Privacy Policy

Last updated: February 2026

1. Introduction

Oro Group ("we", "us", "our") operates OroFlow. This Privacy Policy explains how we collect, use, and protect your personal data when you use our Platform, in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

2. Information We Collect

Account Information: When you register, we collect your name, email address, and encrypted password.

Usage Data: We collect information about how you use the Platform, including workflows created, features used, and timestamps.

Payment Information: Payment details are processed by our third-party payment partners (ToyyibPay). We store transaction references but not your full payment card details.

Technical Data: We may collect your IP address, browser type, and device information for security and analytics purposes.

3. How We Use Your Information

We use your data to:

Provide and maintain the Platform
Process your subscription and payments
Send important service updates and notifications
Improve our services and develop new features
Ensure platform security and prevent fraud
Provide customer support

4. Data Storage & Security

Your data is stored securely on Supabase infrastructure with encryption at rest and in transit. We implement industry-standard security measures including Row-Level Security (RLS) policies to ensure users can only access their own data. Passwords are hashed and never stored in plain text.

5. Data Sharing

We do not sell your personal data. We may share data with:

Service providers: Hosting, payment processing, and analytics partners who assist in operating the Platform
Legal requirements: When required by Malaysian law, regulation, or legal process
Business transfers: In connection with a merger, acquisition, or sale of assets

6. Your Rights

Under the PDPA, you have the right to:

Access your personal data held by us
Correct any inaccurate personal data
Withdraw consent for data processing
Request deletion of your account and associated data

To exercise these rights, contact us using the details below.

7. Cookies & Local Storage

We use browser local storage to maintain your login session and preferences. This is essential for the Platform to function. We do not use third-party tracking cookies.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

9. Children's Privacy

OroFlow is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this page periodically.

11. Contact Us

For privacy-related enquiries or to exercise your data rights, contact us:

WhatsApp: +60 16-369 5701
Email: [email protected]