1. Who this policy applies to
This Privacy Policy explains how Lockbah collects, uses, stores, discloses, and protects personal data when you visit the site, create an account, subscribe, contact us, configure printing, or use live selling workflows.
For the purposes of Malaysian personal data protection law, Lockbah is operated by Rezuan bin Kassim. Until a separate data protection officer or registered business contact is published, privacy requests should be sent to the contact email shown on this page.
2. Personal data we collect
We collect personal data that you provide directly, that is created when you use Lockbah, and that we receive from service providers needed to run the product.
- Account data, including name, email address, password credentials, email verification status, two-factor authentication status, passkey records, and login/session data.
- Billing data, including subscription status, selected plan, billing interval, Paddle customer and subscription identifiers, payment status, transaction references, LIVE Credit purchases, and invoices or receipts made available by Paddle.
- Printer setup data, including PrintNode API keys, PrintNode login email, PrintNode login password if entered, printer identifiers, printer names, shop names, paper settings, label copy settings, and print workflow preferences.
- Live selling data, including TikTok LIVE session records, comments, product numbers, product names, buyer or viewer names where captured, product locks, VIP codes where enabled, print status, and live history.
- Contact and support data, including contact form name, email address, phone number, message content, support requests, refund requests, and related communications.
- Technical data, including IP address, browser and device information, cookies, session identifiers, request logs, error logs, and security events.
3. Why we use personal data
We process personal data for purposes connected with providing, securing, supporting, and improving Lockbah.
- To create and secure accounts, verify email addresses, authenticate users, and prevent unauthorized access.
- To provide live selling, comment tracking, product lock, printer setup, print job, onboarding, dashboard, and history features.
- To process subscriptions, trials, renewals, failed payments, cancellations, invoices, LIVE Credit top-ups, and refund requests through Paddle.
- To respond to contact messages, support questions, legal requests, privacy requests, and account administration needs.
- To monitor service reliability, investigate errors, enforce Terms of Service, prevent abuse, and comply with legal obligations.
- To send service, security, account, billing, and operational messages. Marketing messages, if used, will be handled in line with applicable consent and opt-out requirements.
4. Malaysian PDPA principles
We aim to handle personal data in line with the Malaysian Personal Data Protection Act 2010 and applicable amendments, including notice and choice, disclosure limits, security, storage limits, data integrity, and access or correction rights.
Where consent is required, we will seek it through the account, checkout, form, or other relevant flow. You may withdraw consent where the law allows, but some processing may still be necessary to provide the service, keep records, or meet legal obligations.
5. Disclosure and processors
We do not sell your personal data. We disclose personal data only where needed to operate Lockbah, comply with law, protect rights and security, or complete a transaction you requested.
- Paddle, for checkout, subscriptions, billing, invoices, taxes, payment status, payment recovery, and refund processing.
- PrintNode, for printer connectivity and print job handling when you configure PrintNode-based printing.
- Email and communication providers such as Resend or the configured mail provider, for account, verification, support, and transactional emails.
- Hosting, database, storage, monitoring, security, and analytics providers used to run and protect Lockbah.
- Professional advisers, authorities, courts, regulators, or law enforcement where required or permitted by law.
6. International transfers
Some providers we use may process or store personal data outside Malaysia. This includes payment, printing, hosting, email, security, and infrastructure providers.
Where Malaysian law requires safeguards, consent, contractual protection, or another lawful basis for cross-border processing, we will use the available mechanism appropriate to the service and data involved.
7. Security
We use reasonable technical and organizational safeguards to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction.
Sensitive printer credentials stored by the application, such as PrintNode API keys and PrintNode login passwords, are stored using Laravel encrypted casts and are hidden from normal serialized responses. No internet service can be guaranteed completely secure, so you should also protect your account, devices, email inbox, and printer credentials.
8. Retention
We keep personal data only for as long as needed for the purposes described in this policy, including providing the service, maintaining account and billing records, complying with legal obligations, resolving disputes, enforcing agreements, and protecting security.
Live session history, comments, product locks, credit transactions, billing records, and logs may have different retention periods because they support different product, accounting, legal, and security purposes.
9. Your rights
Subject to Malaysian law, you may request access to your personal data, correction of inaccurate personal data, withdrawal of consent, limits on processing that may cause damage or distress, and limits on direct marketing.
Send requests to the contact email shown on this page. We may need to verify your identity and account authority before acting on a request. Some data may need to be retained where required by law, billing records, fraud prevention, dispute handling, or service security.
10. Cookies and similar technologies
Lockbah uses cookies and similar technologies for authentication, sessions, security, CSRF protection, preferences, and basic operation of the site. If analytics or marketing cookies are added later, this policy and the consent flow should be updated before they are used.
11. Changes to this policy
We may update this Privacy Policy when the product, providers, legal requirements, or business details change. The effective date shows when the current version applies.