What Data We Collect and Why We Hold It
We collect personal data in three main contexts. First, account registration: your name, contact details and date of birth, used to verify your identity and maintain your account in line with applicable local law. Second, payment activity: when you fund your account via Touch 'n Go
-
1
eWallet, Boost, GrabPay, DuitNow or FPX, we record transaction references and amounts to reconcile your wallet balance and process withdrawals. We do not store your full e-wallet credentials on our servers — payment authentication happens on the provider's own platform. Third, device and session data: your
-
2
device type, browser version, IP address and pages visited are logged automatically to detect unusual access patterns and keep your account secure. We do not sell or rent personal data to third parties for their own marketing. Data shared with payment processors, identity-verification services or fraud-screening
-
3
providers is shared only to the extent required to complete your account transaction. Retention periods vary by data category: active account data is held for as long as your account remains open; transaction records are retained for the period required under applicable Malaysian financial regulations; device
-
4
logs are rotated on a rolling basis. You may request a copy of your data, ask for corrections or raise a deletion request at any time through our support channel.
Service availability depends on eligible regions and local law. Users should check local rules before opening an account.