Privacy Policy

1. Introduction

This Privacy Policy explains how Codehelo Technologies Sdn Bhd (Business Registration No. 202601010891 (1672989-H)) ("we", "us", or "our") collects, uses, discloses, and protects personal data through the MISO platform (the "Service"), in line with the Personal Data Protection Act 2010 (Malaysia) ("PDPA").

2. Information We Collect

We may collect: account information (name, email address, phone number, business details, and profile photo); order and reservation information (items ordered, order history, reservations, table or delivery details, and delivery addresses); payment information (processed by our payment providers — we do not store complete card numbers); location data, including precise device location to show nearby merchants and enable delivery and pickup, and — for delivery riders — live location during an active delivery, including in the background; camera and photo access, used with your permission to scan order and table QR codes and product barcodes and to upload profile, business, and delivery-proof images; a push-notification token to send order and delivery updates; rider verification data (identity documents and payout details) if you register as a delivery rider; and device and usage data (such as IP address, browser type, and interactions with the Service).

3. How We Use Your Information

We use personal data to: provide and operate the Service; process and fulfil orders and payments; provide customer support; communicate with you about your account and orders; improve and secure the Service; and comply with legal obligations.

4. Legal Basis & Consent

We process personal data on the basis of your consent, the performance of a contract with you, our legitimate business interests, and compliance with applicable law, as permitted under the PDPA.

5. Sharing & Disclosure

We may share personal data with: the restaurant or shop fulfilling your order; payment processors (Airwallex and Fiuu) to process transactions; delivery riders to fulfil deliveries; service providers that host and support the Service — including Supabase (authentication), Amazon Web Services (hosting and storage), Mapbox (maps), Twilio (SMS, WhatsApp, and email), Cloudflare (security), and Expo, Apple, and Google (push notifications); and authorities where required by law. We do not sell your personal data.

6. Cookies, Advertising & Similar Technologies

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Service is used so we can improve it. You can control cookies through your browser settings.

The Service displays advertising provided by Google AdMob. To show ads, AdMob may collect your device’s advertising identifier and app-usage information. With your consent — on iOS via the App Tracking Transparency prompt, and on Android via your device advertising settings — this information may be used to deliver personalised ads and measure their performance, including tracking across other apps and websites. You can decline or withdraw consent at any time (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Privacy → Ads, where you can reset your advertising ID). If you decline, ads are still shown but are not personalised. AdMob’s use of data is governed by Google’s Privacy Policy and Google’s advertising practices.

7. Data Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, or misuse. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

8. Data Retention

We retain personal data for as long as necessary to provide the Service, fulfil the purposes described in this Policy, and comply with our legal obligations, after which it is deleted or anonymised.

9. Your Rights

Subject to the PDPA, you may request access to or correction of your personal data, withdraw consent, or limit the processing of your data. To exercise these rights, contact us using the details below.

10. International Transfers

Some of our service providers may process data outside Malaysia. Where this occurs, we take steps to ensure appropriate safeguards are in place to protect your personal data.

11. Children

The Service is not directed to children under 18, and we do not knowingly collect personal data from them.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date.

13. Contact Us

For any privacy questions or requests, contact: