Sabah Business Hub · First Step Creatives
Privacy Policy
Dasar Privasi
Last updated / Kemaskini terakhir: 22 October 2026
What changed on 22 October 2026: Reddit is added to the social media where owners can choose to have their business featured (section 3). On 21 October 2026, owners could first choose to be featured. Before that, on 18 October 2026, we added what we keep when you report a listing (sections 2, 3 and 6), business suggestions (sections 2 and 6) and the referral cookie (section 11).
Perubahan pada 22 Oktober 2026: Reddit ditambah ke media sosial di mana pemilik boleh memilih untuk ditampilkan (bahagian 3). Pada 21 Oktober 2026: pemilik kini boleh memilih untuk perniagaan mereka ditampilkan di media sosial kami (bahagian 3). Pada 18 Oktober 2026: kami menambah data yang kami simpan apabila anda melaporkan sesuatu penyenaraian (bahagian 2, 3 dan 6), cadangan perniagaan (bahagian 2 dan 6) dan kuki rujukan (bahagian 11).
What changed on 17 October 2026: we added session recordings (section 11) and changed how we tell you about future updates to this policy (section 13). Both take effect on 31 October 2026.
Perubahan pada 17 Oktober 2026: kami menambah rakaman sesi (bahagian 11) dan mengubah cara kami memaklumkan kemas kini dasar ini pada masa hadapan (bahagian 13). Kedua-duanya berkuat kuasa pada 31 Oktober 2026.
1. Who we are1. Siapa kami
Sabah Business Hub is operated by First Step Creatives (SSM Registration No. 003519412-V). For any enquiries regarding your personal data, contact us at support@firststepcreatives.com.
Sabah Business Hub dikendalikan oleh First Step Creatives (No. Pendaftaran SSM 003519412-V). Untuk sebarang pertanyaan mengenai data peribadi anda, hubungi kami di support@firststepcreatives.com.
2. What personal data we collect and its source2. Data peribadi yang kami kumpul dan sumbernya
We collect the following categories of personal data:
| Category | Data collected | Source | Required? |
|---|---|---|---|
| Account | Email address, full name, phone number, preferred language, account type | Directly from you | Email: required. Others: optional |
| Business listing | Business name, address, category, description, phone, hours, photos | OpenStreetMap (seeded listings); directly from you (claimed listings) | Required for listing |
| Verification documents | SSM registration certificate, business licence, utility bill | Directly from you | Required for Verified status |
| Payment | Payment card details, billing information | Stripe (payment processor) | Required for paid subscriptions |
| Business suggestions | Your email address (optional) when you suggest a business for us to list | Directly from you | Optional, only to tell you when it's listed |
| Listing reports | Your email address and what you tell us when you report a listing | Directly from you | Only if you report a listing |
| Usage | Pages viewed, features used, IP address, device type, browser, and session recordings (clicks, scrolls and what appears on screen, with typing hidden) | Automatically via analytics | Automatic (opt-out available) |
Kami mengumpul kategori data peribadi berikut: data akaun (emel, nama, telefon, bahasa pilihan, jenis akaun), data penyenaraian perniagaan, dokumen pengesahan (sijil SSM, lesen perniagaan, bil utiliti), data pembayaran (melalui Stripe), data laporan penyenaraian (emel anda dan butiran laporan, hanya jika anda melaporkan sesuatu penyenaraian), dan data penggunaan (halaman dilawati, ciri digunakan, alamat IP, jenis peranti). Sila rujuk jadual di atas untuk butiran penuh.
We do not collect copies of your identity card (IC), passport, or any government-issued personal identification document.
Kami tidak mengumpul salinan kad pengenalan (IC), pasport, atau sebarang dokumen pengenalan diri yang dikeluarkan kerajaan.
3. Why we collect your data3. Mengapa kami mengumpul data anda
We process your personal data for the following purposes:
- Providing the directory service — displaying business listings, enabling search, and connecting users with businesses in Sabah.
- Account management — creating and managing your account, authenticating your identity via magic-link sign-in.
- Business verification — reviewing your submitted documents to verify your association with a listed business before awarding the Verified badge.
- Payment processing — processing Verified Badge subscription payments through Stripe. We do not store your full payment card details on our servers.
- Analytics and improvement — understanding how the platform is used so we can improve it, and providing business owners with aggregated visitor statistics for their listings.
- Handling reports about listings — if you report a listing, we use your email to confirm the report, look into it and let you know when we have. We never share your email or identity with the business you reported.
- Service communications — sending you important notices about your account, verification status, subscription, or changes to our terms.
- Featuring your business on social media (only if you agree) — if you switch on “Feature my business” in Settings, we may post your listing's public details (business name, what you do, area, photo and a link) on Sabah Hub's Instagram, Threads, Facebook, X and Reddit. It's off unless you switch it on, and you can switch it off any time; ask us and we'll remove posts already made.
We will not use your personal data for purposes other than those listed above without your prior consent.
Kami memproses data peribadi anda untuk tujuan berikut: menyediakan perkhidmatan direktori, pengurusan akaun, pengesahan perniagaan, pemprosesan pembayaran melalui Stripe, analitik dan penambahbaikan, mengendalikan laporan tentang penyenaraian (emel pelapor tidak pernah dikongsi dengan perniagaan), komunikasi perkhidmatan, dan (hanya jika anda bersetuju dalam Tetapan) menampilkan maklumat awam penyenaraian anda di Instagram, Threads, Facebook, X dan Reddit Sabah Hub. Kami tidak akan menggunakan data peribadi anda untuk tujuan lain tanpa persetujuan anda terlebih dahulu.
4. Who we share your data with4. Dengan siapa kami berkongsi data anda
We share your personal data with the following categories of third-party service providers, solely to operate the platform:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Database hosting, file storage, authentication | Singapore |
| Vercel | Website hosting and delivery | Global (edge network) |
| Stripe | Payment processing | United States |
| PostHog | Analytics and session recordings | European Union |
| Resend | Transactional email delivery + open/click tracking | Asia Pacific (Tokyo) |
We do not sell, rent, or trade your personal data to any third party. We do not share your verification documents with anyone other than our internal verification team.
Kami berkongsi data peribadi anda dengan penyedia perkhidmatan pihak ketiga berikut semata-mata untuk mengendalikan platform: Supabase (pangkalan data, Singapura), Vercel (pengehosan laman web, global), Stripe (pembayaran, Amerika Syarikat), PostHog (analitik, Kesatuan Eropah), dan Resend (penghantaran e-mel dan penjejakan buka/klik, Tokyo). Kami tidak menjual, menyewa, atau memperdagangkan data peribadi anda kepada mana-mana pihak ketiga.
5. Cross-border data transfer5. Pemindahan data merentas sempadan
Your personal data is stored on servers located in Singapore (Supabase) and may be processed in the European Union (PostHog), the United States (Stripe, Vercel), and Japan / Tokyo (Resend, email delivery + open/click tracking).
By using Sabah Business Hub and providing your personal data, you consent to the transfer of your personal data to these locations under Section 129(3) of the Personal Data Protection Act 2010 (as amended). Each of these service providers maintains data protection standards that are at least equivalent to the protection afforded under the PDPA.
Data peribadi anda disimpan di pelayan yang terletak di Singapura (Supabase) dan mungkin diproses di Kesatuan Eropah (PostHog), Amerika Syarikat (Stripe, Vercel), dan Jepun / Tokyo (Resend, penghantaran e-mel dan penjejakan). Dengan menggunakan Sabah Business Hub dan memberikan data peribadi anda, anda bersetuju dengan pemindahan data peribadi anda ke lokasi-lokasi ini di bawah Seksyen 129(3) Akta Perlindungan Data Peribadi 2010 (seperti yang dipinda).
6. How long we keep your data6. Berapa lama kami menyimpan data anda
| Data type | Retention period |
|---|---|
| Account data | While your account is active, plus 12 months after deletion |
| Business listing data | While the listing is active on the platform |
| Verification documents | Up to 2 years after verification approval, then permanently deleted |
| Rejected verification documents | Deleted within 30 days of rejection |
| Payment records | Retained by Stripe per their retention policy; we store only transaction references |
| Analytics / usage data | Anonymised after 24 months |
| Business suggestions | Deleted after 12 months |
| Listing reports (your email and report) | Unconfirmed reports deleted after 7 days; confirmed reports deleted after 12 months |
| Session recordings | Deleted automatically after 30 days |
When data is no longer needed for the purpose it was collected, we delete or anonymise it. We do not retain personal data indefinitely.
Apabila data tidak lagi diperlukan untuk tujuan ia dikumpulkan, kami akan memadamkan atau menjadikannya tanpa nama. Dokumen pengesahan yang diluluskan dipadamkan secara kekal selepas 2 tahun. Dokumen yang ditolak dipadamkan dalam masa 30 hari. Kami tidak menyimpan data peribadi selama-lamanya.
7. Your rights7. Hak anda
Under the Personal Data Protection Act 2010 (as amended), you have the following rights:
- Right of access — You may request a copy of the personal data we hold about you.
- Right of correction — You may request that we correct any inaccurate or incomplete personal data.
- Right to withdraw consent — You may withdraw your consent to our processing of your personal data at any time. If you withdraw consent for verification document processing, your Verified badge will be revoked. If you withdraw consent for analytics, we will stop collecting usage data from your sessions.
- Right to complain — You may lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your data has been mishandled.
To exercise any of these rights, email us at support@firststepcreatives.com. We will respond within 21 days of receiving your request.
Personal Data Protection Commissioner / Pesuruhjaya Perlindungan Data Peribadi: www.pdp.gov.my
Di bawah Akta Perlindungan Data Peribadi 2010 (seperti yang dipinda), anda mempunyai hak berikut: hak akses, hak pembetulan, hak menarik balik persetujuan, dan hak untuk membuat aduan kepada Pesuruhjaya Perlindungan Data Peribadi Malaysia. Untuk melaksanakan mana-mana hak ini, emelkan kami di support@firststepcreatives.com. Kami akan membalas dalam masa 21 hari dari penerimaan permintaan anda.
8. How we protect your data8. Bagaimana kami melindungi data anda
We implement appropriate technical and organisational measures to protect your personal data, including:
- All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
- Data stored in our database is encrypted at rest.
- Verification documents are stored in private, access-controlled storage — accessible only to you and our verification team.
- Database access is controlled through row-level security policies that prevent unauthorised access to other users' data.
- We do not store your full payment card details — these are handled entirely by Stripe, a PCI DSS-compliant payment processor.
Kami melaksanakan langkah teknikal dan organisasi yang sesuai untuk melindungi data peribadi anda, termasuk penyulitan HTTPS/TLS, penyulitan data semasa rehat, kawalan akses peringkat baris dalam pangkalan data, dan penyimpanan dokumen pengesahan yang dikawal akses secara peribadi.
9. Data breach notification9. Pemberitahuan pelanggaran data
In the event of a personal data breach that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner as soon as practicable, in accordance with the Personal Data Protection Act 2010 (as amended).
Sekiranya berlaku pelanggaran data peribadi yang berkemungkinan menyebabkan kemudaratan besar kepada anda, kami akan memaklumkan anda dan Pesuruhjaya Perlindungan Data Peribadi secepat yang boleh dilaksanakan, selaras dengan Akta Perlindungan Data Peribadi 2010 (seperti yang dipinda).
10. AI-generated content10. Kandungan yang dijana oleh AI
Some business descriptions on Sabah Business Hub are generated by artificial intelligence based on publicly available data (including OpenStreetMap). These descriptions are clearly machine-generated drafts and may contain inaccuracies. Business owners can review, edit, or replace AI-generated content after claiming their listing.
Sesetengah penerangan perniagaan di Sabah Business Hub dijana oleh kecerdasan buatan berdasarkan data yang tersedia secara umum. Penerangan ini adalah draf yang dijana mesin dan mungkin mengandungi ketidaktepatan. Pemilik perniagaan boleh menyemak, mengedit, atau menggantikan kandungan yang dijana AI selepas menuntut penyenaraian mereka.
11. Cookies and analytics11. Kuki dan analitik
We use the following cookies and tracking technologies:
- Essential cookies — Required for authentication (keeping you signed in). These cannot be declined as they are necessary for the service to function.
- Referral cookie — If you arrive through a business owner's referral link, a cookie (“sbh_ref”) remembers which listing referred you for 30 days, so the owner can be rewarded if your business joins and is verified. It holds only the referral code, nothing about you.
- Analytics cookies — Used by PostHog to understand how the platform is used. You may opt out of analytics tracking at any time using the cookie banner or by contacting us.
- Session recordings (from 31 October 2026) — To find and fix problems with the site, PostHog may record how you use our pages: the pages you visit, where you click and scroll, and what appears on screen. Anything you type into forms is hidden before it leaves your browser, and we never record our admin pages or the pages where claim and verification documents are uploaded or viewed. Recordings are deleted automatically after 30 days and only our team can watch them. You can turn recordings off, along with other analytics, by choosing “Decline” in the cookie banner or under “Cookie settings” at the bottom of every page.
- Email opens and clicks — Emails we send you (claim invites, sign-in links, receipts, notifications) may contain a 1×1 tracking pixel and rewritten click-tracking links via Resend. We use this to measure delivery quality and campaign effectiveness. To opt out, reply to any email asking to be excluded, or use the unsubscribe / opt-out link where provided.
We do not use advertising cookies or tracking pixels from third-party advertising networks.
Kami menggunakan kuki penting (untuk pengesahan), kuki analitik (PostHog, untuk memahami penggunaan platform), dan penjejakan buka/klik e-mel (Resend, untuk mengukur kualiti penghantaran). Anda boleh menolak kuki analitik pada bila-bila masa atau menghubungi kami untuk menarik diri daripada penjejakan e-mel. Kami tidak menggunakan kuki pengiklanan.
Rakaman sesi (mulai 31 Oktober 2026): untuk mengesan dan membetulkan masalah di laman ini, PostHog mungkin merakam cara anda menggunakan halaman kami — halaman yang anda lawati, tempat anda klik dan tatal, serta apa yang dipaparkan di skrin. Apa sahaja yang anda taip dalam borang disembunyikan sebelum ia meninggalkan pelayar anda, dan kami tidak sekali-kali merakam halaman pentadbir kami atau halaman di mana dokumen tuntutan dan pengesahan dimuat naik atau dilihat. Rakaman dipadam secara automatik selepas 30 hari dan hanya pasukan kami boleh menontonnya. Anda boleh mematikan rakaman, bersama analitik lain, dengan memilih “Decline” pada sepanduk kuki atau di “Cookie settings” di bahagian bawah setiap halaman.
12. Children's data12. Data kanak-kanak
Sabah Business Hub is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.
Sabah Business Hub tidak bertujuan untuk digunakan oleh individu di bawah umur 18 tahun. Kami tidak mengumpul data peribadi daripada kanak-kanak secara sedar.
13. Changes to this policy13. Perubahan kepada dasar ini
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version is always on this page, with the date it was last changed at the top. For significant changes, we will also post a notice on the platform (for example on our What's new page) when they take effect. Please check this page from time to time. If we ever want to use your personal data for a new purpose that you have not been told about, we will tell you and, where the law requires it, ask for your consent first.
Kami mungkin mengemaskini Dasar Privasi ini dari semasa ke semasa. Versi terkini sentiasa terdapat di halaman ini, dengan tarikh kemas kini terakhir di bahagian atas. Bagi perubahan penting, kami juga akan memaparkan notis di platform (contohnya di halaman What's new kami) apabila ia berkuat kuasa. Sila semak halaman ini dari semasa ke semasa. Jika kami ingin menggunakan data peribadi anda untuk tujuan baharu yang belum dimaklumkan kepada anda, kami akan memaklumkan anda dan, jika dikehendaki oleh undang-undang, meminta persetujuan anda terlebih dahulu.
14. Governing law14. Undang-undang yang mentadbir
This Privacy Policy is governed by the laws of Malaysia, including the Personal Data Protection Act 2010 (Act 709) as amended by the Personal Data Protection (Amendment) Act 2024.
Dasar Privasi ini ditadbir oleh undang-undang Malaysia, termasuk Akta Perlindungan Data Peribadi 2010 (Akta 709) seperti yang dipinda oleh Akta Perlindungan Data Peribadi (Pindaan) 2024.