Merchant Data Terms

Last updated: 13 June 2026

1. Roles

The merchant determines why and how customer order, fulfilment, payment-evidence, invoice, and communication data is used for its business. For that data, the merchant acts as data controller and Kedaiflow processes the data on the merchant's documented instructions to provide the service. Kedaiflow separately controls account, subscription, security, abuse-prevention, support, product analytics, and legal-compliance data for its own legitimate purposes.

2. Instructions and purpose

Kedaiflow may collect, store, organise, display, transmit, analyse, back up, and delete merchant-customer data only as needed to provide, secure, troubleshoot, and support the contracted storefront, order-management, notification, invoice, and optional AI functions, or as required by law.

3. Merchant obligations

The merchant must have a lawful basis for the data it submits, provide required notices to customers, limit collection to necessary data, keep account access secure, respond to customer requests, and avoid uploading unrelated identity, financial, or screen content.

4. Providers and transfers

Kedaiflow may use hosting, database, email, analytics, support, and optional model providers described in the Privacy Notice. Processing may occur in Malaysia, Singapore, and other disclosed provider locations. Kedaiflow will require appropriate contractual and security protections from providers where applicable.

5. Security and incidents

Kedaiflow applies access controls, encryption in transit, credential encryption where implemented, logging, and reasonable operational safeguards. Kedaiflow will notify the merchant without undue delay after confirming a personal-data breach affecting merchant-customer data and will provide available information needed for required notifications.

6. Retention and deletion

Data is retained while the account is active and for documented operational, security, dispute, accounting, and legal periods. Merchants should export required records before account deletion. Deletion from active systems may be followed by provider and backup expiry cycles, while records required by law or for disputes may be retained for the applicable period.

7. Assistance

Kedaiflow will provide reasonable assistance with access, correction, deletion, security, and regulator enquiries relating to data processed for the merchant. Contact hello@kedaiflow.com.