This notice explains how Tru 360 Solutions (AS0515710K), Malaysia ("Kadlah", "we", "us") processes personal data in connection with kadlah.com, accounts, digital invitations, RSVP pages, checkout, and support. It is intended to describe our practices under Malaysia's Personal Data Protection Act 2010 (Act 709), as amended from time to time.
1. Data we collect
Depending on how you use Kadlah, we may collect your name, email address, account and support user ID, password-related authentication records, and OTP or email-verification details; order, payment, discount, and redemption references; invitation text, event details, and uploaded artwork; RSVP guest names, attendance, guest counts, and notes; promotional-email preferences and consent or withdrawal records; and Contact Us details such as your name, email, optional phone number, subject, and message. We also create email-delivery diagnostics such as recipient, message category and subject, provider reference, delivery status or error, and a redacted message preview. Operational emails to Kadlah's configured admin contact may contain customer name and email, account, order or invitation identifiers, and the related status or event details. For security, fraud prevention, rate limiting, and bot checks, we may process technical information such as request IP address and browser signals.
2. Purposes and notice
We use data to create and secure accounts, provide invitation editing/hosting and RSVP features, verify email, process orders and refunds where applicable, send transactional emails and receipts, prevent fraud and quota abuse, respond to enquiries, maintain audit records, improve reliability, and comply with law. With separate optional consent, we may also send promotional messages about Kadlah, new designs, product improvements, or offers. We also use limited information to send internal operational notifications and to record whether transactional or promotional emails were accepted, delivered, or failed. We do not sell personal data or use it for independent third-party marketing without clear notice and any consent required by law.
3. Promotional communications
Promotional communications are optional and are not required to create an account, purchase an invitation, or use the service. We send them only when you actively opt in, such as through signup, checkout, or the customer-portal preference. Each promotional email provides a clear unsubscribe link, and you can withdraw consent at any time in the customer portal or through that link. Kadlah may disclose the minimum contact details needed to email and communications providers acting on our instructions to deliver these messages. Withdrawal does not affect essential account, security, payment, verification, or invitation-service messages. We keep a minimal suppression record when needed to honour your withdrawal and prevent future promotional sends.
4. Public invitation and RSVP data
If you publish an invitation, the invitation content you choose to display can be viewed by anyone who has its public link. RSVP submissions are not shown on the public invitation page by default; the invitation owner can view them in the authenticated customer portal, and authorised Kadlah administrators may access them when needed to operate or support the service. RSVP submissions may include a guest's name, attendance response, guest count, and any note they choose to provide. Do not publish sensitive or unnecessary information. Invitation owners should obtain appropriate permissions from people named or photographed and tell guests how their RSVP details will be used.
5. Providers and disclosures
We disclose only what is needed to providers supporting the service: Supabase (database, authentication, and storage), Vercel (hosting and optional analytics), CHIP Collect (payment processing), Resend (transactional and, if enabled, promotional email), Upstash (temporary distributed rate-limit counters), and Cloudflare (site protection and Turnstile anti-bot verification where enabled). Cloudflare and other security providers may receive request details such as IP address and browser signals to assess abuse. Provider infrastructure may process data outside Malaysia; the precise location depends on provider configuration and may change. We use providers to operate Kadlah and limit disclosures to what is needed for each service. We may also disclose data to regulators, advisers, or authorities when legally required or necessary to protect users and Kadlah.
6. Payment data
CHIP handles live payment details. Kadlah stores order totals, currency, provider references, status, and limited receipt information for reconciliation and support; we do not store full card numbers or banking credentials.
7. Retention and deletion
We retain records only as long as needed for the purposes described here, including providing the service, preventing abuse, resolving disputes, meeting legal or accounting obligations, and maintaining secure backups. An unverified account with no order or invitation records may be deleted after the configured waiting period. Email-delivery and operational-notification logs may contain recipient, subject, provider references, delivery status or errors, and a redacted message preview; they may be retained for the applicable operational or legal period and are not necessarily erased immediately when an account is deleted. To enforce a lifetime Free allocation limit, we may retain a keyed, one-way HMAC of a normalized verified email and an allocation count after an account is deleted. This abuse-prevention key is not the raw email and is not used to send messages. Account deletion removes personal data and invitations where operationally possible, but payment, fraud, audit, abuse-prevention, delivery-log, or backup records may remain for their applicable retention period. Aggregate daily invitation-view totals are retained with the invitation while it exists.
8. Security
We use authenticated server actions, row-level access controls, service-role-only settlement/allocation operations, rate limiting, verification, and least-privilege access. No online service is risk-free; contact us promptly if you suspect unauthorised access.
9. Your choices and requests
Subject to applicable law and identity verification, you may request access to, correction of, or deletion of your personal data, ask about its processing, and withdraw consent where processing depends on consent. Where applicable, you may also request that we transmit your personal data electronically to another data controller; this is subject to technical feasibility and compatible data formats. For promotional email, use the unsubscribe link in the message or the Marketing emails setting in your customer portal. Some data is required to provide an account, payment, or invitation. Email [email protected]; we may ask for information to verify your identity.
10. Cookies and similar technology
Kadlah uses essential cookies and browser storage for authentication, security, language preferences, consent preferences, and application operation. These are needed for the service to work and cannot be switched off through the optional analytics setting. You can manage optional analytics at any time using the Cookie settings link in the footer.
Optional analytics is off until you choose to allow it. If you allow it, Kadlah may use privacy-focused Vercel Analytics and Speed Insights, and Google Analytics when it is configured, to understand aggregate website usage and performance. You can choose Essential only or withdraw optional analytics permission at any time. Those providers process data under their own notices and controls.
For a published invitation, Kadlah records an aggregate daily view count when its public link is opened. A temporary browser-session marker helps avoid counting repeated loads in the same tab. The stored view summary does not contain raw IP addresses, visitor identifiers, user-agent details, or RSVP content. Request IP information may still be processed separately for security and rate limiting. Published-invitation totals are retained with the invitation while it exists so the account owner and Kadlah can understand basic usage.
11. Children and changes
Kadlah is not directed to children. Do not submit a child's personal data unless you have authority and it is necessary for the invitation. We may update this notice and will post the new version here.
12. Contact and complaints
Data protection enquiries can be sent to [email protected] or through our Contact Us page. You may also contact Malaysia's Personal Data Protection Commissioner through the official JPDP channels.