Privacy Policy

This Privacy Policy applies to the Malachi service (the “Service”) operated by Huper Technology Pte Ltd (“Huper”, “we”, “us”), a company incorporated in Singapore. It is written with the Singapore Personal Data Protection Act 2012 (PDPA) in mind and applies equally to data subjects in other jurisdictions to the extent local law requires.

Two distinct types of personal data flow through the Service:

• Customer data — information about the businesses and people who sign up to use Malachi (you, the seller). For this data we are a controller.
• Buyer data — personal data of end-buyers on Shopee, Lazada, or TikTok Shop whose messages, orders, or returns are routed through the Service. For this data we act as a data processor on the Customer’s behalf.

We collect the following categories of personal data:

• Account data — name, email address, hashed password, company name, and time zone supplied when you sign up.
• Billing data — plan, billing interval, subscription status, and the last four digits and expiry of your payment card. Card numbers and CVV are handled directly by Stripe; we never see or store them.
• Marketplace credentials — OAuth access and refresh tokens for each Shopee, Lazada, or TikTok Shop you connect. These are encrypted at rest using AES-256-GCM.
• Zendesk credentials — your Zendesk subdomain, agent email, and API token. The API token is encrypted at rest using AES-256-GCM.
• Message and event metadata — identifiers for buyer conversations, order numbers, return-merchandise numbers, timestamps, marketplace ids, ticket ids, and the outcome of each send or retry. We use this to thread conversations and to maintain an audit log.
• Buyer-facing content in transit — the body of buyer messages and agent replies passes through our infrastructure on its way between the marketplace and Zendesk. Persistent storage of message bodies lives in your Zendesk instance, not ours, except for short-lived diagnostic logs and queue records used to deliver retries.
• Operational logs — request logs, error traces, webhook delivery records, and similar diagnostic information generated automatically by the Service.

We use personal data to:

• provide, maintain, and secure the Service;
• create and send Zendesk tickets, post agent replies to marketplaces, and otherwise perform the integration the Customer has configured;
• authenticate users, manage subscriptions, and process payments;
• send service emails (welcome, payment failures, security alerts, material policy changes);
• detect, investigate, and prevent fraud, abuse, and violations of the Terms of Service;
• comply with our legal obligations and respond to lawful requests;
• improve the Service in aggregate, non-identifying ways.

We do not sell personal data. We do not use Customer Data or buyer personal data to train machine-learning models.

Where Singapore PDPA or another applicable law requires a legal basis, we rely on the following:

• Performance of a contract — to provide the Service to the Customer.
• Legitimate interests — to secure the Service, prevent abuse, and communicate about material changes, in a manner that does not override the rights of data subjects.
• Legal obligation — to comply with tax, accounting, and law-enforcement requirements.
• Consent — where required, and which you may withdraw at any time.

We share personal data only with the following categories of recipients, and only as needed to operate the Service:

• Marketplaces (Shopee, Lazada, TikTok Shop) — to send agent replies back to the originating buyer conversation, on the Customer’s behalf.
• Zendesk — to create and update tickets in the Customer’s own Zendesk instance, using credentials the Customer provides.
• Stripe — for subscription billing and payment processing. Stripe acts as a separate controller of cardholder data under its own privacy policy.
• Infrastructure and email providers — including our cloud host and our SMTP provider, who process personal data on our instruction under written data-processing terms.
• Professional advisers — auditors, lawyers, and accountants, under duties of confidentiality.
• Authorities — when required by valid legal process, after reviewing the request for legality and scope.
• Successors — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

We do not share Customer Data with other Customers. Every domain row in our database is scoped to the owning Customer’s user identifier at the schema level, so cross-tenant lookup is impossible by query.

We apply the following technical and organisational measures:

• Encryption at rest — marketplace OAuth tokens and Zendesk API tokens are encrypted in the database using AES-256-GCM. Plaintext exists only inside running process memory while a request is being served.
• Encryption in transit — all traffic to the Service is served over TLS.
• Webhook signature verification — every inbound webhook from Shopee, Lazada, TikTok Shop, Zendesk, and Stripe is signature-checked before any side effect.
• Tenant isolation — multi-tenant data is scoped at the schema level to the owning user identifier, not just by query convention.
• Least-privilege access — production database access is restricted to a small number of named administrators and is not exposed publicly.
• Audit logging — every send, retry, and webhook delivery is recorded and retained per Customer.

No system is perfectly secure. Despite our measures, we cannot guarantee that unauthorised access, hardware failure, or other incidents will never occur. If we become aware of a personal-data breach affecting you, we will notify you and the relevant regulator as required by applicable law.

We retain personal data for as long as your account is active and for a reasonable period afterwards to fulfil the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Typical retention periods:

• Account and billing records — for the life of the account and up to seven years afterwards, to satisfy tax and accounting requirements.
• Marketplace and Zendesk tokens — deleted promptly when you disconnect the relevant connection or close your account.
• Message and event metadata — retained for the life of the account to maintain the audit log; deleted on a reasonable schedule after account closure unless we are legally required to keep it longer.
• Operational logs — typically retained for up to 90 days for debugging and security.

Subject to applicable law, you have the right to access, correct, update, withdraw consent for, or request deletion of your personal data, and to receive a copy in a portable format. You may also object to or request that we restrict certain processing.

Many of these rights can be exercised directly in the application — for example by updating your profile, disconnecting a marketplace, or cancelling your subscription. For any other request, contact us at [email protected]. We will respond within the time period required by applicable law (and within 30 days in any case).

If you are a buyer on a marketplace and your data has been processed by Malachi on a seller’s behalf, please direct your request to that seller. We will assist the seller in fulfilling valid requests.

We are based in Singapore and may transfer personal data to, and process it in, jurisdictions outside your country of residence, including for hosting, support, and payment processing. Where required by law, we put in place appropriate safeguards (such as standard contractual clauses or equivalent) before transferring personal data internationally.

The Malachi application uses a small number of strictly necessary cookies, including a session cookie set by our authentication system. We do not run third-party advertising or behavioural-tracking cookies on the application. Our marketing site may use minimal first-party analytics to count page views in aggregate; this data is not used to profile individuals.

The Service is intended for businesses and is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe we may have done so, please contact us and we will delete it.

We may update this Policy from time to time. When we make material changes we will notify you by email or in-product notice and update the effective date at the top of this page. Your continued use of the Service after the change becomes effective constitutes your acceptance of the revised Policy.

For privacy questions, complaints, or to exercise your rights, contact us at:

Huper Technology Pte Ltd
Email: [email protected]
Singapore

If you are in Singapore and are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC).