Privacy Policy

1. Introduction

Welcome to Share Eat, a mobile platform that connects Foodie Content Creators with Restaurants for User Generated Content (UGC) marketing collaborations. Share Eat is operated by Share Eat Sdn. Bhd. (hereinafter referred to as "we", "our", or "us").

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you access and use the Share Eat mobile application (the "App"). It applies to all users of the App, including Foodie Content Creators ("Creators") and Restaurant partners ("Restaurants"). If you are visiting our website (shareeat.io) rather than using the App, please see Section 20, which describes the cookies and tracking technologies used on the website.

For the purposes of the Personal Data Protection Act 2010 of Malaysia, as amended by the Personal Data Protection (Amendment) Act 2024 (collectively, the "PDPA"), Share Eat Sdn. Bhd. is the data controller of your personal data. This document also serves as our Personal Data Protection Notice issued pursuant to Section 7 of the PDPA.

When you register for the App, you will be presented with a clear, explicit consent step — a mandatory tickbox requiring you to actively confirm that you have read and agree to this Privacy Policy. Without giving this consent, registration cannot be completed. If you do not agree to this Policy, please do not register for or use the App. Your consent is recorded with a timestamp and the policy version in force at the point of registration, and is kept in a permanent consent log.

2. Who This Policy Applies To

This Privacy Policy applies to two categories of users:

• Foodie Content Creators – individuals who register on the App to discover and apply for UGC collaboration opportunities with Restaurants.
• Restaurants – food and beverage businesses that register on the App to post collaboration briefs, review Creator profiles, and manage UGC campaigns.

All users must be at least 18 years of age. The App is not intended for use by minors. If we become aware that a user is under 18, we will deactivate their account and delete their data.

3. Information We Collect

We collect the following categories of personal data:

3.1 Account & Identity Information

• Display name
• Email address (verified at registration via a one-time passcode (OTP) sent to your email)
• Account password (stored in hashed form by our authentication provider; we never see your plaintext password)
• If you choose to sign in with Google or Apple (where offered): your name and email address as provided by that sign-in provider. If you use Apple's "Hide My Email", we receive the private relay address Apple generates for you.
• Phone number (WhatsApp contact number, collected during profile setup — see Section 6.1 for how it is shared)
• Referral code (optional — if you sign up through a friend's referral link or enter a code manually)

3.2 Profile Information

For Creators:

• Profile photo
• Bio, location (a free-text city/area label you type in — not GPS), and content niche and style tags you select
• Social media handles (e.g. Instagram, TikTok, RedNote)
• Content samples and portfolio photos or videos uploaded by you

For Restaurants:

• Restaurant name, description, and cuisine type
• Restaurant profile photo (logo), cover photo, and food/menu photos
• Business location (a free-text label you type in)
• Contact phone number

3.3 Location Information

• The App does not collect GPS or device location, and does not request location permission. Location fields in your profile are free-text labels you type yourself.
• Approximate (city-level) location may be derived from your IP address by our analytics providers (see Section 13).

3.4 Content You Upload & Content Licence

• Photos you upload from your photo library (profile images, restaurant logos/covers, food and menu photos). The App accesses your photo library only when you actively pick an image, and does not use your camera.
• Campaign application pitch messages written by Creators (shared with the Restaurant that owns the campaign)
• Links to your published posts and their performance metrics (views, likes, comments) submitted as campaign deliverables
• Screenshots of your post analytics uploaded as proof of performance (shared with the campaign's Restaurant)

The App does not currently provide an in-app messaging feature. Communication between Creators and Restaurants takes place off-platform (see Section 12.3).

3.5 Usage & Technical Data

• Device type, operating system, and app version
• IP address and the approximate location derived from it
• App usage events: screens viewed, buttons and elements tapped, session information, sign-up and campaign funnel events, and app install/open/update events (collected via Google Analytics for Firebase and PostHog — see Section 13)
• Search terms you enter when browsing campaigns
• In-app filters and preferences you use when browsing campaigns (for example, platform or dietary-status filters)
• How you interact with campaign listings (for example, how long a listing stays on your screen and how far you scroll), which we use to personalise the order of campaigns shown to you
• A push notification token for your device (if you enable push notifications)
• Crash and error reports — if the App malfunctions, technical details of the error (such as the error message, stack trace, and device and app version) are collected via PostHog so we can diagnose and fix the problem (see Section 13)

3.6 Referral Data

• Your unique referral code (a randomly generated code — it contains no personal information)
• If you redeem someone's code (or someone redeems yours): a record linking the two accounts, used to grant rewards and enforce programme limits
• The sharing channel you choose when you share your referral link (e.g. which app you shared it to)

3.7 Consent & Legal Records

• A permanent log of your privacy-policy consent: the policy version, the action (granted or withdrawn), and the timestamp. We retain this as a legal record even after other data is deleted, to evidence compliance with the PDPA.

4. How We Use Your Information

We use your personal data for the following purposes:

• To create, verify, and manage your account
• To display your profile to relevant parties (Restaurants viewing Creator profiles and vice versa)
• To facilitate collaboration matching between Creators and Restaurants, including personalising the campaigns shown to Creators based on their in-app activity and interests
• To facilitate contact between matched Creators and Restaurants to coordinate collaborations (currently conducted off-platform, e.g. via WhatsApp)
• To let Restaurants review Creator applications, invite Creators to campaigns, and rate submitted work (see Section 6.1)
• To generate AI-assisted campaign briefs and topic tags for Restaurants (see Section 7)
• To operate the referral programme and grant referral rewards
• To send push notifications about new collaboration opportunities, application updates, and important platform updates
• To send transactional emails (e.g. account verification codes and password reset codes)
• To improve our App's features and user experience through analytics
• To enforce our Terms of Service and Community Guidelines
• To comply with applicable laws and regulations, including the PDPA

5. Legal Basis for Processing Your Data

In accordance with Section 6 of the PDPA, we process your personal data on the following bases:

• Consent – You have given explicit, active consent at registration, recorded with a timestamp and the policy version then in force. You may withdraw this consent at any time, subject to Section 10 below.
• Contractual necessity – Processing is necessary for the performance of a contract to which you are a party (our Terms of Service), or for the taking of steps at your request with a view to entering into such a contract.
• Legal obligation – Processing is necessary for compliance with a legal obligation to which we are subject, other than an obligation imposed by contract.
• Other grounds permitted under Section 6(2) of the PDPA – including where processing is necessary to protect your vital interests, for the administration of justice, or for the exercise of any functions conferred on any person by or under any law.

6. How We Share Your Information

We do not sell your personal data. We may share your information in the following circumstances:

6.1 Between Users on the Platform

Certain profile information is visible to other users on the App to facilitate collaboration matching. This includes:

• For Creators: display name, profile photo, bio, location label, social media handles, content portfolio, niche and style tags, and your average rating from past collaborations.
• For Restaurants: restaurant name, profile photo, cover photo, location, cuisine type, description, and contact number (visible while you have an active campaign).

Your email address and account password are never shared with other users. In addition:

• When a Creator applies to a Restaurant's campaign (or is invited to one), that Restaurant can view the Creator's profile, including their WhatsApp contact number and pitch message, to evaluate the application and coordinate the collaboration off-platform. This access relates to that Restaurant's own campaigns only.
• Restaurants can rate a Creator's submitted work (1–5 stars). Your aggregate rating and the number of ratings appear on your Creator profile; you can also see ratings given to your own submissions.
• If someone signs up using your referral code, you will be notified and shown that user's display name (and they can see they were referred by you).
• Your display name and profile photo may appear in notifications sent to your collaboration counterparties (for example, "X applied to your campaign").

6.2 Third-Party Service Providers

We share data with trusted third-party providers who assist us in operating the App:

• Supabase — hosts our database, authentication, and file storage (on Amazon Web Services, Sydney, Australia region)
• Resend — delivers our transactional emails (account verification and password reset codes)
• Google — Google Analytics for Firebase (usage analytics), Google Cloud / Vertex AI (AI processing described in Section 7), and Google Sign-In (if you use it)
• Apple — Sign in with Apple (if you use it)
• PostHog, Inc. (United States) — product analytics (see Section 13)
• Expo — push notification delivery

These providers are contractually bound to process your data only on our instructions and in accordance with applicable data protection laws.

6.3 Legal & Regulatory Disclosure

We may disclose your data if required to do so by law, court order, or government authority, or where we believe disclosure is necessary to protect the rights, property, or safety of Share Eat, our users, or the public.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the relevant third party. We will notify you via email or a prominent notice on the App before your data is transferred and becomes subject to a different privacy policy, and we will obtain your consent where required under the PDPA.

7. AI Processing

The App uses Google's Gemini model (via Google Cloud Vertex AI, processed in the United States) for two features:

• AI campaign briefs — when a Restaurant uses the AI assistant while creating a campaign, the campaign draft details it has entered (title, goal, cuisine type, platforms, menu items to feature, deal details, and any additional free-text context) are sent to Gemini to generate a suggested brief.
• Campaign topic tagging — campaign details are sent to Gemini to suggest topic tags that help match campaigns to relevant Creators.

What is not sent to AI: Creator personal data, user photos, contact details, and account information are never sent to Gemini. Only Restaurant-authored campaign text is processed.

AI outputs are returned to the requesting Restaurant and are only stored if the Restaurant saves the campaign. We do not use your data to train AI models, and under Google Cloud's data-governance terms, Google does not use data submitted through Vertex AI to train its foundation models.

8. Data Storage & International Transfers

Your data is stored and processed on third-party cloud infrastructure. Our primary database, authentication, and file storage are hosted by Supabase on Amazon Web Services in Australia (Sydney region). Other providers — Google (Firebase Analytics, Google Cloud / Vertex AI), PostHog, Inc., Resend, and the Expo push notification service — store and process data primarily in the United States. Accordingly, your data may be stored and processed on servers located in countries outside of Malaysia, including but not limited to Australia and the United States.

Section 129 of the PDPA, as amended by the Personal Data Protection (Amendment) Act 2024, permits the transfer of personal data outside Malaysia only where the receiving jurisdiction has in force laws substantially similar to the PDPA, or otherwise ensures an adequate level of protection equivalent to that afforded under the PDPA, or where another condition under Section 129(3) applies (including your consent). We ensure that all international transfers of your data are protected by appropriate safeguards, including:

• Standard contractual clauses (data processing agreements) with our cloud service providers
• Adherence to the data protection and security standards mandated by our respective third-party processors
• Contractual obligations binding our service providers to process your data only for the purposes we specify

By using the App, you acknowledge that your data will be transferred to and processed in the countries described above, subject to these safeguards.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the App's services.

9.1 Active Accounts

We retain your data for the duration of your account's active status.

9.2 Closing or Deleting Your Account

The App's Settings screen provides two separate controls:

• Log Out — signs you out of the App on your device. Logging out does not delete, close, or hide your account, and your profile remains visible to other users.
• Delete Account — opens a pre-filled email to [email protected] requesting deletion of your account. Your account is not deleted merely by tapping this button — you must send the email (or email us directly). Our team then actions your request.

There is no self-service button that deletes or deactivates your account instantly; every closure and deletion request is handled by our team so that we can verify the request and meet our legal obligations. You may send a deletion, closure, or suspension request to [email protected] at any time, whether or not you use the in-app button.

9.3 What Happens After You Request Deletion

Once we receive your deletion request, we will permanently erase your personal data within 21 calendar days, subject to any overriding legal obligations. We retain a limited subset of data beyond that point only where necessary, and for no longer than necessary, for the following purposes:

• To resolve any ongoing or potential disputes arising from your use of the App, and to prevent fraud and enforce our Terms of Service — retained for no longer than 12 months
• To comply with legal and regulatory obligations. Where a specific law requires longer retention, we retain only the minimum data necessary to fulfil that obligation
• Our consent log (Section 3.7) is retained as a permanent legal record that consent was given or withdrawn

If, instead of deleting your account, we suspend it (for example, while a dispute is being resolved), we will retain your data for no longer than 12 months before permanently deleting it, unless a longer period is required by law.

10. Your Rights Under Malaysia's PDPA

As a data subject under the PDPA, you have the following rights:

• Right of Access (Section 30) – You may request a copy of the personal data we hold about you. We may charge a prescribed fee for access requests as permitted under the PDPA.
• Right to Correction (Section 34) – You may request that we correct inaccurate, incomplete, misleading, or out-of-date personal data.
• Right to Withdraw Consent (Section 38) – You may withdraw your consent to the processing of your data at any time by written notice. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. Note that withdrawing consent may affect or prevent your ability to use the App.
• Right to Prevent Processing Likely to Cause Damage or Distress (Section 42) – You may, by written notice, require us to cease or not begin processing of your personal data that is causing or likely to cause substantial damage or distress that is unwarranted.
• Right to Prevent Processing for Direct Marketing (Section 43) – You may, by written notice, require us to cease or not begin processing your personal data for purposes of direct marketing.
• Right to Data Portability (Section 43A, introduced by the Personal Data Protection (Amendment) Act 2024) – You may request that we transmit your personal data to another data controller of your choice, where technically feasible and compatible in data format.
• Right to Close Your Account – You may request closure of your account at any time using the "Delete Account" option in the App's Settings screen (which opens an email to us) or by contacting [email protected] directly. Closing your account is handled by our team; logging out of the App only signs you out and does not close your account (see Section 9.2).
• Right to Erasure – You may request permanent deletion of your personal data by submitting a written erasure request to [email protected] (the in-app "Delete Account" option opens this email for you). We will action erasure requests within 21 calendar days, subject to legal retention obligations.

To exercise any of these rights, please contact us at [email protected]. We will respond to all requests within 21 calendar days, in line with the timeframes prescribed under the PDPA. If you object to analytics processing described in Section 13, you can turn it off yourself at any time using the "Analytics" toggle in the App's Settings screen; you may also contact us and we will apply the controls available to limit further analytics processing of your data.

If you are dissatisfied with how we have handled your personal data or a request relating to it, you have the right to lodge a complaint with the Personal Data Protection Commissioner, Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi), Malaysia.

11. Users Outside Malaysia

The App is intended for the Malaysian market. If you access the App from the European Economic Area, the United Kingdom, or another jurisdiction with its own data protection law, you may have additional rights under that law (for example, under the EU/UK General Data Protection Regulation: rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your local supervisory authority). Where such laws apply to our processing of your data, we will honour those rights. You may exercise them through the same contact point in Section 19.

12. Communications & Notifications

12.1 Push Notifications

We send push notifications to inform you of new collaboration opportunities, updates on your applications, and important platform updates. If you enable push notifications, a device push token is stored against your account to deliver them; invalid tokens are removed automatically. You may manage push notification preferences in the App's notification settings and through your device settings at any time. Notifications may include the display name of your collaboration counterparty and campaign titles; a copy of your notifications is kept in your in-app notification inbox.

12.2 Email Communications

We send transactional emails, such as account verification codes and password reset codes. We do not currently send marketing or promotional emails. If we introduce marketing emails in the future, we will provide a clear opt-out (an "Unsubscribe" link in every such email) and update this Privacy Policy accordingly. Transactional emails cannot be opted out of while your account is active.

12.3 Communication Between Users

The App does not currently provide an in-app messaging feature. Once a Restaurant approves a Creator for a collaboration, the parties coordinate directly off-platform (for example, via WhatsApp) using the contact details shared for that purpose (see Section 6.1). We do not control, monitor, or store the content of these off-platform communications. Please do not share sensitive personal or financial information through them.

13. Analytics & Tracking

We use two analytics services to understand how the App is used and to improve it. Analytics collection begins only after you accept this Privacy Policy — at the registration consent tickbox, or when you tap a Google or Apple sign-in button after being shown the consent notice. Before that moment, no analytics events are collected or sent. You can turn analytics off (and back on) at any time using the "Analytics" toggle in the App's Settings screen; while it is off, no analytics events are collected.

• Google Analytics for Firebase — collects app events (screens viewed, features used, searches, sign-up and campaign funnel steps), session information, and device identifiers. We do not attach your name, email, or user ID to Firebase Analytics data.
• PostHog (PostHog, Inc., hosted in the United States) — collects product analytics events (screens viewed, elements tapped, sign-up, application, campaign, and referral funnel events, and app install/open/update events), and crash and error reports (the error message, stack trace, and device and app version) when the App malfunctions. PostHog events are associated with a pseudonymous account identifier (your random internal user ID) and your account role. We do not send your name, email address, or phone number to PostHog.

Analytics data is used in aggregated form to understand usage patterns and improve the App experience; we do not use it to make decisions with legal effect about you. In addition, the App records how you interact with campaign listings (view duration and scroll depth) in our own database to personalise your campaign feed — this data is not shared with third parties.

We do not use advertising SDKs, do not track you across other companies' apps or websites, and do not sell analytics data. Should we introduce such tools in the future, we will update this Privacy Policy and notify you accordingly. To stop analytics processing, use the "Analytics" toggle in the App's Settings screen, or see Section 10.

14. Data Security & Breach Notification

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using industry-standard TLS/SSL protocols
• Access controls limiting data access to authorised personnel only, including row-level security rules restricting which users can read which records
• Regular security assessments of our cloud infrastructure

However, no method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

14.1 Data Breach Notification

The Personal Data Protection (Amendment) Act 2024 introduced mandatory data breach notification obligations under the PDPA. In the event of a personal data breach, we will:

• Notify the Personal Data Protection Commissioner as soon as practicable, and in any event within 72 hours of becoming aware of the breach, in accordance with the PDPA and the Commissioner's applicable guidelines; and
• Where the breach is likely to result in significant harm to you, notify you without unnecessary delay, and in any event within 7 days of notifying the Commissioner.

Notification to affected users will be delivered via:

• Email to the address registered on your account
• A prominent in-app notice

Our breach notification will include: the nature of the breach, the categories of data affected, the likely consequences, and the measures we have taken or propose to take to address it.

15. Third-Party Links & Social Media

The App may contain links to third-party websites, social media platforms, or services (e.g. Instagram, TikTok). We are not responsible for the privacy practices of these third parties. We encourage you to review their respective privacy policies before sharing any personal data with them.

16. Children's Privacy

Share Eat is strictly intended for users aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has registered on the App, please contact us immediately at [email protected] and we will take prompt action to deactivate the account and delete the relevant data.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or App features. When we make material changes, we will:

• Update the "Effective Date" and version number at the top of this document
• Notify you via push notification or email
• Display a prominent notice within the App
• Where required by law or where changes are material, seek your renewed explicit consent before changes take effect

Your continued use of the App after the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms. If you do not agree, you may request deactivation of your account by contacting us.

18. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Malaysia, including the Personal Data Protection Act 2010 as amended by the Personal Data Protection (Amendment) Act 2024. Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Malaysia.

19. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact our Privacy & Data Team:

Data Protection Officer (DPO)

Share Eat has designated a Data Protection Officer (DPO), appointed in accordance with the requirements of the Personal Data Protection (Amendment) Act 2024, responsible for overseeing our compliance with the PDPA and this Privacy Policy. You may direct any data protection enquiries directly to our DPO at [email protected]. Please include "DPO – Privacy Enquiry" in your subject line for prompt handling.

We aim to respond to all privacy-related enquiries within 21 calendar days.

20. Website Visitors, Cookies & Similar Technologies

Sections 1–19 of this Policy describe the App. This section applies to visitors of our website, shareeat.io, including this page. A fuller, standalone description of the website's data practices — including our website analytics — is available in our Website Privacy Notice.

20.1 Meta Pixel

Our website uses the Meta Pixel (Meta Platforms, Inc., United States), a piece of code that sets cookies and collects information about your visit — the pages you view, actions you take on the site (for example, tapping a button to contact us on WhatsApp), your IP address, and browser and device information — and shares it with Meta. We use this to measure the effectiveness of our advertising and to understand how visitors reach our site. Meta processes this data under its own privacy policy and may associate it with your Facebook or Instagram account if you have one.

You can limit or prevent this tracking by:

• Blocking or deleting cookies in your browser settings, or using a browser or extension that blocks trackers
• Adjusting your advertising preferences in your Meta account settings (Settings → Ad preferences), if you have a Meta account

20.2 Waitlist & Contact Forms

Some pages of our website include a waitlist or sign-up form hosted by Tally (Tally BV, Belgium). Information you enter into such a form (for example, your name, email address, phone number, or social media handles) is collected through Tally on our behalf and used only to contact you about Share Eat — for example, to invite you to join the App. Tally processes this data as our service provider under its own privacy and data-processing terms.

20.3 Contacting Us via Email or WhatsApp

If you contact us by email or through a WhatsApp link on our website, we receive the contact details and message content you choose to send. We use them to respond to your enquiry. WhatsApp is operated by Meta and is governed by its own terms and privacy policy.

The website does not otherwise collect personal data unless you actively provide it. For the avoidance of doubt: the App itself does not use the Meta Pixel or any advertising SDK — the statements in Section 13 about the App are unaffected by this section.

This Privacy Policy (Version 2.2) is effective as of 15 July 2026 and supersedes all previous versions.

Share Eat Sdn. Bhd. © 2026. All rights reserved.