Privacy Policy
About this policy
This Privacy Policy explains how Recurated collects, uses, stores, and shares your personal data when you use our website at recurated.my or our mobile application (together, the “Service”).
By using the Service, you agree to the collection and use of your personal data as described in this policy. If you do not agree, please stop using the Service.
This policy should be read alongside our Terms of Use, which govern your use of the Service.
Who we are
The data controller responsible for your personal data is:
- Business name: Vertex Recurated Ventures
- Registration number: 202603074584 (CA0418513-T)
- Registered address: 98-3-23C Prima Tanjung, 11200 Tanjung Bungah, Pulau Pinang, Malaysia
- Email: support@recurated.my
We are registered with the Companies Commission of Malaysia (SSM) and comply with Malaysia's Personal Data Protection Act 2010 (PDPA).
What data we collect
We collect the following categories of personal data:
Account information
- Name, email address, and password (or social login token)
- Profile photo (if you upload one)
- Username and public profile details
Transaction data
- Items you buy or sell, including prices and descriptions
- Order history, shipping addresses, and delivery status
- Payment method details (processed by Stripe — we do not store full card numbers)
- Bank account details for seller payouts
- Recurated Wallet balance and transaction history
Communications
- Messages sent between buyers and sellers through the platform
- Support requests and correspondence with our team
- Dispute communications
Technical and usage data
- IP address, browser type, and device information
- Pages visited, search terms, and how you interact with the Service
- Cookies and similar tracking technologies (see Section 7)
Verification data (Authentication service only)
- Photos of items submitted for authentication
- Shipping details relating to authentication orders
How we collect your data
We collect your data in the following ways:
- Directly from you — when you register, create listings, make purchases, contact support, or use any feature of the Service.
- Automatically — through cookies, log files, and analytics tools as you use the Service.
- From third parties — if you sign in via Apple, Google, or Facebook, we receive basic profile information from those providers. We also receive transaction data from our payment processor, Stripe.
Why we use your data
We use your personal data for the following purposes:
| Purpose | Legal basis (PDPA) |
|---|---|
| Creating and managing your account | Contract performance |
| Processing purchases and sales | Contract performance |
| Processing payments and payouts via Stripe | Contract performance |
| Facilitating communication between buyers and sellers | Contract performance |
| Resolving disputes and enforcing our Terms of Use | Legitimate interest |
| Providing customer support | Contract performance |
| Sending transaction and account notifications | Contract performance |
| Sending marketing emails (with your consent) | Consent |
| Improving the Service and understanding how it is used | Legitimate interest |
| Preventing fraud and ensuring platform safety | Legitimate interest |
| Complying with legal obligations | Legal obligation |
Who we share your data with
We do not sell your personal data. We share your data only with the following parties, and only to the extent necessary:
Other users
When you buy or sell on Recurated, your username, profile photo, and relevant transaction details (such as shipping address) are shared with the other party to complete the transaction. Your public profile is visible to all users.
Payment processors
Payments are processed by Stripe. When you make or receive a payment, your payment details are handled directly by Stripe under their own privacy policy. We receive only transaction confirmation and limited payment metadata.
Shipping and logistics
Your shipping address is shared with the seller so they can dispatch your order. Sellers are responsible for sharing this with their chosen courier.
Authentication service
If you use Recurated Authentication, your item details and shipping information are handled by our Penang authentication team. This data is not shared externally.
Service providers
We use trusted third-party providers to operate the Service, including cloud hosting, analytics, and email delivery. These providers only process your data on our instructions and are contractually required to protect it.
Legal and regulatory obligations
We may disclose your data to law enforcement, regulators, or courts if required to do so by law, or to protect the rights and safety of our users and the platform.
Cookies
We use cookies and similar technologies to operate and improve the Service. Cookies are small text files stored on your device.
Types of cookies we use
- Essential cookies — required for the Service to function. These cannot be disabled. They include session authentication and security cookies.
- Analytics cookies — help us understand how users interact with the Service so we can improve it. We use anonymised data only.
- Preference cookies — remember your settings, such as your preferred theme (light or dark mode).
You can manage or disable non-essential cookies through your browser settings. Disabling cookies may affect how the Service works.
How long we keep your data
We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:
- Account data — retained for the lifetime of your account, plus 12 months after account deletion to handle any post-closure disputes or legal matters.
- Transaction records — retained for 7 years for financial and legal compliance purposes.
- Support communications — retained for 3 years from the date of the last communication.
- Analytics data — anonymised and aggregated; no personal identifiers retained.
When we no longer need your data, we securely delete or anonymise it.
Your rights
Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data:
- Right of access — you may request a copy of the personal data we hold about you.
- Right to correction — you may request that we correct inaccurate or incomplete data.
- Right to withdraw consent — where we process your data based on consent (e.g. marketing emails), you may withdraw consent at any time.
- Right to limit processing — in certain circumstances, you may request that we limit how we use your data.
To exercise any of these rights, contact us at support@recurated.my. We will respond within 21 days as required under the PDPA. We may need to verify your identity before processing your request.
Children's privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at support@recurated.my and we will delete it promptly.
Users aged 13–18 may use the Service but are encouraged to review this policy with a parent or guardian.
Security
We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, loss, or misuse. These measures include:
- Encrypted data transmission (HTTPS/TLS)
- Secure password hashing
- Access controls limiting who can view personal data internally
- Payment data processed exclusively by PCI-DSS compliant Stripe
No system is completely secure. If you believe your account has been compromised, contact us immediately at support@recurated.my.
Links to other websites
The Service may contain links to third-party websites, including courier services, payment providers, and social platforms. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party sites you visit.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. When we make material changes, we will notify you by email or through a prominent notice on the platform at least 14 days before the changes take effect.
The current version of this policy is always available at recurated.my/privacy. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.
Contact us
If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us:
- Email: support@recurated.my
- Website: recurated.my/contact
- Company: Vertex Recurated Ventures (202603074584 / CA0418513-T), 98-3-23C Prima Tanjung, 11200 Tanjung Bungah, Pulau Pinang, Malaysia