Privacy Policy

This Privacy Policy explains how KadoVault (“KadoVault”, “we”, “us”, “our”) collects, uses, discloses and protects personal data when you use our website at kadovault.com and our application (together, the “Service”).

We are committed to handling personal data in accordance with the Personal Data Protection Act 2010 of Malaysia and its amendments (the “PDPA”). By using the Service, you acknowledge that you have read and understood this Policy.

1Personal data we collect

We collect the following categories of personal data:

Account data

• Your name and email address, provided when you register or sign in with Google (via our authentication provider). If you use Google Sign-In, we receive your name, email address and Google account identifier — we do not receive your Google password.
• A display name and an internal account identifier (your “KV ID”).

Content and usage data

• Data you create in the Service: claim sales, cards, prices, buy/want lists, store pickups, settings, and your bank details for payout messages (which you choose to enter).

Third-party (buyer/contact) data you input

• Information you enter about your buyers or contacts — for example their name, Facebook profile link, phone number and delivery address. See section 3.

Subscription and payment data

• If you subscribe to a paid plan, we collect the payment receipt/slip you upload and the reference details of your transfer. Payments are made manually via DuitNow or bank transfer — we do not collect or store your card, bank login, or full account credentials.

Technical data

• IP address, device and browser information, and usage logs collected automatically by our hosting and infrastructure providers for security and to operate the Service.

2How we use your data

We process personal data to:

• Create and manage your account and authenticate your sign-in;
• Provide, operate and maintain the Service and its features;
• Process and verify subscription payments and manage your plan;
• Respond to your enquiries and provide support;
• Send you service-related communications (e.g. access approvals, receipts, important notices);
• Maintain the security, integrity and availability of the Service, and detect and prevent misuse;
• Comply with our legal obligations.

We rely on your consent (given when you use the Service) and on the necessity of processing to provide the Service you have requested, as permitted under the PDPA. You may withdraw consent as described in section 8, though this may prevent us from providing the Service.

3Data you input about others

KadoVault lets you record information about your buyers and contacts. Where you enter another person’s personal data, you are the data user (controller) of that data, and KadoVault acts as a data processor storing and processing it on your behalf and on your instructions.

You are responsible for ensuring you have a lawful basis (including any necessary consent) to collect and enter that data, and for complying with the PDPA in respect of it — including providing notice to those individuals and honouring their rights. You agree to indemnify us as set out in our Terms of Service in relation to data you input.

4Disclosure to third parties

We do not sell your personal data. We share data only with service providers who process it on our behalf to run the Service, under appropriate confidentiality and data-protection obligations:

• Supabase — authentication and database hosting;
• Cloudflare — website hosting, application compute and file/object storage (including uploaded payment slips);
• Google — where you choose Google Sign-In;
• An email delivery provider — to send transactional emails such as access approvals and receipts, where applicable.

We also retrieve trading-card reference data from third-party sources (e.g. Scryfall, MTGJSON, Card Kingdom); no personal data is shared with these sources. We may also disclose data where required by law or to protect our rights, users or the public.

5Cross-border transfers

Our primary database is hosted in Singapore, and some of our processors (such as Cloudflare and Google) operate globally. This means your personal data may be transferred to, stored, or processed outside Malaysia. Where we transfer data outside Malaysia, we take reasonable steps to ensure it receives a standard of protection comparable to that required under the PDPA.

6Retention

We retain personal data for as long as your account is active and as needed to provide the Service. When you delete your account or ask us to delete your data, we will delete or anonymise it within a reasonable period, except where we are required to retain certain records (for example, payment and tax records, typically for up to 7 years), or where retention is necessary to resolve disputes or enforce our agreements.

7Security

We take reasonable technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, and the use of reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8Your rights

Subject to the PDPA, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Withdraw consent to our processing;
• Limit the processing of your data;
• Request deletion of your data; and
• Request portability of your data where applicable.

To exercise any of these rights, contact us at support@kadovault.com. We may need to verify your identity before responding, and may charge a prescribed fee for data-access requests where permitted.

9Cookies & local storage

We use cookies and browser local storage to keep you signed in, remember your preferences, and operate the Service. Disabling these may prevent parts of the Service from working. We do not use them for third-party advertising.

10Data breaches

If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as and where required under the PDPA and its regulations.

11Children

The Service is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, please contact us and we will delete it.

12Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new “Last updated” date, and, where changes are material, take reasonable steps to notify you.

13Contact us

For any questions or requests about this Policy or your personal data, contact:

KadoVault
Email: support@kadovault.com