Legal

Privacy Policy

Last updated: [DATE] · Effective: [DATE]

This policy explains what personal data BlissPOP collects, why, and the choices you have. We aim to handle the photos and wishes you share with care.

Important: This is a working draft for review. Have it checked by a qualified Malaysian legal advisor (the Personal Data Protection Act 2010 applies) before you publish it as your official policy.

On this page

Who we are
What we collect
How we use it
Guest photos & wishes
Who we share with
How long we keep it
Your rights
Security
Children
Changes
Contact

1. Who we are

BlissPOP ("BlissPOP", "we", "us") is a service operated by [COMPANY NAME] (SSM No. [REGISTRATION NUMBER]), a company registered in Malaysia. We are the data controller responsible for the personal data described in this policy.

2. What personal data we collect

We collect the following, depending on how you use BlissPOP:

If you create a Host Account

Account data — your email address and password (passwords are stored in encrypted form by our authentication provider; we never see them in plain text).
Usage data — the Bliss Moments you create, their titles, occasions, validity dates, and credit balance.
Payment data — top-up amount and date. Card and e-wallet details are entered with our payment provider, not stored by us.

If you are a guest sending a wish

Your name (as you type it), a selfie photo you choose to upload, and your wish message and selected vibe.

Automatically

Basic technical data such as device and browser type, and approximate timing of actions, used to keep the service working and secure.

3. How we use your data

To create and run your Bliss Moments and show wishes in the final reveal.
To manage your account, credits and top-ups.
To provide support and respond to your messages.
To keep the service secure and prevent misuse.
To meet legal and accounting obligations.

We do not sell your personal data, and we do not use guest photos for advertising.

4. Guest photos & wishes

When a guest submits a selfie and wish through a Moment link, that content is shown to the people who open that Bliss Moment (the Host and others who have the link). By submitting, the guest agrees to their photo, name and message being displayed within that Bliss Moment.

If you are a guest and want your submission removed, contact the Host who shared the link, or email us at support@blisspop.app and we will help remove it.

We share data only with service providers that help us run BlissPOP, under agreements that require them to protect it:

Hosting & database / file storage — our backend and image storage provider, used to store accounts, Bliss Moments and uploaded photos.
Payment processing — our payment provider, used to process top-ups. They handle your payment details under their own privacy terms.

Some providers may process data outside Malaysia. Where that happens, we take steps intended to keep your data protected to a comparable standard. We may also disclose data if required by law.

6. How long we keep it

Account data — kept while your account is active. You can ask us to delete your account.
Bliss Moments and guest content — kept while the Bliss Moment is active. After a Bliss Moment expires, its content may be deleted in line with our retention practices.
Payment records — kept as long as needed for accounting and legal obligations.

Confirm these retention periods match what your system actually does (e.g. when expired Bliss Moment photos are deleted from storage), and state specific timeframes here before publishing.

7. Your rights

Under the Personal Data Protection Act 2010 (Malaysia), you may, subject to conditions:

Request access to the personal data we hold about you.
Request correction of inaccurate data.
Withdraw consent or limit how we process your data.
Request deletion of your account and associated data.

To exercise any of these, email support@blisspop.app. We may need to verify your identity first.

8. Security

We use reasonable technical and organisational measures to protect your data, including encrypted connections and access controls. No online service can be completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly to any issues.

9. Children

BlissPOP is intended for users aged 18 and over. If you believe a child has provided us personal data without appropriate consent, contact us and we will take appropriate steps.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "Last updated" date. Significant changes may be communicated to account holders.

11. Contact us

Questions about this policy or your data? Email support@blisspop.app or see our contact page.