1. Controller and contact
MEGA HAUL SDN. BHD. · SSM 202601041107 (1703202-D)
UNIT 20-03 Q SENTRAL, JALAN STESEN SENTRAL 2, 50470 KUALA LUMPUR, WILAYAH PERSEKUTUAN KUALA LUMPUR, MALAYSIA.
megahaul@proton.me · 03-9544 6268 (+603-9544 6268)
MEGA HAUL SDN. BHD. is responsible for personal data processed through MyPet World. Contact us about access, correction, choices, withdrawal of consent, account closure or concerns. We may verify account ownership without requesting a password by email or telephone.
2. Data collected and purposes
We store your account email, salted password hash, verification/reset token hashes, session identifiers, nickname/avatar, saved pet care, XP, inventory and game activity. These enable registration, account security, saved gameplay and recovery. Email is required for a verified account; without it account features cannot operate.
Purchase records include user/order IDs, products, quantities, MYR totals, provider references, payment verification, delivery attempts and the immutable Gem/item ledger. Checkout acceptance stores policy versions, consent type, user/order IDs and server timestamps, without collecting an IP address or user-agent for that evidence.
Support cases store the category, original purchase link, messages, acknowledgements, investigation and escalation history. Administrator actions record operator ID, reason and correction evidence. An adult-payer approval stores an external verification case reference and timestamp, not an identity-document copy or a claim of automated identity verification. Your personal spending limit is stored server-side.
Rate limits use hashed keys, including a trusted proxy IP only when configured; the current default uses a shared request bucket. Hosting providers may process connection and error logs. Do not put passwords, card details, OTPs or unnecessary identity information into support messages.
4. Hosting and international processing
The repository Blueprint configures this application and PostgreSQL in Render’s Singapore region, outside Malaysia. Provider operations, mail processing, source hosting and their subprocessors may involve other countries. We do not claim that every service log or processor stays solely in Singapore or Malaysia. The owner must confirm provider-specific destinations, safeguards and any required notices/conditions before real-money processing begins.
5. Retention and account closure
Active account/game data is retained to operate your account. Financial, acceptance, entitlement, security and support evidence may need to be retained for applicable accounting, fraud prevention, payment disputes or legal claims; it must not be kept longer than necessary for those purposes.
You can submit an authenticated deletion request in Support, with password confirmation. An administrator reviews unresolved purchases and claims before anonymising primary login identifiers and revoking access. Minimum linked purchase/case evidence is retained under restricted access; closure is not a promise to erase financial evidence immediately. No automatic historical-record purge schedule is currently enabled. Exact retention periods, backup disposal and review schedules remain owner-confirmation items before paid launch.
Sessions are valid for up to seven days; verification links for 24 hours and reset links for 30 minutes. Token expiry does not itself mean all associated database rows or provider logs have been deleted. The current Render Free database has no managed recovery/automatic backup coverage and is used for testing; durable backup and restore arrangements remain a paid-launch requirement.
6. Rights and choices
Contact us for access, correction, account closure, withdrawal of consent where applicable, limits on relevant processing, or objections/other rights available under Malaysian law. We will explain identity verification, any lawful exceptions and the effect on features that need the data. Withdrawing consent does not retrospectively invalidate lawful prior processing. You may raise unresolved concerns with Malaysia’s Personal Data Protection Commissioner.
Purchase-term acceptance and Privacy Notice acknowledgement are separate from marketing consent. The application currently has no marketing-consent enrolment or optional tracking pixels.
7. Security, children and updates
Controls include password hashing, hashed database sessions, HTTPS/Secure cookies in production, origin checks, rate limits, ownership/role checks, escaped UI text and server-only secrets. These controls are not a security certification or an absolute security guarantee. Contact us promptly about suspected misuse.
Parents/guardians should supervise children’s use and contact us about inappropriate collection. No automated age/guardian verification provider is connected. Real purchases remain blocked pending approved arrangements. Material changes receive a new policy version and further notice/consent where required.
1. Pengawal dan hubungan
MEGA HAUL SDN. BHD. · SSM 202601041107 (1703202-D)
UNIT 20-03 Q SENTRAL, JALAN STESEN SENTRAL 2, 50470 KUALA LUMPUR, WILAYAH PERSEKUTUAN KUALA LUMPUR, MALAYSIA.
megahaul@proton.me · 03-9544 6268 (+603-9544 6268)
MEGA HAUL SDN. BHD. bertanggungjawab atas data peribadi melalui MyPet World. Hubungi kami bagi akses, pembetulan, pilihan pemprosesan, penarikan balik persetujuan, penutupan akaun atau aduan. Kami mungkin mengesahkan pemilikan akaun tanpa meminta kata laluan melalui e-mel atau telefon.
2. Data dan tujuan
Kami menyimpan e-mel, hash kata laluan bersalt, hash token pengesahan/tetapan semula, sesi, nama panggilan/avatar, haiwan peliharaan, XP, inventori dan aktiviti untuk pendaftaran, keselamatan, simpanan permainan dan pemulihan. E-mel diperlukan untuk akaun disahkan; tanpa maklumat wajib, ciri akaun tidak boleh berfungsi.
Rekod pembelian merangkumi ID pengguna/pesanan, produk, kuantiti, jumlah MYR, rujukan penyedia, bukti pengesahan, percubaan pembekalan dan lejar. Bukti penerimaan menyimpan versi dasar, jenis pengesahan, ID pengguna/pesanan dan cap masa pelayan, tanpa alamat IP atau ejen pengguna untuk bukti tersebut.
Kes sokongan menyimpan kategori, pautan pesanan, mesej, pengakuan penerimaan, siasatan dan eskalasi. Tindakan pentadbir merekodkan ID pengendali, sebab dan bukti pembetulan. Kelulusan pembayar dewasa menyimpan rujukan kes pengesahan luar dan cap masa, bukan salinan dokumen identiti. Had perbelanjaan peribadi disimpan pada pelayan. Had kadar menggunakan kunci hash; IP proksi dipercayai hanya jika dikonfigurasi. Penyedia pengehosan mungkin memproses log teknikal. Jangan hantar kata laluan, nombor kad, CVV, OTP atau maklumat identiti berlebihan.
3. Penerima dan data pembayaran
Pengendali sokongan yang dibenarkan mengakses rekod yang diperlukan untuk siasatan. Render menyediakan pengehosan aplikasi/pangkalan data; GitHub mengehos kod dan menyokong penggunaan; Resend digunakan apabila API e-melnya dikonfigurasi, atau penyedia SMTP yang dikonfigurasi. Resend menghantar e-mel akaun dan resit pembekalan sah kelak apabila dikonfigurasi; sandaran SMTP hanya menghantar e-mel akaun. Penghantaran resit semasa memerlukan Resend.
Tiada penyedia pembayaran sebenar dipilih atau diaktifkan. Identiti penyedia dan perkongsian data seperti butiran akaun, rujukan, jumlah dan status mesti didedahkan sebelum pengaktifan. Butiran pembayaran sebenar hendaklah dikendalikan melalui daftar keluar dihos yang dipercayai. Portal tidak menerima/menyimpan nombor kad sebenar atau CVV. Kad demonstrasi ialah data rekaan tetap dan medan kad tidak dihantar.
4. Pengehosan dan pemprosesan antarabangsa
Blueprint repositori mengkonfigurasi aplikasi dan PostgreSQL di rantau Singapura Render, di luar Malaysia. Operasi penyedia, e-mel, kod sumber dan subpemproses mungkin melibatkan negara lain; bukan semua log terhad kepada Malaysia/Singapura. Pemilik mesti mengesahkan destinasi, perlindungan dan notis/syarat yang berkenaan sebelum pemprosesan wang sebenar.
5. Penyimpanan dan penutupan akaun
Data akaun aktif disimpan untuk mengendalikan akaun. Bukti kewangan, penerimaan, hak pembelian, keselamatan dan kes mungkin diperlukan bagi perakaunan, pencegahan penipuan, pertikaian dan tuntutan sah, dan tidak boleh disimpan melebihi keperluan tujuan tersebut.
Permintaan pemadaman melalui Sokongan memerlukan log masuk dan pengesahan kata laluan. Pentadbir menyemak pesanan/tuntutan terbuka sebelum menyahnamakan pengenal log masuk utama dan membatalkan akses. Bukti minimum pesanan/kes dikekalkan dengan akses terhad; rekod kewangan tidak semestinya dipadam serta-merta. Jadual pembersihan automatik belum diaktifkan. Tempoh simpanan, pelupusan sandaran dan jadual semakan masih perlu disahkan pemilik sebelum pelancaran berbayar.
Sesi sah sehingga tujuh hari; pautan pengesahan 24 jam dan tetapan semula 30 minit. Tamat tempoh tidak bermakna semua rekod atau log penyedia sudah dipadam. Pangkalan data Render Free semasa digunakan untuk ujian dan tiada perlindungan pemulihan/sandaran automatik terurus; aturan sandaran dan ujian pemulihan kekal syarat pelancaran berbayar.
6. Hak dan pilihan
Hubungi kami bagi akses, pembetulan, penutupan akaun, penarikan balik persetujuan jika berkenaan, had pemprosesan dan hak lain di bawah undang-undang Malaysia. Kami akan menerangkan pengesahan pemilikan, pengecualian sah dan kesan kepada fungsi. Penarikan balik tidak membatalkan pemprosesan terdahulu yang sah. Aduan tidak selesai boleh dirujuk kepada Pesuruhjaya Perlindungan Data Peribadi Malaysia. Penerimaan terma dan pengakuan notis privasi berasingan daripada persetujuan pemasaran; tiada pendaftaran pemasaran atau piksel penjejakan pilihan semasa.
7. Keselamatan, kanak-kanak dan perubahan
Kawalan termasuk hash kata laluan/sesi, HTTPS dan kuki Secure dalam produksi, semakan asal, had kadar, semakan pemilikan/peranan, teks UI yang dilepaskan dan rahsia pelayan. Ini bukan pensijilan atau jaminan keselamatan mutlak. Laporkan penyalahgunaan yang disyaki.
Ibu bapa/penjaga hendaklah menyelia kanak-kanak dan menghubungi kami mengenai pengumpulan tidak sesuai. Tiada penyedia pengesahan umur/penjaga automatik disambungkan; bayaran sebenar kekal disekat sementara menunggu aturan diluluskan. Perubahan penting mendapat versi baharu dan notis/persetujuan lanjut jika diperlukan. Dikemas kini 22 Oktober 2026.