Privacy Policy

This policy covers mangalyam.my and is written to meet the Malaysian Personal Data Protection Act 2010 (PDPA). The data user is Art Engine My Solutions (Registration No. 202103086214), which trades as Mangalyam.my.

Two different people appear in this policy and they are treated differently: the host, who buys an invitation and builds it, and the guest, who opens the link the host sends them. A guest never has an account with us and did not choose us — the host did — so we hold as little about them as the product allows.

What we collect from hosts

• Your account. Email address, a password (stored only as a bcrypt hash — we cannot read it, and neither can anyone who obtains the database), optionally your name, and the date you signed up.
• What you put in the invitation. The names of whoever is celebrating, the occasion, dates and times, venue name and address, your schedule, your message to guests, and a contact name and phone number if you add one.
• Photographs you upload. Cover photo and gallery images. Every upload is re-encoded on arrival, which strips the embedded camera metadata — including GPS coordinates — before it is stored. We do that whether or not you ask.
• Gift details, if you switch them on. Bank name, account holder name, account number and any payment QR image you upload. Read the warning under “What is public” below before you use this.
• Payment records. The amount, the currency, whether it succeeded, and the reference our payment processor gives us. We never see or store your card number, CVV or banking credentials — those go straight to the processor and never touch our servers.

What we collect from guests

Only what a guest types into the reply form: their name, whether they are coming, how many people they are bringing, a meal preference if the host asked for one, and a message if they leave one.

We do not ask a guest for an email address, we do not track them across the web, and we do not build a profile of them. Opening an invitation does not create an account or a record.

What is public

A published invitation is a web page at an unlisted address. Anyone holding the link can open it — which is the point, because that link gets forwarded around family groups. It is unlisted, not private, and we ask search engines not to index it, but you should treat anything on the page as visible to anyone the link reaches.

On that page, these are public:

• The names, occasion, date, venue and address you entered.
• Your photographs.
• The contact name and phone number you chose to show guests.
• Guest names and their messages, if a guest leaves one — a guest is told this next to the field before they type.
• Your gift and bank details, if you switched that section on. This is the one to think hardest about: an account number on a link that travels through WhatsApp groups is an account number a great many people can copy. The editor says so at the point you enter it.

These are never public: who is attending, how many they are bringing, and what they eat. That is the host’s list, and the public page is built so it cannot be read off it, even by counting.

Why we hold it

• To provide what you bought — build the invitation, publish it, show it to your guests, collect the replies.
• To take payment and keep the record of it, which we are also required to keep for tax purposes.
• To support you when you write to us about your own account.

We do not sell personal data. We do not share it with advertisers. We do not use it to train anything. There is no advertising on mangalyam.my.

Who else sees it

Three kinds of third party, and no others:

• Our payment processor handles the card or online banking transaction. You are on their page when you pay; they send us back only whether it worked and a reference.
• Our hosting and storage provider runs the servers the site and your uploaded images sit on.
• Anyone we are legally required to disclose to — a court order, or a lawful request from a Malaysian authority.

Your data may be stored or processed outside Malaysia by those providers. By using the service you consent to that transfer, which the PDPA permits where it is necessary to perform the contract you have with us.

Cookies

We set one cookie, and only after you sign in: it keeps you signed in as you move between pages. There are no analytics cookies, no advertising cookies and no third-party trackers on this site. Fonts are served from our own servers rather than fetched from Google, so reading a page here does not tell anyone else that you did.

The invitation builder also keeps an unfinished draft in your own browser’s local storage so you do not lose it on a refresh. That stays on your device until the invitation is saved to an account or you clear it.

How long we keep it

• While your account exists, we keep your account and your invitations, because you may want to look at them again — people come back to an invitation years later.
• Delete an invitation and its photographs and its replies go with it.
• Ask us to close your account and we delete everything within 30 days, except payment records, which we keep for seven years because Malaysian tax law requires it.

Your rights under the PDPA

You can ask us, at any time, to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong or out of date;
• delete your account and the data in it;
• stop processing your data, or withdraw a consent you gave us — though if you withdraw the consent we need to run the service, we will not be able to keep your invitation online.

Email us and we will answer within 21 days, which is the period the PDPA sets. We may ask you to confirm who you are first, which is a protection for you rather than an obstacle.

If you are a guest and a host has published your name or your message on an invitation, ask the host first — they can edit or remove it themselves, immediately. If they will not, write to us and we will remove it.

Security, honestly stated

Passwords are hashed, uploads are stripped of camera metadata and re-encoded, every request for something you own is checked against your account before it is answered, and payment credentials never reach us. No one can promise a system is unbreakable, and we are not going to. What we can tell you is what we hold and how little of it there is, which is on this page.

Children

The service is not for under-18s to buy. Invitations frequently celebrate children — a naming ceremony, a first birthday — and a parent who publishes their own child’s name and photograph is making that decision for their family, as they would with a printed card.

Changes

If we change this policy we will change the date at the top. If the change is significant — new categories of data, a new class of recipient — we will email account holders rather than rely on you noticing.