Privacy Policy

Last updated: 4 August 2026

ReserveHub ("we", "us") provides an online booking platform for service businesses in Malaysia. This policy explains how we collect, use, and protect personal data, in line with the Personal Data Protection Act 2010 (PDPA).

1. Data we collect

  • Merchant account data — name, email address, business name, subdomain, subscription and payment records, and (for payout eligibility) business verification documents and bank account details.
  • Booking data — when a customer books with a merchant through a ReserveHub booking page, we store the details submitted on that form (such as name, phone number, email, and any custom fields the merchant has defined) on the merchant's behalf.
  • Technical data — IP addresses and request logs used for security, rate limiting, and troubleshooting.

2. How we use it

  • To operate bookings: showing availability, confirming appointments, and sending booking-related email notifications.
  • To process payments through ToyyibPay (FPX). Card or bank credentials are entered on the payment gateway's own pages and are never stored by ReserveHub.
  • To operate AI-assisted features (such as landing page content generation): the text a merchant submits to these features is sent to our AI service provider to generate the result, and usage is logged for billing and abuse prevention.
  • To provide support, maintain security, and meet legal obligations.

3. Who we share it with

We do not sell personal data. Data is shared only with the service providers needed to run the platform — our hosting provider, email delivery service, payment gateway (ToyyibPay), and AI service provider — and only to the extent needed for the service to work. Booking data belongs to the merchant the booking was made with; that merchant controls it and can see it in their dashboard.

4. Retention

Booking and payment records are kept for as long as the merchant's account is active and as required for accounting and legal purposes. AI feature logs (prompts and generated output) are kept for a limited period for billing and quality purposes and are then deleted automatically.

5. Your rights

Under the PDPA you may request access to or correction of your personal data. Customers who booked with a merchant should contact that merchant directly, as the merchant controls the booking record; we will assist merchants in fulfilling such requests. Merchants can contact us at the support channel in their dashboard or by email.

6. Security

Data is transmitted over HTTPS and stored on access-controlled infrastructure. Payment gateway credentials and secrets are redacted from our logs.

7. Contact

For privacy matters, contact us at support@reservehub.my.

8. Changes

We may update this policy from time to time. The "last updated" date above reflects the current version; material changes will be announced to merchants in the dashboard.