Privacy Policy

This Privacy Policy explains what personal data UniSell Enterprise (“UniSell”, “we”, “us”), a business registered in Malaysia (registration no. 202603184025 (AS0518279-W)) and run from Kuala Lumpur, collects when you use UniSell, why, who can see it, how long we keep it, and the rights you have over it under Malaysia’s Personal Data Protection Act 2010 (“PDPA”). It should be read together with our Terms and Conditions.

1. Identity verification (your ID and selfie)

To buy, sell or message on UniSell you verify your identity by uploading a photo of your student ID and a selfie of you holding it. This is optional, but without it you can only browse. We handle these with particular care:

• They are used only for UniSell verification— to check that the person on the ID is the person in the selfie. They are never used for anything else, never shown publicly, and never shared with or sold to anyone.
• Only UniSell’s admins can see them— today that is only the UniSell founder, who reviews every verification. Nobody outside UniSell can view them, and other users never see them. They are kept in private storage with no public link.
• They are deleted once your verification is reviewed. As soon as your verification is approved, your ID photo and selfie are permanently deleted. If it is rejected, they are deleted too, and you can submit new photos. After deletion we keep only the record of the review: the outcome (approved or rejected), when it was submitted and reviewed, who reviewed it, and any note left. Only whether you are verified is shown to other users.

2. Other information we collect

• Account details: your email address (Gmail or iCloud), the university you choose when you sign up (we check it against your student ID when you verify), username, display name, and password (stored securely; we can’t see it).
• Profile details you choose to add: your village, course and birthday.
• What you post: listings and their photos, food store menus, event posters and details, and reviews. These are shown publicly on UniSell, as that’s their purpose.
• Messages between you and other users, stored so the conversation is there when you come back.
• Event tickets: when you buy a ticket, the attendee’s name, phone number, and student ID or age. The event’s organiser sees these on their door list so they can check people in.
• Food orders: what you ordered and any note you add for the store, which the store owner sees.
• Your phone number, which we ask for when you buy an item or order food. When you pay, we email the seller (or the store owner) your display name, your account email address and your phone number, so they can reach you to arrange the handover. Your phone number isn’t shown anywhere else on UniSell. (The other person on an order can already see your account email on the order page.)
• Orders and payments: what you bought or sold, amounts, fees, order status and payment references, and the order emails we send you about them (receipts, sale and refund notices). Card and bank login details are entered on BillPlz’s page, not ours, and UniSell never sees or stores them.
• Wallet withdrawals: the bank name, account number and account holder name you give us to pay out your earnings.
• Early-access waitlist: your email address, if you joined it.
• Technical data: like any website, our hosting and login providers record IP addresses, browser details and the time of requests, for security and to keep the service running. We also record when you accepted our Terms.
• On your device: things like your login session, your day/night setting and an unsent listing draft are kept in your browser’s storage. We don’t use advertising or tracking cookies, or analytics.

3. Why we use it

We use your data to run UniSell: to create and secure your account, verify that you’re a real student, show your listings and profile, let you message and trade with other students, hold payments until a handover is confirmed, pay out your wallet, prevent fraud and misuse, and send you emails about your account and orders. We don’t sell your data or use it for advertising.

4. Who else handles it

A few service providers process data on our behalf, only as needed to run UniSell:

• Supabase — our database and file storage (including the private storage your ID photos sit in until they’re deleted). It is stored in Singapore.
• Vercel — hosts the website.
• BillPlz — processes payments.
• Resend — sends our emails. We may also email you directly from our own Google (Gmail) account.
• Sentry — tells us when something on UniSell breaks, with technical details such as the page, your browser and the error, so we can fix it. It is set not to collect your IP address or cookies.

Some of these providers store or process data on servers outside Malaysia. By using UniSell you consent to that transfer, and we only use providers that protect the data to a standard comparable to the PDPA. Other users see what you publish (your listings, profile, reviews), the messages you send them, and what a trade needs: sellers and food stores see who bought from them, and event organisers see the attendee details given for their event. We will disclose personal data to authorities only where Malaysian law requires it.

5. How long we keep it

ID photos and selfies are deleted as soon as your verification is reviewed (Section 1). Everything else is kept for as long as your account is open. If you ask us to close your account, we delete or anonymise your personal data, except records we are legally required to keep (such as transaction and payout records for accounting), which we keep only as long as the law requires.

6. Your rights

Under the PDPA you can ask to see the personal data we hold about you, ask us to correct it, withdraw your consent (which may mean closing your account), or ask us to delete your account and data. Most profile details can be edited yourself in Settings. For anything else, email us and we’ll respond within 21 days.

7. Keeping it safe

We keep ID documents in private storage, restrict access to them to the verification reviewer, encrypt data in transit, and limit what each part of UniSell can read. No system is perfectly secure; if a breach ever affects your data, we will tell you and the relevant authorities as the law requires.

8. Changes to this policy

If we change how we handle your data, we’ll update this page and its date, and tell you by email or on UniSell if the change is significant.

9. Contact

Questions, requests or complaints about your personal data can be sent to contact@unisell.my.