability and processing are also governed by Meta’s terms and privacy practices.

When the SiniSlot chatbot is used, the submitted prompt and conversation context are sent to Google Gemini to generate a response. Do not enter payment credentials, passwords, identity-document numbers, health details, legal secrets, or other sensitive information in chat. Chatbot responses are automated and may be inaccurate.

Web Push notifications are optional. A browser push subscription contains a delivery endpoint and cryptographic keys. Users can disable notifications in their browser or device settings.

SiniSlot uses necessary browser storage for security, language, session, and product functions. Necessary storage is always active because login, bookings, and payments cannot work without it.

On its public pages SiniSlot uses analytics and advertising cookies to measure visits, sign-ups, and its ads, and a line at the bottom of every public page says so. Analytics and advertising are separate settings, and either or both can be turned off at any time; once a setting is off, its tags are no longer loaded. Browsing, booking, and payment work the same either way.

Marketing and analytics tags are never loaded on the dashboard, the admin area, payment pages, private receipt links, or an SME booking or catalog page. A booking customer visiting an SME page is not added to SiniSlot advertising measurement.

A visitor can turn analytics or advertising off, or back on, at any time using "Cookie settings" at the bottom of every public page. The stored choice records which categories are on and when the choice was made. Unless advertising is turned off, Google, Meta, and other providers may use cookies or similar technologies and receive device, page, referral, and interaction information under their own policies. Browser privacy controls and advertising settings can further limit measurement.

• The SME and its authorized staff, where needed to manage a customer’s booking, service, payment, refund, or E-Invoice.
• Billplz for customer booking payments, payout bank account checks, payouts, and refunds. Stripe for payments, refunds, and disputes made through previously connected Stripe accounts, and for records of past Pitis top-ups by card. Fiuu (Razer Merchant Services) for records of past Pitis top-ups by FPX online banking, DuitNow QR, and Touch ’n Go eWallet.
• Supabase for database hosting, authentication, and application services; Google Cloud for application hosting and logs; Google Gemini for chatbot responses; Meta WhatsApp for booking flows and messages; Google for tag measurement; and infrastructure providers for Web Push delivery.
• LHDN MyInvois or related tax systems when an SME configures and submits an E-Invoice.
• Professional advisers, insurers, auditors, authorities, courts, law enforcement, or transaction counterparties where reasonably necessary for legal compliance, safety, claims, financing, reorganization, merger, or sale.

SiniSlot does not sell personal data for money. We do not disclose customer lists to unrelated third parties for their independent direct marketing.

Some providers and their infrastructure may process data outside Malaysia. Where personal data is transferred internationally, we take reasonable steps to use reputable providers, contractual protections, access controls, and other safeguards appropriate to the data and service. Provider locations and subprocessors may change over time.

We retain personal data only for as long as reasonably needed for the purposes described in this Policy, the SME’s instructions, account operation, security, dispute handling, and legal, accounting, tax, or regulatory requirements. Different records therefore have different retention periods.

Active account, booking, payment, wallet, subscription, and E-Invoice records may be retained while the account or business relationship continues and afterwards where records are required. Terminal unconfirmed payment-hold personal data is designed to be redacted after 30 days through maintenance. Payment observability records are maintained for 90 days by default. Security, hosting, provider, backup, and transaction records follow their applicable operational and legal schedules.

When data is no longer required, we delete or anonymize it where reasonably practicable. Deletion from backups and third-party systems may occur on their normal cycles, and some records may be preserved where deletion would conflict with legal duties, fraud prevention, payment disputes, or another person’s rights.

We use reasonable administrative and technical safeguards, including access controls, encrypted connections, secrets management, signed webhook verification, rate limits, redaction, restricted financial views, and monitoring. No service is completely secure. Users must protect account credentials, devices, receipt links, and one-time codes and notify us promptly of suspected unauthorized access.

Subject to Malaysian law and any applicable exceptions, individuals may request access to or correction of personal data, withdraw consent where processing relies on consent, ask questions about processing, or request deletion where retention is no longer required. SMEs can update much of their account data in the dashboard. Booking customers should contact the relevant SME first because the SME controls the service relationship and may hold additional records outside SiniSlot.

• Send privacy requests to support@sinislot.shop with enough information to verify identity and locate the relevant account or booking.
• Do not send full card details, banking passwords, or one-time codes with a request.
• We may request verification, clarify the scope, charge a permitted fee, refuse a legally exempt request, or retain records where required by law or a live dispute.
• Marketing and optional push notifications can be disabled using the unsubscribe method provided or browser/device controls.

SiniSlot business accounts are not intended for persons under 18. An SME that accepts bookings involving children is responsible for obtaining appropriate parent or guardian authority and collecting only necessary information.

We may update this Policy as our services, providers, or laws change. The effective date above identifies the latest version. Material changes may also be communicated through the platform where appropriate.

For privacy questions or requests, use the Contact page or email support@sinislot.shop. For data held by a business in connection with its services, contact that business first.