Privacy notice

Last updated: 2026-10-14

DineFlow is operated by NexgenMY ("we"). This notice explains how we process personal data under Malaysia's Personal Data Protection Act 2010.

Data we collect

• Restaurant owners and staff: name, email, phone number, password (stored securely) and activity logs.
• Restaurant details: name, branches, menu, tables, settings and subscription records.
• Restaurant guests: orders and payments, without names or contact details.

Purposes

To provide the DineFlow service, send account and billing emails, give support, prevent abuse and comply with the law.

Storage and security

Data is stored on Railway servers in the Singapore region and backed up daily. Each restaurant can only see its own data.

Retention

We keep data while the account is active and delete old data on our retention schedule (for example old audit logs and staff requests). Unverified accounts are deleted after 7 days.

Disclosure

We do not sell data. We share it only with providers needed to run the service (hosting, email) or when the law requires it.

Your rights

You may ask to access, correct or delete your data by contacting us.

Contact

you@example.com