Privacy Policy

Who is responsible

VEXA GLOBAL (SSM 202503349980 (AS0507688-V)) is the data user for the purposes of the PDPA. Data questions and access requests go to support@vexa.com.my.

What we collect

• Your email address — to create your account, verify it, and send order notifications.
• Your orders — what you bought, when, how much, and the delivery status.
• Payment references — a transaction ID from our payment provider. We never receive or store your card number or banking credentials.
• Security records — sign-in attempts and the times you reveal purchased credentials, so we can spot account takeover.
• Optional profile details — a display name and phone number, only if you enter them.

We don't run advertising trackers or sell data to anyone. Ever.

Why we hold it

To sell you an account and deliver it, to honour the warranty, to keep the store secure against fraud and account takeover, and to meet Malaysian business record-keeping requirements. That's the whole list.

Account credentials and the 30-day window

The login details of accounts we sell are encrypted with AES-256-GCM before they touch our database. The encryption key is held separately from the data, and decryption only happens on our server at the moment you press Reveal — never in your browser, never in an email, never in a link.

30 days after purchase we permanently delete the encrypted credentials. You keep the account, of course — but we stop being able to show the details again. This is deliberate: data we no longer hold cannot be stolen from us. Secure the account and change the password when you receive it.

Who else sees your data

• Supabase — our database and login provider, hosting in Singapore.
• Stripe — processes payments and receives your email and order total to do so.
• Vercel — serves the website.
• Cloudflare — checks that sign-ups are made by people, not bots.

These providers process data on our instructions. Some are outside Malaysia, which the PDPA permits where the receiving party gives comparable protection — these do.

How long we keep things

• Encrypted account credentials: 30 days after purchase, then deleted.
• Order and payment records: 7 years, as Malaysian tax law requires.
• Security and audit records: 2 years.
• Your account: until you ask us to close it, then we delete what we are not legally required to keep.

Your rights

Under the PDPA you can ask for a copy of the data we hold about you, correct anything wrong, withdraw consent, or ask us to delete your account. Write to us and we'll respond within 21 days. We may need to keep order records even after closing an account — that's a legal obligation, not a choice.

Cookies

We set cookies to keep you signed in and to remember your cart. That's it — no advertising or analytics cookies. Blocking them means you can't stay logged in or check out.

Contact

Questions about any of this go to our contact page. If you think we've mishandled your data, you can also complain to the Personal Data Protection Commissioner of Malaysia.