Privacy Policy

This policy explains what personal data BestByLocals collects, why, and what you can do about it. We collect as little as we can.

Who is responsible

[COMPANY LEGAL NAME], registered in Malaysia (registration no. [●]) ("we"). Contact for privacy questions: support@getbestbylocals.com. [LEGAL REVIEW: address disclosure — the business address is deliberately not published on this site (Founder, 4 Oct 2026); confirm whether the PDPA notice or GDPR art. 13 requires a postal address and how to provide it.] [LEGAL REVIEW: confirm whether we must appoint a Data Protection Officer under the Personal Data Protection (Amendment) Act 2024, and whether we need an EU/UK representative under GDPR art. 27 / UK GDPR.]

What we collect

When you browse this website

• We do not use analytics or advertising. The only tracking is partner (affiliate) and campaign attribution, described below — and the affiliate cookie only with your permission.

• Our hosting provider, Cloudflare, processes technical data such as your IP address, browser type and the pages requested, to deliver the site and protect it from abuse. [LEGAL REVIEW: confirm retention per our Cloudflare plan.]

• Referral and campaign details. If your link contains a partner ID (aff) or campaign tags (utm_*), we keep them in your browser for this tab only and pass them to Lemon Squeezy with your order, so we know where the order came from and can credit the partner. If you allow the affiliate cookie, they are kept for 30 days instead. See the Cookie notice.

• Affiliate cookie (only with your permission). If you arrive through a partner's link we ask before setting Lemon Squeezy's affiliate cookie. If you click Allow, Lemon Squeezy's affiliate script records the visit with an anonymous device identifier and sets the ls_aff_ref cookie. If you click No thanks, it isn't loaded. We remember your choice for 30 days.

• Lemon Squeezy's script (lemon.js) loads on every page, so Lemon Squeezy receives your IP address and browser details when you visit. [LEGAL REVIEW]

What you must give us. Your name and email address are needed to deliver a guide you buy (and your email to confirm a waitlist sign-up). Everything else is optional. [LEGAL REVIEW: PDPA s.7 — obligatory vs voluntary data.]

When you buy a guide

Payment happens on Lemon Squeezy (Lemon Squeezy LLC, USA), our merchant of record. Lemon Squeezy collects your payment and billing details under its own privacy policy; we never see your full card details. Lemon Squeezy shares with us:

• your name and email address;
• your order number, the guide you bought and the price;
• your country (for tax);
• what you entered at checkout: destination, tier, start date and time, language, and your three tick-box confirmations (data/Wi-Fi, EU/UK withdrawal waiver, 18 or older);
• any discount code you used, and the affiliate ID and campaign tags you arrived with (if any).

When you join a waitlist

For a destination that isn't on sale yet you can leave your email address. We store your email address, the destination, your language, whether you ticked the optional box for news and offers (it is unticked unless you tick it), your confirmation that you are 18 or older, and a record of each consent: the exact wording you were shown, the form version, the date and time, and a scrambled (hashed) form of your IP address — never the IP address itself. We first send one email asking you to confirm your address; nothing else is sent unless you confirm. Every email has an unsubscribe link. [LEGAL REVIEW]

When you email us

Your email address and whatever you write to us.

Why we use it (and our legal basis)

Purpose	Data	Legal basis (EU/UK)
Send your guide at the right time and keep your link working for your access window	Email, order details, start date/time	Performance of our contract with you
Handle cancellations, refunds and support	Email, order details, messages	Contract; legitimate interests
Keep business and tax records	Order details	Legal obligation
Keep the website secure	Technical data	Legitimate interests
Affiliate cookie and 30-day storage of partner/campaign details	Affiliate click ID, device identifier, partner ID, campaign tags	Consent ("Allow"), which you can refuse ("No thanks") [LEGAL REVIEW]
Record which partner or campaign an order came from (this tab only)	Partner ID, campaign tags, order details	Legitimate interests [LEGAL REVIEW]
Waitlist: tell you when a destination opens (after you confirm your email)	Email, destination, language, consent record	Consent, which you can withdraw at any time (unsubscribe link) [LEGAL REVIEW]
News and offers (only if you ticked the optional box and confirmed)	Email, language, consent record	Consent, which you can withdraw at any time [LEGAL REVIEW]
Prove what you agreed to	Consent record (wording, form version, time, hashed IP)	Legal obligation; legitimate interests [LEGAL REVIEW]

We don't sell your data, use it for advertising, or send marketing emails unless you separately opt in. Emails about your order — the confirmation, your guide link, a start-date change — are service messages, not marketing. [LEGAL REVIEW]

Under Malaysia's Personal Data Protection Act 2010 (as amended in 2024), we process your data only for these purposes, and this policy is our written notice to you. The notice is also published in Bahasa Malaysia: Notis Privasi (Bahasa Malaysia). [LEGAL REVIEW]

Who we share it with

Only service providers that help us run the service, under contract:

• Lemon Squeezy — payments, tax, receipts and refunds (merchant of record), and our affiliate programme.
• Affiliates see that a sale was credited to them and its value; they don't receive your name or email. [LEGAL REVIEW: confirm against Lemon Squeezy's affiliate dashboard.]
• Cloudflare — website hosting and security.
• Resend — sending our emails (order confirmation, your guide link, waitlist confirmation). [LEGAL REVIEW]

Some of these providers process data outside Malaysia and outside your country, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses. [LEGAL REVIEW]

How long we keep it

• Order records: 7 years, to meet Malaysian accounting and tax record-keeping requirements. [LEGAL REVIEW]
• Support emails: up to 2 years after the conversation ends. [LEGAL REVIEW]
• Waitlist sign-ups: if you don't confirm your email, your sign-up is deleted after 30 days. Confirmed sign-ups are kept until you unsubscribe. When you unsubscribe (or an unconfirmed sign-up is deleted), we delete your email address and keep only the record of your consent, with your email address replaced by a scrambled (hashed) value, so we can show what was agreed if you ask. [LEGAL REVIEW]
• Your guide link stops working at the end of your access window; any copy saved on your phone for signal gaps deletes itself at the same time.

Your rights

You can ask us to access, correct or delete your data, or to limit or object to how we use it. EU/UK residents can also ask for data portability and complain to their local data protection authority; Malaysian residents can complain to the Personal Data Protection Commissioner. Email support@getbestbylocals.com — we'll reply within one month (within 21 days for requests under Malaysia's PDPA). [LEGAL REVIEW: align timelines with the PDPA and GDPR.]

Security

We use reasonable technical and organisational measures to protect your data against unauthorised access, loss or misuse — for example, guide links are signed and expire, and we store only a scrambled form of IP addresses for consent records. No system is completely secure.

Data breaches

If a breach of personal data puts you at risk, we'll contain and assess it and, where the law requires, tell you and the relevant authority within the legal deadline (under the EU/UK GDPR, where feasible within 72 hours of becoming aware of it). [LEGAL REVIEW: finalise an incident-response procedure before launch; PDPA (Amendment) Act 2024 breach-notification timelines.]

Children

Our guides are sold to adults. We don't knowingly collect data from children.

Changes

If we change this policy we'll update the date at the top of this page.