1. Overview
Toocak ("we", "our", or "the Platform") provides a no-code website building and e-commerce SaaS platform that enables independent merchants, creators, and small businesses to showcase products and receive customer inquiries and orders via WhatsApp. We take user privacy, data security, and compliance with personal data protection laws seriously.
2. Information We Collect
When you use Toocak, we may collect the following categories of information:
- Account Details: Your name, email address, password hash, and organization information provided during registration.
- Storefront Information: Business name, subdomain, custom domain, catalog items, photos, contact numbers, and WhatsApp numbers configured in your dashboard.
- Technical & Analytics Data: IP address, device type, browser information, and aggregated visit statistics to optimize platform performance and ensure platform security.
3. WhatsApp Platform Data & WhatsApp Flows
When customers choose to order products via WhatsApp Flows (our native in-chat checkout feature powered by Meta's WhatsApp Cloud API), we collect and process specific platform data transmitted through Meta webhooks:
- Customer Contact Details: Full name and WhatsApp phone number.
- Order & Delivery Details: Delivery address, ordered product SKU/ID, quantity, and customer notes.
Purpose of Processing: This platform data is processed strictly to generate and record the order within the merchant's store dashboard, reserve product inventory, and send automated order receipt confirmations back to the customer in the WhatsApp chat.
No Data Selling or Advertising: We do not sell, rent, lease, or disclose WhatsApp Platform Data to any third parties or advertising networks. Platform data is never used for targeted advertising or user profiling.
4. How Customer Orders Are Handled
Toocak operates as a technical intermediary and SaaS platform on behalf of our merchants. When a visitor places an order via WhatsApp or our native WhatsApp Flow, the order data is relayed directly into the designated merchant's administrative dashboard. We do not store customer credit card numbers or sensitive banking passwords on our servers.
5. How We Use Your Data
We use collected data solely for legitimate business purposes:
- To provision, maintain, and secure your website, storefront, and account.
- To facilitate domain routing, order recording, and WhatsApp order formatting.
- To communicate important service notifications, security alerts, and system updates.
- To prevent fraudulent activities and enforce our Terms of Service and acceptable use standards (including investigating misuse or prohibited activities such as child exploitation material, pornography, alcohol, gambling, and dangerous weapons, and reporting severe unlawful conduct to relevant authorities).
6. Data Retention & Security
We implement industry-standard security measures including HTTPS encryption, signed and encrypted flow tokens, secure hashed credentials, and scoped database access controls to safeguard your data. Order data is retained only for as long as necessary to support the merchant's operational and accounting requirements, or until a valid data deletion request is fulfilled.
7. User Data Deletion Instructions
In compliance with Meta Platform Policies, personal data protection laws (including the Personal Data Protection Act - PDPA), and privacy standards, users and customers have the right to request the deletion of their personal information, account credentials, and WhatsApp order history.
A. Account Owners & Merchants (Self-Service Deletion):
Registered merchants can initiate the deletion of their account and organization data directly through the platform dashboard:
- Log in and navigate to Account Settings (
/profile). - Scroll down to the Delete account section.
- Enter your current password to confirm your identity and click Delete my account.
30-Day Grace Period: Upon initiating account deletion, all published storefronts and websites are immediately placed into maintenance mode, and your account enters a 30-day grace period. If you change your mind within 30 days, simply log in to your account and click "Cancel Deletion & Restore Account" to restore full access. After 30 days, self-service restoration is disabled, and your account and personal records are permanently queued for purging.
B. Store Customers & WhatsApp End-Users:
Customers who have placed orders or interacted with a merchant's storefront may request deletion of their personal records (name, phone number, delivery address) through either of the following methods:
- Directly via Merchant: Merchants can anonymize and remove customer personally identifiable information (PII) at any time from their dashboard's Customers section in accordance with PDPA guidelines while preserving anonymized sales logs for statutory accounting.
- Via Platform Support: Send an email to [email protected] with the subject line "WhatsApp Data Deletion Request", providing the phone number used when placing the order and the store name. Your records will be verified, anonymized, and permanently removed from active databases within 30 days.
8. Third-Party Integrations
Our service integrates with third-party service providers including WhatsApp (Meta Platforms, Inc.), cloud hosting providers, and optional payment gateways (such as Billplz or Stripe). Each third-party provider processes data subject to their respective terms and privacy policies.
9. Contact & Business Information
If you have questions regarding this Privacy Policy, data handling practices, or wish to exercise your data rights, please contact us:
- Service Provider: Toocak Platform
- Operating Location: Malaysia
- Email: [email protected]
- Online: Contact Page