Privacy Policy

Last updated: 25 July 2026

This Privacy Policy explains how Hoseh Technology ("Hoseh Seller", "we", "us", or "our"), a business registered in Malaysia (SSM), collects, uses, and protects personal data when you use the Hoseh Seller service at seller.hoseh.app ("the Service"). It is written to align with Malaysia's Personal Data Protection Act 2010 (PDPA), as amended. Hoseh Seller currently serves sellers in Malaysia; we expect to support additional Southeast-Asian markets over time and will update this policy accordingly.

Hoseh Seller is a seller-side analytics tool: you connect your own marketplace shops (Shopee, Lazada, TikTok Shop) and we show you your true profit. We only ever process the connecting seller's own store data, solely to show analytics back to that seller. This policy should be read together with our Data Protection & Security page.

You give your consent to the processing described here by ticking the acceptance box when you register, and again when you authorise each shop connection. We record which version you accepted and when. See section 5, Legal Basis & Consent, for how to withdraw it.

1. Who We Are

Hoseh Technology is the data controller for the personal data described in this policy. We are registered in Malaysia (SSM). You can reach us at hello@hoseh.app for any privacy matter.

2. Information We Collect

• Account information: your name, email address, and contact details when you register for or contact Hoseh Seller.
• Connected-shop data (your own store): for each shop you connect, your own order, product/item, finance/payment-fee, and (where available) logistics data, accessed via the marketplace's official API under your authorisation. This is your business data and may include limited buyer-related fields contained in order records; Hoseh Seller does not require or display buyer personal information (names, addresses, phone numbers) to provide its analytics.
• Seller-provided inputs: figures you add yourself, such as product costs (COGS), used to compute profit.
• Usage data: how you interact with the app (pages visited, features used, session duration).
• Device and technical data: IP address, browser type, operating system, and device identifiers collected automatically.

3. Marketplace Access Is Read-Only and Revocable

Hoseh Seller accesses your connected-shop data only with your explicit authorisation, through each marketplace's official OAuth flow (Shopee Open Platform, Lazada Open Platform, TikTok Shop Open Platform). We request read-only scopes and the minimum data necessary. Hoseh Seller cannot make changes to your store.

You may revoke Hoseh Seller's access at any time through the marketplace's Seller Centre / app-authorisation settings, or by contacting us. On revocation we stop syncing, and all synced marketplace data for that shop is deleted immediately, and in any event within 14 days (see Retention).

4. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service — computing and displaying your own profit analytics back to you.
• Maintain your account and send you service notifications and support communications.
• Maintain security, and detect, prevent, and address fraud or technical issues.
• Improve the Service using usage data and aggregated, anonymised information.
• Comply with legal obligations and respond to lawful requests.

We never use one seller's data to serve another seller, and we never use connected-shop data to build cross-seller datasets, market benchmarks, or competitor comparisons.

5. Legal Basis & Consent

We process personal data on the basis of your consent (given when you register and when you authorise a shop connection) and, where applicable, to perform our agreement with you and to meet legal obligations. You may withdraw consent at any time by disconnecting your shops, closing your account, or contacting us; withdrawing consent does not affect processing already carried out.

6. We Do Not Sell or Share Your Data

We do not sell, rent, or trade your personal data or your store data. We share data only with the limited sub-processors needed to run the Service, and only as required by law:

• Sub-processors: a small number of trusted providers that process data only on our behalf, under data-protection terms, and never for their own purposes:
  • Database, authentication, and server hosting — stores your account and analytics data and runs our server functions
  • AI text generation — Google (Gemini API) — turns figures we have already calculated into plain language. We name this provider specifically because it is the one that receives your figures to generate text; see section 7
  • Error and performance monitoring — helps us detect and fix faults
  • Transactional email — sends account and team-invitation emails
  • Website hosting — serves our public website
  The current list of named providers is available to you on request — email hello@hoseh.app. We will give notice before adding or replacing a sub-processor, so you can object on reasonable data-protection grounds.
• Legal requirements: where required by applicable law, court order, or a governmental authority.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to you and continued protection of your data.

7. AI-Assisted Features

Some features — the plain-language insight summaries and the in-app assistant — use a third-party AI provider (Google, via the Gemini API) to put figures we have already calculated into words. The AI never calculates your numbers and never makes decisions for you. The figures shown in the app are the source of truth, and AI-generated text is labelled as such in the app.

What we send: your own summary figures — revenue, profit, margin, fee and cost breakdowns, and return and stock counts — and, for the assistant, the names of your own products where your question relates to them. We do not send buyer names, contact details or addresses, order IDs, SKU codes, or raw order records. An automated check runs before every request and blocks it entirely if personal data is detected.

If you type your own question in the assistant, that question text is sent to the AI provider so it can be answered. Please do not include personal or customer details in your question — the app shows this reminder above the question box. Questions containing an email address are refused and never sent.

The provider processes this data to return your answer, and is engaged as a sub-processor. Hoseh Seller is currently in pre-launch testing and the AI features run on the provider's standard tier, under which submitted text may also be used to improve the provider's own services. Before we process any real marketplace data we will move to the provider's paid tier, under which submitted content is not used to train its models, and we will update this policy. In the meantime, please don't enter confidential information into the assistant.

If you would prefer not to use these features, simply don't open the AI summary or the assistant — the rest of the app works without them.

8. International Transfers

Where data is processed or stored outside your country by a sub-processor (for example, a cloud region), we take steps to ensure it remains protected to a standard consistent with the Malaysia PDPA 2010, including contractual data-protection terms with our providers.

9. Data Retention

Buyer personal data (names, addresses, phone numbers, messages) is removed before anything is stored — we don't need it to calculate your profit.

The raw data we receive from a marketplace is deleted after 90 days. What remains after that is your own calculated figures — revenue, costs, fees, and profit per order — which we keep for as long as your shop stays connected and your account is active, so we can show you long-term trends. This is subject to each marketplace's developer terms and to applicable law.

Tax-turnover records are monthly totals for your business, containing no buyer or order-level detail. We keep these until you delete your account, so your rolling 12-month threshold tracking stays accurate.

When you disconnect a shop we delete that shop's synced marketplace data immediately, and in any event within 14 days. You can delete your account at any time to erase all of your data. Full details are on our Data Protection & Security page.

10. Security

We protect data with encryption in transit (TLS 1.2+) and at rest, server-side storage of API keys and secrets, per-seller access isolation, access controls and logging, and an incident-response process. No method of transmission or storage is 100% secure, but we take reasonable steps to protect your information.

11. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your personal data.
• Withdraw consent and disconnect your shops at any time.
• Restrict or object to certain processing, and request portability of your data in a machine-readable format.

To exercise any of these rights, email hello@hoseh.app. We respond to verified requests within the timeframes required by applicable law.

12. Cookies & Analytics

We use only the cookies necessary to operate the Service (such as keeping you signed in) and, where used, privacy-respecting analytics to understand usage. You can control cookies through your browser; disabling essential cookies may affect functionality.

13. Children's Privacy

The Service is intended for business sellers and is not directed to individuals under 18. We do not knowingly collect personal data from minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes by email and update the "Last updated" date above. Continued use of the Service after changes constitutes acceptance of the revised policy.

15. Contact Us

• Email: hello@hoseh.app
• Business: Hoseh Technology (registered in Malaysia, SSM)
• Website: seller.hoseh.app