ur.my

Privacy Policy

Last updated: 18 October 2026

ur.my is run by Surf Seven Network (200203092812 (PG0105691-M)), 55, Lengkok Segar Jaya, Taman Segar Jaya, 13400 Butterworth, Penang, Malaysia. This policy explains what personal data ur.my collects, why, where it comes from, who else handles it, how long it is kept, and how to reach us about it. For that data, Surf Seven Network is the data controller under Malaysia's Personal Data Protection Act 2010, and this policy follows that Act.

1. If you have an account

What we keep:

  • Your name, email address and password. The password is stored scrambled (hashed), so nobody, including us, can read it. If you sign in with Google, Google tells us your name, your email address and that it has confirmed the address, and gives us a number for your Google account; we receive nothing else from Google, and your Google password never reaches us.
  • What you put on your sites: business details, contact details, text, prices, opening hours and photos. Most of it is meant to be public once it is approved.
  • Your organizations and, if you ask to be verified, the SSM number and registration document you send.
  • If you invite customers to review you, the name and WhatsApp number you give for each invitation. We hold them for you, only to make that invitation.
  • Your payments: the site, the amount, the period, how you paid and your email address. Card, bank and e-wallet details go only to HitPay; we never see them.
  • Our own records about your account: the checks on your content, refusals, strikes and bans.
  • Your account's activity, which you see on your profile: when you signed in or changed how you sign in, from which kind of device and browser, and roughly where (the IP address and the town and country it belongs to).

Where it comes from: from you, as you sign up and use the dashboard; from Google, if you sign in with Google; and from HitPay, which tells us that a payment went through and how it was paid.

What you must give: an account needs a name, an email address and a password, or a Google sign-in; without them we cannot open one. Everything else is up to you, such as an SSM number and document, which are needed only to be verified.

What we use it for: running your account and sites; checking content; emails about your account (confirming your address, password resets, new enquiries, renewal reminders and receipts); taking payments and keeping accounts; and keeping ur.my free of scams and spam. We do not sell personal data, and we do not send marketing.

ur.my accounts are for people aged 18 and over.

2. If you visit a site on ur.my

  • Visits. Sites on ur.my set no cookies and carry no advertising or tracking by others. To count visits, a small script reports the page viewed, the page you came from and any campaign tag in the link. To count unique visitors without cookies, your IP address and browser are turned into a code with a secret that changes every month. When the month is over, the codes and the secret are deleted, so a visit cannot be traced back to you. Your IP address itself is not stored; it is held for up to an hour to stop floods and abuse of the forms, then forgotten.
  • Enquiries. When you send an enquiry, your name, email address, phone number and message go to the business's dashboard, and the business is told that it has a new enquiry (without your words). The business uses your details to reply to you, and is responsible for how it uses them after that. We never email you, and we do not use your details for anything else.
  • Reviews. Your name, rating and review are published once they have been checked. Your email address is never shown; we keep it so that each email address can review a site once.
  • Searches on ur.my. The words searched for in the ur.my directory are counted for the businesses they show, as daily totals; who searched is not kept.
  • Reports. If you report a site to us, we keep what you chose and wrote, and the page you reported, but nothing about who you are. Your IP address is held for up to an hour to stop abuse of the form, then forgotten; so that each visitor reports a site only once a day, a code made from it and your browser is kept for a day.

3. Who else handles it

We use a few services to run ur.my. Each gets only what it needs for its job:

  • Google (Gemini) checks new and changed content, before it goes live or, on sites of verified organizations and paid plans, just after: site text and new photos, the names and addresses of new sites, and visitors' reviews. It also reads the SSM documents sent for verification, and checks a site's published content again when visitors have reported it. Enquiries are never sent. On the paid service we use, Google does not use what we send to improve its products.
  • Cloudflare carries and protects all traffic to ur.my, and forwards email sent to [email protected]. Before a form is sent, Cloudflare Turnstile checks that a person is sending it, from technical details of the browser.
  • Resend sends our emails.
  • HitPay takes payments. It receives your email address and the amount, and handles your card, bank or e-wallet details.
  • Backblaze keeps our nightly backups: a copy of the database, encrypted before it leaves our server, kept for 14 days, and a copy of the sites' photos, in which a deleted photo stays for 30 days.

Some of these services store or process data outside Malaysia, for example in the United States or Singapore. Each one protects it under its own data protection terms, which are part of our agreement with it, and we use them only for the purposes above. We give personal data to the authorities only when the law requires it.

4. How long we keep it

  • Your account and sites: until you close them. Closing a site deletes its content, photos, enquiries and reviews; closing your account does that for every site, then deletes the account. A site that is not renewed, or on the free plan not extended, is deleted in the same way 30 days after it is suspended.
  • Banned accounts: the email address and the reason are kept, so that the address cannot sign up again.
  • SSM documents: deleted as soon as the request is decided. When our automated check verifies one, we keep the document, encrypted, for up to 7 days so that we can check that decision ourselves. A verified organization keeps its SSM number and registered name.
  • Earlier versions of your content: a version replaced before it was checked is deleted after 30 days. Approved and refused versions are kept while the content exists.
  • Enquiries: until the business deletes them or its site is closed.
  • Account activity: 90 days.
  • Review invitations: the customer's name and number are deleted 30 days after the link stops working.
  • Reports about a site: while the site exists.
  • Payments: kept for 7 years after the payment, as Malaysian tax law requires, even after a site or account is closed, and then deleted. A payment that was started but never finished is deleted after 30 days.
  • Visit statistics: kept only as totals, with no personal data.
  • Backups: what you delete stays in our backups for a while: up to 14 days in the database copies and 30 days for photos. Backups are used only to restore ur.my after a failure.

5. Keeping it safe

Everything sent to and from ur.my is encrypted (HTTPS). Passwords are hashed, and SSM documents are encrypted while we hold them. Only we can reach the server and ur.my's admin area.

If personal data we hold is ever lost or exposed in a way likely to cause harm, we will report it to the Personal Data Protection Commissioner and tell the people it may harm, as the Act requires.

6. Cookies

Sites on ur.my and ur.my's public pages set no cookies. The dashboard uses cookies only to keep you signed in and to protect its forms.

7. Your rights

You can ask to see the personal data we hold about you, to have it corrected, or to have it deleted. You can also ask for a copy of your account's data in a common format, to take to another service. You can correct or delete most of it yourself in the dashboard, and you can close your account at any time. For anything else, write to [email protected]; we reply within 21 days. About an enquiry you sent, contact the business first. About a review, write to us.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Commissioner of Malaysia.

8. Changes to this policy

We update this policy when ur.my changes how it handles personal data, and we email account holders before an important change takes effect. Our Terms of Service and Refund Policy cover everything else.

9. Contact

Surf Seven Network (200203092812 (PG0105691-M))
55, Lengkok Segar Jaya, Taman Segar Jaya, 13400 Butterworth, Penang, Malaysia
Email: [email protected]