Privacy Policy

SmartMixedRice is a point-of-sale system for food stalls in Malaysia and Indonesia — a website, an Android app for merchants, and a self-order kiosk for customers, all talking to one backend. This policy covers all three.

Account & business information. When you register a stall: business name, your name, email, password (stored as a salted hash, never in plain text), and optionally a phone number. When you invite staff: their name and phone number — staff accounts use phone + one-time SMS code instead of a password.

Transaction data. Order line items, amounts, payment method (cash / DuitNow QR / other), and timestamps. We do not process card payments and never see card numbers — DuitNow QR payments are confirmed manually by your cashier, not through a payment gateway we operate.

Customer data you choose to enter. If you record a customer's phone number for loyalty points or receipt lookup, we store it linked to your stall only. This is data you control as the merchant — we process it on your behalf.

Camera images (AI tray pricing, optional feature). If you use the AI camera pricing tool, photos of the food tray are sent to our server to generate a price suggestion and may be kept afterward for human review and to improve the model. These are photos of food trays, not of people, and are tied to your business account, not to an individual customer's identity.

Device information. If you use the app, we record a device identifier, platform (Android), and app version so the "Devices" security feature can show you which devices are signed in and let you remotely sign one out if it's lost.

Standard server logs. IP address, request timestamps, and error logs — kept for security and debugging, the same as almost any web service.

To run the service you signed up for: authenticate you, record your sales, calculate your reports, send OTP codes so staff can join your team, and — only if you turn it on — suggest AI prices from a tray photo. We do not collect any data we don't use for one of these purposes.

Your business data is visible to the staff accounts you invite, scoped by the role you give them — a cashier cannot see reports a manager can, for example. Outside your business, only SmartMixedRice engineers can access data, and only to provide support or fix a bug. We do not sell your data or share it with third parties for advertising.

Two categories of data leave our own servers, strictly to deliver the service:

• Phone numbers, sent to our SMS provider solely to deliver a one-time login/join code.
• All data, hosted with our cloud infrastructure provider — they store it on our behalf and do not use it for their own purposes.

We keep your data for as long as your account is active. When you delete your account (see below), we remove the data that identifies you and keep the accounting rows in anonymised form, because transaction records carry a tax retention obligation. Concretely:

Deleted: your name, email, phone number and password; your customers' phone numbers and names; your payment QR together with the DuitNow ID and account name on it; your devices, login sessions and any unused staff invites; tray photos from the AI pricing feature; dish photos.

Kept, with nothing that identifies a person: transaction amounts and times, order items, the loyalty point ledger, and the branch/menu structure they belong to.

Deletion is immediate and cannot be undone. There is no recycle bin and no grace period.

Under Malaysia's PDPA 2010 (and Indonesia's PDP Law, UU 27/2022, for our Indonesian merchants), you can ask us what data we hold about you, ask us to correct it, or ask us to delete it.

You can delete your account yourself, and you do not need the app installed to do it: smartmixedrice.com/account/delete. The same option is in the app under Account. Before anything is deleted the page shows you exactly what will be removed and what will be kept.

你可以自己注销账号,不需要安装 app:smartmixedrice.com/account/delete。 app 内的入口在「账号」页。删除前页面会明确列出会删掉什么、会保留什么。

If you are the only owner of a business, deleting just your login would leave a shop nobody can manage — so in that case you either hand ownership to someone else first, or delete the whole business. The page tells you which applies to you.

For access or correction requests, email or WhatsApp us (below).

SmartMixedRice is a business tool for stall owners and their staff. It is not directed at children, and we don't knowingly collect data from anyone under 18 as an account holder.

Passwords are hashed, never stored in plain text. All traffic between the app/website and our servers is encrypted (HTTPS). Access to your business data is controlled by login + role-based permissions, and you can remotely sign out a lost device from the app's Devices page.

If we change what we collect or how we use it, we'll update this page and change the effective date above. For material changes, we'll also message registered stall owners directly.

Questions, or want to access/correct/delete your data: