Privacy Notice

1. Who is responsible

STK MARKETING (M) SDN. BHD. (company no. 202501017765 (1619179-K)), 39-1F, Jalan Setia Perdana BC U13/BC, Bandar Setia Alam, 40170 Shah Alam, Selangor, operates this customer app for D'Natural Apple Fiber. This notice, effective 22 October 2026, explains the information handled by the current app and the choices available to you. Privacy contact: choonyanycy@gmail.com.

2. Account and membership information

Email registration asks for your full name, email address and password. Phone number is optional. The authentication service processes your credentials and manages sign-in, email confirmation and password reset. The app keeps an account identifier, profile information, creation/update times, consent information and account roles.

Rewards are hidden for launch. Existing demo points records may remain stored, including changes, reasons and dates; no real earning or redemption is available. Google sign-in is optional and uses the Google/Lovable sign-in service.

Confirm Google identity attributes/scopes and provider settings. Email signup requires PDPA consent, but the current Google sign-in path does not record that same checkbox consent; resolve this before release.

3. Enquiries and suspected-counterfeit reports

An enquiry records your name, email, selected topic, message, consent, submission time and case status. A suspected-counterfeit report records your name, email, purchase location and description, with optional phone number and code from the pack, plus consent, submission time and case status.

Reports and enquiries do not have a direct account-ID field, but names, emails and message contents can identify you. The optional code entered in a report is stored as entered; it is not hashed like issued verification codes. Please do not include passwords, payment-card details or unnecessary medical information.

Legal review: handling of sensitive information volunteered in messages, and the appropriate consent/retention process for investigations.

4. Product verification

The full code you submit is sent to the verification service for a secure hash comparison. Issued-code records keep a SHA-256 hash, a last-four-character hint, batch, status, scan count and first/last scan times. Each verification log keeps a code hint where applicable, result and time, without a user-ID field.

A code may also appear in a QR-link address and your browser history. Hosting or request logs may process the URL or network information. The absence of an account ID in a scan record does not mean all verification activity is anonymous.

Confirm production request/log capture, query-string redaction and retention. Do not describe all codes as unhashed nowhere: counterfeit reports can contain a full code.

5. Session storage and technical information

To keep you signed in, the authentication library saves session information in browser/WebView storage and refreshes it as needed. Signing out removes the active app session; it does not delete your account or past submissions.

The app reports error messages, stack traces and page paths to available Lovable reporting hooks and server logs when errors occur. Hosting, authentication and sign-in providers may also process connection information such as IP addresses, browser/device details and access times. Google-hosted fonts and the product-image host receive requests when their resources load.

Confirm which reporting hooks operate in the published/native versions, payload redaction, provider cookies, device identifiers, resource-host data and retention. Production analytics or tracking has not been established by source review.

6. Why information is used and your choices

Information is used to create and secure accounts, display membership records, verify product codes, answer enquiries, investigate suspected counterfeits and operate/troubleshoot the app. Promotions and member news use an optional marketing preference; email signup defaults this preference to off, and members can change it in their account.

You can browse product and store information without a membership. Providing the required account or form fields is necessary to use that particular service; optional phone/code fields and marketing consent can be left blank or off. Verification sends the code when you choose to check it.

Confirm marketing delivery channels/vendors, legal basis for each purpose and any additional consent requirements. Recording a preference is not proof that a marketing delivery system is configured.

7. Access, service providers and external stores

Authorized staff can access customer profiles, points, verification records and submitted cases as permitted by their roles. Hosting, authentication, sign-in and technical service providers process information needed for their services. Required disclosures to authorities may occur where legally justified.

Purchases take place on external stores, not in this app. Shopee, TikTok and the official website handle their own checkout and privacy practices. If you follow a store, pharmacy or WhatsApp link, that service receives your visit/message under its own terms. This app does not have payment-card entry, order checkout, photo uploads, GPS collection, camera scanning or push notifications.

Confirm the full provider/subprocessor list, processing locations, international-transfer safeguards, whether data is sold/shared for advertising, and any future integrations. The official website link currently uses HTTP; verify a secure destination before mobile release.

8. Retention and security

The app uses authentication and role-restricted data access. No method of transmission or storage is completely secure. Do not share passwords or private codes in public messages.

Self-account deletion removes the authentication account, profile, preferences, roles and points history from live records. Support enquiries and counterfeit reports are retained separately pending approval of their retention periods. Verification records are not linked to membership. No scheduled retention cleanup is implemented. Backup and provider-log retention may differ from live records.

Owner confirmation / legal review: set retention periods by data type, lawful investigation/recordkeeping exceptions, backup expiry, safeguards and incident-response responsibilities. No deletion deadline is promised in this draft.

9. Access, correction, consent withdrawal and deletion

You may request access to or correction of personal data, withdraw consent, stop marketing or request deletion through Customer support. We need a proportionate way to verify the requester before disclosing or deleting records. Restrictions or lawful retention may apply and should be explained.

Use Account privacy to permanently delete your account after password verification or a sign-in within the last five minutes. The public /delete-account page also provides an email-request option. Removing the app or signing out is not deletion. Enquiries and reports linked by email are not automatically deleted; request review of those records separately.

Confirm the responsible contact, request verification, response procedure, retention exceptions and deadlines with a qualified Malaysian adviser; Review the manual case-deletion process, backup/provider retention and final release behavior.

10. Children, languages and changes

This notice, effective 22 October 2026, is available in English and Bahasa Malaysia. Material changes to data practices should be reflected in the notice and, where required, new consent obtained.

Legal/translation review: confirm audience and age restrictions, handling of children's data, both language versions and Malaysia PDPA requirements as amended. No age gate is currently implemented.