Privacy Policy

01Who we are

ShopyLink (“ShopyLink”, “we”, “our”, “us”) is a package-forwarding and digital gift-card service. We give you personal shopping addresses in supported countries (currently the USA, UAE, Türkiye and China), receive the parcels you buy, and forward them to your door in Syria. We also sell digital gift cards for popular stores and platforms.

This policy explains what information we collect, why we collect it, and the choices you have. It applies to the ShopyLink mobile app and to this website (shopylink.my and its subdomains).

02Information we collect

Information you give us

• Phone number. Your phone number is your account identity. We verify it with a one-time code sent by SMS when you register, sign in, or change your number.
• Profile details. Your first, middle and last name, gender, and date of birth, provided when you register and editable in the app.
• Addresses. Your residential delivery address, and the ship-to name you choose for your shopping addresses abroad.
• Support messages. The tickets and messages you send to our support team, including any details you choose to include in them.

Information created when you use ShopyLink

• Shipment records. Tracking numbers, origin country, parcel weight, declared item count, shipping fees, customs duties, and delivery status and dates.
• Subscription records. The shopping-address plans you purchase and their validity.
• Payment records. The amount, status, and gateway reference of each payment — never your card details (see Payments).
• Gift-card orders. The store, denomination and quantity you order, and the issued codes — which we store encrypted.
• Notifications. An in-app feed of updates about your own account activity, such as a shipment payment or an activated subscription.

Information collected automatically

• Server logs. Like most online services, our servers record technical request data — IP address, timestamps, the endpoint called, and basic device metadata — used for security, troubleshooting and reliability.
• On-device preferences. Your language, theme and session tokens are stored locally on your device (tokens in your device's secure storage). They stay on your device.

What we do not collect

• No advertising or third-party analytics SDKs are embedded in the app.
• The app requests no device permissions beyond internet access — no camera, contacts, or GPS location access.
• We do not collect data about you from third parties or other sources.

03How we use your information

• To run your account — registering you, verifying your phone number by SMS, and keeping you signed in securely.
• To move your parcels — receiving, weighing, forwarding and delivering shipments, and calculating shipping fees and customs duties.
• To process payments — initiating charges through our payment gateway, confirming their outcome, and reconciling orders.
• To fulfil gift-card orders — purchasing your cards from suppliers and delivering the codes to you in the app.
• To keep you informed — showing in-app notifications about your own shipments, payments and orders.
• To support you — answering your tickets and resolving issues.
• To keep the service safe — preventing fraud and abuse, securing accounts, and debugging problems.
• To meet legal obligations — such as customs, tax and accounting requirements that apply to shipping and payments.

We do not use your information for advertising, and we do not sell it to anyone.

04Payments

Card payments are processed by a licensed third-party payment gateway (currently Paymera). When you pay, you are taken to the gateway's own secure hosted page, and you enter your card details there — your card number is never entered on, sent to, or stored by ShopyLink's servers.

We receive and keep only the outcome of the payment: the amount, currency, status, and a transaction reference. We use these to activate what you paid for, to reconcile orders, and to resolve disputes.

05When we share information

We share personal information only with providers who help us run the service, and only what each one needs:

• SMS delivery providers receive your phone number and the one-time code, to deliver verification messages.
• The payment gateway processes your payments on its own pages, under its own privacy policy.
• Gift-card suppliers receive the order details needed to issue your codes (the product and an order reference — not your name or contact details).
• Shipping and customs partners receive your name, delivery address and parcel details where needed to transport, clear and deliver your shipments.
• Map tiles. If you open a map in the app, your device fetches map imagery directly from OpenStreetMap's tile servers, which see your IP address like any website you visit.

Beyond that, we disclose information only if the law requires it (for example a lawful request by authorities, or customs regulations), to protect the rights and safety of our users and service, or — if ShopyLink is ever part of a merger or acquisition — to the successor operator under this same policy.

06How long we keep it

• Account and profile data is kept for as long as your account is active.
• Shipment, order and payment records are kept for as long as needed to operate the service and to meet legal, tax, accounting and customs record-keeping requirements.
• Support conversations are kept while your account is active so we can follow up on past issues.

When you ask us to delete your account, we delete or anonymize your personal information, except records we are legally required to retain (such as transaction records), which are kept only as long as the law requires.

07How we protect it

• All traffic between the app, this website and our servers is encrypted with TLS (HTTPS).
• Sensitive values such as gift-card codes are stored encrypted at rest.
• Sign-in uses one-time SMS codes; session tokens are stored in your device's secure storage and can be revoked server-side.
• Access to production systems and data is restricted to the people who operate the service.

No method of transmission or storage is 100% secure, but we work to protect your information with measures appropriate to the risk. If we learn of a breach affecting your personal data, we will notify you as required by law.

08Your rights and choices

• Access and update. You can view and edit your profile (name, gender, date of birth) directly in the app, and change your phone number through a verified in-app flow.
• Copy of your data. You can ask us for a copy of the personal information we hold about you.
• Deletion. You can ask us to delete your account and personal information (see How long we keep it for the limited records we must retain).
• Complaints. Depending on where you live, you may also have rights to correction, objection or restriction of processing, and to complain to a data-protection authority.

To exercise any of these rights, contact us at support@shopylink.my from a channel linked to your account, or through in-app support. We may need to verify it's you before acting on a request.

09Children's privacy

ShopyLink is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

10International transfers

By its nature, package forwarding moves information across borders: our servers and the providers we work with (SMS delivery, payment processing, gift-card suppliers, shipping partners) may store or process data in countries other than your own. Where that happens, we take reasonable steps to ensure your information receives an adequate level of protection consistent with this policy.

11Changes to this policy

We may update this policy as the service evolves. When we do, we will update the effective date at the top of this page, and for material changes we will notify you in the app or on this website before they take effect. The current version always lives at this address.

12Contact us