Privacy and Security

Lim Yi Qi. Questions, access or correction requests: deepbite123@gmail.com.

• Account: email, a hashed password, role, country, and the random name we give you.
• Verification, and nothing more: your name (a supplier gives the company's legal name), your email address and when you confirmed it by a code, your WhatsApp number and whether it was confirmed by a code, one registration number (an MDC or SDC number for a dentist, an SSM or ACRA number for a supplier), the state where a Malaysian dentist practises, a supplier's device licence number if given, what the public register returned, and the professional declaration. A clinic or trading name if you give one. We never ask for an identity card or passport number. Confirmation codes are kept only as a hash, for the ten minutes they last.
• Trading: listings, photos and links, offers, chat messages, orders, delivery names and addresses, phone numbers for couriers, disputes, reviews, saved searches, wanted requests and your shelf tracker.
• Locum Lounge: clinic details, shifts, and the WhatsApp number posts apply to.
• Requests: the name, contact details and area you give when asking for a shelf audit, with your consent time. An email if you post a wanted request with no account. An email, item details and date if you ask for a shelf reminder.
• Declaration: the choice you made, its time and version, your browser type, and a salted hash of your network address.
• Usage: pages viewed and steps taken (such as joining, listing or paying), a random browser identifier, the campaign or site you first arrived from, and applications clicked. Network addresses are used briefly to slow abuse.
• Payments, collected by Stripe: Stripe collects your payment details, and for payouts the identity, business and bank details its own checks require, under its own terms and privacy policy. We don't receive those documents. We keep references and amounts, not your full card or bank details.

To run accounts and orders, check who may trade, show listings lawfully, prevent fraud and abuse, keep records, handle disputes and complaints, send service messages, meet legal duties, and understand what works so we can improve. We don't sell your personal data. Register data collected for verification isn't used for marketing. We contact you about an audit or a shelf reminder only if you ask us to, and you can tell us to stop at any time. Members also get follow-up emails about their own account and stock, such as a step left unfinished or stock crossing a date band, and can turn these off in Settings. Messages about orders and payouts still come through.

• Other members see your pseudonym, role tick, listings, reviews and what you write. If you switch anonymity off, they see your clinic or company name. In a delivery order, the seller and carrier see the name and address you enter. In a collection, you share what you choose to.
• Visitors can see listings, public profiles, locum posts and clinic profiles, subject to the rules on registered devices.
• DeepBite staff with admin access can see account, verification, order and dispute details, and may read chats to deal with a dispute or complaint.
• Service providers: Stripe (payments, and its own checks for payouts), Resend (email, including confirmation codes), the WhatsApp Cloud API or a text message gateway when we send a code to your number, our hosting and database providers, and WhatsApp when you choose to apply. Some are outside Malaysia, so your data may be processed overseas.
• Public sources: your registration number and name are searched on the Malaysian MHPS register, a government site.
• Authorities and others, where the law requires it, or where we reasonably consider it necessary to deal with fraud, safety, or a legal claim. This can include your real identity.

Daily Bite is sent only to people who sign up for it, on its page or in one click from their account, and confirm.

• What we keep: your email address, the role you chose, whether you ticked that you are a dental professional and whether you asked for offers, a random token for your own links, where you signed up, and the dates you signed up, confirmed and stopped. If you joined from your account, the list row is linked to it. For each email we count how many readers it went to, and for a sponsor's card how many times its link was followed; the link is the same for every reader, so a click is counted, not tied to you.
• Why: to send the tip you asked for, and a sponsor's card only if you asked for offers. The professional tick decides whether a card about a registered device may reach you.
• Who sees it: nobody outside DeepBite. We never sell, export or hand over the list, and a sponsor never sees an address: a sponsor sees only how many readers the card went to and how many clicks it had. The emails are sent through Resend, which is outside Malaysia, as our other emails are.
• How to stop: every email ends with two links, one to stop everything and one to stop the sponsor cards and keep the tips. Each works in one tap with no sign-in. Members can also stop from their account page. A stopped address gets nothing more; ask us and we will delete it.
• Unconfirmed addresses get nothing but the confirmation email, and are deleted after 30 days.

We use first-party cookies only, and no third-party advertising or analytics scripts.

• Login session: keeps you signed in.
• deepbite_declaration, deepbite_declined: remember your professional declaration.
• theme: remembers light or dark mode.
• db_anon, db_touch: a random browser identifier and where you first came from, kept for up to a year.

These are practices in place today. They may change, may have faults, and don't guarantee security. No independent audit or certification has been done.

• Passwords are stored as bcrypt hashes. Login attempts are rate limited, and responses are built not to reveal which emails are registered at login. Password reset links are single-use and expire after two hours.
• Confirmation codes are six digits, stored only as a SHA-256 hash, last ten minutes, allow five tries, and at most three go to one address or number an hour. We don't ask for identity numbers, so none are stored.
• Pseudonyms by default: real names are read only on the server. Pages are built to display pseudonyms, and registered device details are removed on the server before a page reaches a visitor who hasn't declared.
• Payments: card and bank details go directly to Stripe. Payment events are accepted only with Stripe's signature, recorded in a ledger, and each order's money step runs once.
• Access: permissions are checked on the server on each request, and a member's role and status are re-read rather than trusted from the browser. Money logic can't be called directly from a browser.
• Abuse limits: rate limits apply to login, signup, password reset, confirmation codes, measurement and locum number releases. Payment links are screened and contact details flagged in chat.
• Web protections: security headers limit framing and content sniffing, images load without sending your page address, and the server won't start in production with key settings missing.

Some data is held in readable form because the service needs it, including legal names, registration numbers, addresses, chat messages and WhatsApp numbers. A rate limit can be worked around by a determined person. Anything you share with another member is outside our control.

While your account is open, and afterwards for as long as needed for orders, disputes, fraud prevention, legal and tax records. Declarations are kept as evidence. Apart from unconfirmed Daily Bite addresses (see The Daily Bite list), we don't yet delete data on an automatic schedule. Ask us if you want your account closed, and we'll remove or anonymise what we aren't required to keep.

Under Malaysia's Personal Data Protection Act 2010, and Singapore's where it applies, you can ask to access or correct your data, withdraw consent, and limit direct marketing. Withdrawing some consents may mean you can no longer trade. We may charge a fee where the law allows, and may refuse where it allows. Providing verification details is your choice, but you can't buy, list or post without them.

If we become aware of a data breach that the law requires us to report, we'll follow what the law requires. To the fullest extent permitted by law, our responsibility for any incident is limited as set out in the Terms.

We may update this notice. The version date shows what's current.