Privacy Policy

This policy explains what personal data BestByLocals collects, why, and what you can do about it. We collect as little as we can.

Who is responsible

CASPER CREATIVE SOLUTIONS, a sole proprietorship registered in Malaysia (SSM registration no. NS0328529-A) ("we"). Contact for privacy questions: email [email protected].

What we collect

When you browse this website

• We do not use analytics or advertising, and no third-party scripts load on this website. The only tracking is campaign attribution kept in your browser, described below.
• Our hosting provider, Cloudflare, processes technical data such as your IP address, browser type and the pages requested, to deliver the site and protect it from abuse.
• Referral and campaign details. If your link contains a partner ID (aff), campaign tags (utm_*) or a discount code, we keep them in your browser for this tab only and pass them to our payment provider with your order, so we know where the order came from. See the Cookie notice.

What you must give us. Your name and email address are needed to deliver a guide you buy (and your email to confirm a waitlist sign-up). Everything else is optional.

When you buy a guide

Payment happens on the checkout page of our third-party payment provider, which may act as the reseller (merchant of record) for your purchase; its name is shown at checkout and on your receipt. The provider collects your payment and billing details under its own privacy policy; we never see your full card details. The provider shares with us:

• your name and email address;
• your order number, the guide you bought and the price;
• your country (for tax);
• what you entered at checkout: destination, tier, start date and time, language, and your three tick-box confirmations (data/Wi-Fi, EU/UK withdrawal waiver, 18 or older);
• any discount code you used, and the partner ID and campaign tags you arrived with (if any).

When you join a waitlist

For a destination that isn't on sale yet you can leave your email address. We store your email address, the destination, your language, whether you ticked the optional box for news and offers (it is unticked unless you tick it), your confirmation that you are 18 or older, and a record of each consent: the exact wording you were shown, the form version, the date and time, and a scrambled (hashed) form of your IP address — never the IP address itself. We first send one email asking you to confirm your address; nothing else is sent unless you confirm. Every email has an unsubscribe link.

When you email us

Your email address and whatever you write to us.

Why we use it (and our legal basis)

Purpose	Data	Legal basis (EU/UK)
Send your guide at the right time and keep your link working for your access window	Email, order details, start date/time	Performance of our contract with you
Handle cancellations, refunds and support	Email, order details, messages	Contract; legitimate interests
Keep business and tax records	Order details	Legal obligation
Keep the website secure	Technical data	Legitimate interests
Record which partner or campaign an order came from (this tab only)	Partner ID, campaign tags, order details	Legitimate interests
Waitlist: tell you when a destination opens (after you confirm your email)	Email, destination, language, consent record	Consent, which you can withdraw at any time (unsubscribe link)
News and offers (only if you ticked the optional box and confirmed)	Email, language, consent record	Consent, which you can withdraw at any time
Prove what you agreed to	Consent record (wording, form version, time, hashed IP)	Legal obligation; legitimate interests

We don't sell your data, use it for advertising, or send marketing emails unless you separately opt in. Emails about your order — the confirmation, your guide link, a start-date change — are service messages, not marketing.

Under Malaysia's Personal Data Protection Act 2010 (as amended in 2024), we process your data only for these purposes, and this policy is our written notice to you. The notice is also published in Bahasa Malaysia: Notis Privasi (Bahasa Malaysia).

Who we share it with

Only service providers that help us run the service, under contract:

• Our payment provider (named at checkout and on your receipt) — payments, tax, receipts and refunds.
• Cloudflare — website hosting and security.
• Resend — sending our emails (order confirmation, your guide link, waitlist confirmation).

Some of these providers process data outside Malaysia and outside your country, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

• Order records: 7 years, to meet Malaysian accounting and tax record-keeping requirements.
• Support emails: up to 2 years after the conversation ends.
• Waitlist sign-ups: if you don't confirm your email, your sign-up is deleted after 30 days. Confirmed sign-ups are kept until you unsubscribe. When you unsubscribe (or an unconfirmed sign-up is deleted), we delete your email address and keep only the record of your consent, with your email address replaced by a scrambled (hashed) value, so we can show what was agreed if you ask.
• Your guide link stops working at the end of your access window; any copy saved on your phone for signal gaps deletes itself at the same time.

Your rights

You can ask us to access, correct or delete your data, or to limit or object to how we use it. EU/UK residents can also ask for data portability and complain to their local data protection authority; Malaysian residents can complain to the Personal Data Protection Commissioner. Email [email protected] — we'll reply within one month (within 21 days for requests under Malaysia's PDPA).

Security

We use reasonable technical and organisational measures to protect your data against unauthorised access, loss or misuse — for example, guide links are signed and expire, and we store only a scrambled form of IP addresses for consent records. No system is completely secure.

Data breaches

If a breach of personal data puts you at risk, we'll contain and assess it and, where the law requires, tell you and the relevant authority within the legal deadline (under the EU/UK GDPR, where feasible within 72 hours of becoming aware of it).

Children

Our guides are sold to adults. We don't knowingly collect data from children.

Changes

If we change this policy we'll update the date at the top of this page.