Policy

Privacy Policy

Last updated: 10 October 2026

🔐

In short: we never store your credit card number, and we never know your Google password. All we keep is your name, email and the list of itineraries you bought.

1. Who we are

fikahere.my is run by two separate entities with different roles. It's important you know who holds what:

Entity	Role
Babyscarves Trading SSM registration no.: (to be added)	Owner of the fikahere.my brand and seller of the itineraries. Responsible for the product content and the data controller under the PDPA.
Khalbyte Global Ventures SSM registration no.: (to be added)	Operator of this website — technical management, hosting and payment handling. Acts as payment collector on behalf of Babyscarves Trading, and is the data processor under the PDPA.

In this policy, "we" refers to both entities together. Both comply with Malaysia's Personal Data Protection Act 2010 (PDPA).

For anything related to your personal data, message us on TikTok — see the Contact page.

2. Signing in with Google — what actually happens

We use Google Sign-In so you don't have to create a new password. Here is how it works:

When you tap "Continue with Google", you are taken to Google's own page. You type your password there, not on our site.
We never see, receive or store your Google password. It never passes through our servers.
After you give permission, Google sends us a verification token containing three things only: your name, email address and Google user ID. Your profile picture is included if you have one.
We ask for the minimum permissions only (the email and profile scopes). We have no access to your Gmail, Google Drive, Calendar, Contacts or any other Google service.
We verify that token on our server before granting access, so no one else can pretend to be you.

You can withdraw this permission at any time in your Google Account → Third-party apps. After that we can no longer verify you, but your purchase records stay until you ask for them to be deleted.

3. Payments — we never touch your card

Payments are processed through CHIP, a licensed payment gateway in Malaysia. The CHIP merchant account is registered to Khalbyte Global Ventures, which collects payments on behalf of Babyscarves Trading.

💳

On your bank or card statement, this transaction may appear as Khalbyte Global Ventures or CHIP, not "fikahere". This is normal — please don't report it as an unrecognised transaction. If in doubt, contact us first via the Contact page.

When it's time to pay, you are taken to a secure page run by CHIP.

We do not store your credit or debit card number, expiry date, CVV or banking details.
That information never passes through our servers. It goes straight to CHIP.
All we get back is the payment status (successful or failed), the transaction reference and the amount paid.

CHIP has its own privacy policy and complies with card security standards (PCI-DSS).

4. What we actually store

Data	Why we need it
Name	To greet you and for your receipt
Email address	To identify your account and send the emails described in section 6
Google user ID	To tie purchases to the right account
List of itineraries bought	So your access stays open whenever you sign in
Reviews you write	Shown publicly after we approve them — only your rating, review and the display name you choose, never your email. Ask us any time to remove one.
Transaction reference & status	Accounting records and resolving disputes
Sign-in session records — device fingerprint and IP address (both hashed), plus browser type	To keep you signed in, let you sign out of other devices, and detect account sharing

We do not collect card numbers, passwords, IC numbers, passport numbers, raw IP addresses or your precise location.

5. Cookies, the Meta Pixel and the TikTok Pixel

We use a session cookie to keep you signed in. You can delete cookies in your browser settings, but you will need to sign in again afterwards.

We also use the Meta Pixel, a tool from Meta Platforms (Facebook and Instagram), to measure how well our ads work and to show our ads to people who may be interested. When you visit our pages, the pixel sets Meta cookies and tells Meta which pages you viewed and whether you started or completed a purchase (the itinerary and the amount). We do not send your name, email address or payment details to Meta.

Meta may link this activity to your Facebook or Instagram account under its own Privacy Policy. You can control this in your Meta ad preferences, or block it by turning off third-party cookies or using a tracker blocker in your browser.

We also use the TikTok Pixel, a similar tool from TikTok, for the same purpose: measuring our TikTok ads and showing them to people who may be interested. It sets TikTok cookies and tells TikTok which pages you viewed and whether you started or completed a purchase (the itinerary and the amount) — again, never your name, email address or payment details. TikTok handles this under its own Privacy Policy; you can manage ad personalisation in your TikTok app settings, or block it with your browser's cookie or tracker settings. When you pay, our server also confirms the purchase to TikTok directly — the itinerary, the amount, an order ID, a scrambled (hashed) account ID and TikTok's own cookie or ad-click ID — so the sale is counted even if your browser blocks the pixel. This never includes your name, email address, IP address or payment details.

6. Emails we send

We use the email address from your Google account to send you:

Receipts and account messages — needed to provide the service. Payment receipts are sent by CHIP.
Purchase reminders — if you start a checkout but the payment doesn't go through, up to two reminders. The second may include a time-limited discount.
Itinerary updates — when an itinerary you bought is updated (for example, new food options).
News and offers — new itineraries and occasional promotions.

Every reminder, update and news email has an unsubscribe link at the bottom, and each type can be stopped separately. We'll still send important service messages about your account or access — for example, if the way you open your itineraries changes.

We never sell your email address or share it with others for their marketing.

7. Device records and account sharing

Each time you sign in, we record one session row. All it holds is:

Device fingerprint — a one-way calculation from your browser type and language settings. It is not a unique device identifier and cannot be turned back into the original data.
Hashed IP address — we do not store raw IPs. The hash is enough to see patterns, but cannot be read back as an address.
Browser type (user agent) — so you can recognise which device is which in your session list.

It serves two purposes: keeping you signed in, and detecting accounts shared beyond a reasonable limit, as described in section 5 of our Terms of Service.

If the number of different devices on one account goes over the limit, the account is flagged for human review — it is not suspended automatically. You can view and end other devices' sessions yourself from the account menu.

Session records are deleted after 12 months of inactivity.

8. Who else can see your data

We do not sell your data, and we don't share it for marketing. Data is shared only with parties needed to run this service:

Khalbyte Global Ventures — site operator and payment collector, as described in section 1.
Google — to verify your sign-in.
CHIP — to process your payment and email your receipt.
Brevo (our email delivery provider) — to deliver the emails described in section 6. Brevo also records whether an email was opened and which links in it were clicked; links in our emails pass through Brevo before reaching fikahere.my.
TikTok — page visits and purchase events through the TikTok Pixel, for measuring our ads (see section 5).
Meta Platforms — page visits and purchase events through the Meta Pixel, for measuring our ads (see section 5).
Authorities — if required by law.

9. How long we keep it

Purchase records are kept as long as your account is active, because you are entitled to reopen your itineraries for life. Transaction records are kept for 7 years for accounting requirements.

10. Your rights

Under the PDPA, you have the right to:

ask for a copy of the personal data we hold about you;
correct inaccurate data;
ask for your data to be deleted (except transaction records we are required to keep);
withdraw consent for us to process your data.

Message us on TikTok — see the Contact page. We will act within 21 days.

11. Security

This site uses HTTPS throughout. Every itinerary is protected on the server and can only be opened by the account that bought it. However, no online system is 100% secure — if a data breach affects you, we will let you know.

12. Children

This site is not aimed at children under 13 and we do not knowingly collect their data.

13. Changes to this policy

If this policy is updated, the date above will change.