Privacy Notice

1. Who we are

SepanjangHayat is run by Sleet Resources (201703210262), R-03A, PALMERA RESIDENSI, LAMAN PUTERI 3,BANDAR PUTERI BANGI. We provide photobooth rental, digital wedding cards and a partner programme. This notice explains how we handle your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). It is provided in Malay and English.

For any question about your data, contact us at sales@sepanjanghayat.com.

2. What we collect

• Your account: name, email, phone number if given, and password (stored hashed — we can't read it).
• Bookings & orders: event dates and venue, the services chosen, quotes, payments and receipts. Your card details are handled by Stripe; we never see or store them.
• Card content: what you put on your card — the couple's and parents' names, event details, contact numbers, photos, songs and QR codes.
• Guests of a card: name, attendance and party size, wishes, voice recordings, photos and videos they share, and any guest list the couple enters.
• Partners: business and contact details, and the bank account commission is paid to.
• AI assistant: the messages you type in the "Ask Us" chat.
• Technical: IP address, device and browser type, and the cookies we need (see below).

3. Why we use it

• To provide what you asked for — bookings, cards, RSVPs, galleries and partner commission.
• To take payments and issue receipts.
• To send service emails: account verification, receipts, reminders and warnings before data is deleted.
• To answer your questions and give support.
• To prevent fraud, spam and abuse.
• To meet legal duties, including tax and accounting records.
• To understand how the services are used overall (for example events per month) — without identifying anyone.

We don't sell your personal data, and don't send marketing emails without your permission.

4. Couples, guests and who can see a card

Anyone with a card's link can see its content. The couple chooses what shows: guests' wishes, and guests' photos and videos only appear when the couple picks them. Voice recordings, the guest list and RSVP answers are seen only by the couple (and anyone they let manage the card).

Couples are responsible for having permission to use other people's data they put on a card — for example parents' names or phone numbers on a guest list.

If your card came in a partner's package, that partner can see the card's status and the name and email of the account that claimed it. A partner who only referred you with a code or link never sees your name or contact details.

5. Who processes data for us

We use these providers to run the services. Some process data outside Malaysia; we share only what each needs for its job.

• Cloudflare — website hosting, database, file storage and security (data centres worldwide).
• Stripe — card, FPX and GrabPay payments.
• Resend — sending emails (United States).
• DeepSeek — the AI model behind the "Ask Us" chat (China). Chat messages are sent to them to be answered — please don't share sensitive information in the chat.
• Google Fonts — the site's fonts load from Google, which receives your IP address.

We also disclose data when the law or the authorities require it.

6. How long we keep it

• Card details are deleted 30 days after the event: RSVPs, wishes, voice recordings, the guest list, galleries, guests' photos and videos, songs and the card's content. The couple is warned by email first, and if guest photo sharing was used, a download of the guests' photos and videos is emailed to them the day after the event. We keep only the event's date and type and the card's language, for statistics.
• Payment records and receipts are kept for 7 years, as tax law requires.
• Your account is kept until you ask us to delete it.
• Partner records are kept while you are in the programme, and payout records for 7 years after.

7. Your rights

You can ask for a copy of your personal data, correct it, withdraw consent, or ask for your account to be deleted. Email us at sales@sepanjanghayat.com; we reply within 21 days. If you withdraw data a service needs (for example the email on your account), we may not be able to keep providing that service. Records the law requires (such as receipts) can't be deleted early.

8. Security

The site uses HTTPS, passwords are stored hashed, and only staff who need it can access your data. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

9. Cookies

We only use cookies the site needs to work — no advertising or tracking cookies.

• sh_session — keeps you signed in.
• sh_ref — remembers the partner who referred you for 60 days, so they're credited.
• sh_pref — remembers the partner who invited you to join the partner programme.
• Cloudflare may set security cookies to protect the site from bots.

10. Children

Accounts are for people aged 18 or over. Guests under 18 should have a parent's permission before sharing photos, videos or voice recordings.

11. Changes to this notice

We update the date above when this notice changes, and tell account holders by email if a change is significant.