Privacy policy.

This notice is issued under section 7 of the Personal Data Protection Act 2010 (“PDPA”). It is also published on this website in Bahasa Malaysia and in Chinese. If the English and translated versions differ, the English version prevails.

This policy was last updated on 23 October 2026. It explains how Aevum handles personal data when you use our website (aevum.my), the Aevum app for visitors, and the Aevum Merchant app for venues and event organisers.

Data controller: Aevum Digital Solutions (SSM 202603076487 (KT0610495-K)), Ipoh, Malaysia. Data Protection Officer: [email protected]. General questions: [email protected].

What we collect on the website

• If you send a form: your name, email, and whatever you typed, plus the topic you chose (venue, city, press, and so on). Name and email are required so we can reply. Other fields are optional unless the form marks them as required. Our forms open your own email app, so what you send reaches us as an email.
• If you claim a place or tell us about a new one: the details and documents the form asks for. Each form explains what is required and how long we keep it.
• If you email us: the address you wrote from and the message.
• Technical and security logs: when you visit, our hosting and security provider Cloudflare processes your IP address, browser and device type, the page requested, the referring page and the time. We use this to deliver the site, prevent abuse and fix errors. We keep logs only as long as we need them for these purposes, and longer only to investigate a security incident.
• Analytics: we do not use any analytics service on this website. See “Analytics and cookies” below.

We do not run an advertising network on this site. We do not ask you to create a website account.

Each website form has a short note that explains how we use what you send, and links to this policy. Any box to receive news from us is optional and is not ticked for you. Questions about a form go to [email protected].

What we collect in the apps

Aevum app (visitors)

• Account details: your email or the sign-in you choose, a display name, your age group, and your language setting.
• Location (optional): precise location while the app is in use, only if you allow it. See “Location” below.
• Purchases: a transaction reference, product, date, country or currency and subscription status sent to us by Apple or Google. We never receive your card number.
• Your activity in the app: stories you unlock, places you save, and settings, so the app works across your devices.
• Device and technical data: device model, operating system, app version, a random app identifier, crash reports, and a push-notification token if you allow notifications.
• Support messages: what you send us when you ask for help.

Aevum Merchant app (venues and organisers)

• Business and contact details: the business name, registration number, the address and phone the venue gives us, email, and the name and role of the person managing the listing.
• Staff accounts: names, work emails and access roles of people you add.
• Listing and event content: descriptions, opening hours, photos, event dates and prices you publish.
• Verification records: documents or evidence you provide to show you are authorised to claim a listing.

We collect this data directly from you, from your device, from Apple or Google (for purchases and sign-in), and, for listings, from public sources or from a venue that claims a listing.

Location

If you allow it, the visitor app uses your device’s precise location only while the app is open and in use, to show where you are on the map and suggest nearby places. We do not collect location in the background, and we do not keep a history of your movements linked to your account. You can turn location off at any time in your phone’s settings, and the app will still work with manual search.

Purchases

In-app purchases and subscriptions are processed by Apple (App Store) or Google (Google Play). We never see or store your full card details. The store sends us a transaction reference, the product bought, the purchase date, country or currency, and whether your subscription is active, renewed, cancelled or refunded, so we can unlock content and handle support.

Why we use your data

Purpose	Data used	Required?
Reply to your messages and forms	Name, email, message, topic	Required to get a reply
Create and run your account	Account details, settings	Required to use an account
Unlock and restore purchases	Purchase records from Apple or Google	Required for paid content
Show you on the map and suggest nearby places	Location while the app is in use	Optional. The app works without it
Publish and verify venue or event listings	Merchant business and contact details, verification records	Required to claim or manage a listing
Keep the service secure, prevent fraud and fix errors	Technical data, logs, crash reports	Required
Send news and offers	Email, push token	Optional, and only if you opt in
Produce anonymous, aggregated statistics and reports, which we may share, sell or license	Usage data, and location while the app is in use, de-identified before it is combined	Optional. On by default for users 18 and over; turn it off in Settings → Privacy or email [email protected]. Always off for users under 18
Meet legal duties and handle disputes	The data the duty or dispute needs	Required by law

If you choose not to give required data, we may not be able to reply, provide an account, unlock purchases or publish your listing.

We do not sell your personal data. We do not use it for third-party advertising.

Sensitive data

We do not ask for or intentionally collect sensitive personal data, such as health, religious beliefs, political opinions or biometric data. Face ID or fingerprint data stays on your device and is never sent to us. Please do not include that kind of information in forms or messages.

Marketing

We send marketing emails or promotional notifications only if you opt in. You can opt out at any time through the unsubscribe link, your app settings, or by writing to [email protected]. Service messages, such as receipts or security alerts, are not marketing.

How long we keep it

We keep personal data only for as long as we need it for the purpose we collected it for, or for as long as the law requires us to keep it, for example tax and accounting records. These periods apply to the website forms:

Data	How long we keep it
Claim documents (SSM, ROS, letters, other documents, halal certificates)	Deleted 30 days after the claim decision or after any dispute or appeal ends. We keep a record of the check (document type, number, expiry, date, result) while the listing stays claimed and for 12 months after
Venue account details	While the account is open, then 12 months
Suggestions for places we have not added, or that the venue has not claimed	12 months from our last contact, then deleted (the public place listing can stay)
Pitch-deck requests	12 months from our last contact, unless investment discussions start

You can ask us to delete your data sooner, unless we must keep it by law. When data is no longer needed, we delete it or make it anonymous so it can no longer identify you.

Who we share it with

We share personal data only with:

• Service providers who process it for us under written contracts that require them to protect it and use it only on our instructions. They are:
  • Cloudflare, Inc. (United States, global network): website hosting and security checks against bots.
  • Proton AG (Switzerland): our email. Messages you send to hi@, dpo@, investors@ and our other addresses, and the emails our website forms open in your email app, are stored with Proton.
  • GitHub, Inc. (United States): stores the website’s content and handles sign-in to the editing area. Only our team signs in there.
  • The website forms have no separate form provider. When you press send, the form opens your own email app with the details filled in, and the message comes to our Proton mailbox.
• Apple and Google, to process purchases and sign-in under their own privacy policies.
• Venues and organisers, only the information you choose to send them, for example if you contact a venue through the app.
• Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality.
• A buyer or successor if the business is sold or restructured, who must keep protecting your data under this policy.
• Authorities, regulators or courts when Malaysian law requires it, or to protect someone’s safety.

Organisations that receive our aggregated reports get only anonymous statistics. See “Aggregated reports and statistics” below.

We do not give venues a list of app users. We share your contact details with a venue only if you choose to contact or book with it.

Aggregated reports and statistics

We may use information about how people use the Aevum app and website to produce aggregated statistics and reports. Examples include how many visitors explore a heritage area each week, the busiest times of day, or which kinds of places people save. We may share these reports with cities, tourism boards, universities, researchers, venues and other organisations, or sell or license the reports to them, including for a fee.

These reports never contain personal data. We do not sell your personal data. Before any report leaves Aevum:

• we remove names, contact details, account IDs, device identifiers and IP addresses;
• every figure is based on at least 20 different people. Smaller groups are combined or left out;
• locations are shown only as areas no smaller than a named district or a 500 m × 500 m grid square, whichever is larger, and times only as periods of one hour or longer. We never include individual routes, location trails, or the start and end points of anyone’s trip;
• we never include activity from anyone who has told us they are under 18, or whose app store tells us they are under 18;
• anyone who receives a report must sign a contract that bans any attempt to identify a person, bans combining the report with other data to do so, and limits passing it on.

Turning usage data into anonymous statistics is itself a use of your personal data. We, or service providers acting for us, do it under this policy.

Your choice (opt-out): the setting “Include my activity in anonymous statistics” is on by default for users aged 18 or over. You can turn it off at any time in the app (Settings → Privacy), or by emailing [email protected]. Turning it off does not change how the app works for you. It applies to statistics produced after you turn it off. Reports already produced cannot identify you. For users under 18, the setting is always off and cannot be turned on.

Transfers outside Malaysia

Some of our service providers store or process data outside Malaysia. They are Cloudflare (global network, based in the United States), Proton AG (Switzerland) for email, GitHub (United States) for the website’s content and editor sign-in, and Apple and Google. Before we transfer personal data abroad, we check that the destination has a law substantially similar to the PDPA or gives an equivalent level of protection, or we rely on another basis allowed by section 129 of the PDPA, such as contractual safeguards with the provider or a transfer that is necessary to provide the service you asked for. You can ask us for more information about these safeguards.

Keeping your data secure

We protect personal data with measures that follow the Personal Data Protection Standard 2015, including encryption in transit, access limited to staff who need it, strong passwords and multi-factor authentication for admin accounts, backups, and logging of access. Our service providers must meet similar standards.

If a personal data breach happens that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it, and notify affected people without unnecessary delay, and no later than 7 days after notifying the Commissioner, with advice on what to do.

Your rights

Under the Personal Data Protection Act 2010 you can:

• Access the personal data we hold about you and get a copy.
• Correct data that is inaccurate, incomplete, misleading or out of date.
• Withdraw consent, in full or in part. This may mean we can no longer provide part of the service.
• Ask us to stop processing that is likely to cause you substantial damage or distress.
• Opt out of direct marketing at any time.
• Data portability: ask us to send your data electronically to another organisation, where that is technically feasible and the format is compatible.
• Delete your account and the personal data linked to it, by writing to [email protected]. Deleting your account does not cancel an App Store or Google Play subscription. Cancel that in your store settings first.

To ask, email our Data Protection Officer at [email protected]. We may ask you to confirm your identity. We will reply to access and correction requests within 21 days, as the PDPA requires, and tell you if we need more time and why. We may charge only the fees allowed by the Personal Data Protection Regulations. Most requests are free.

If you are not satisfied with our reply, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi), www.pdp.gov.my.

Analytics and cookies

Website. We do not use advertising cookies or tracking cookies, and we do not run an advertising network on this site.

We do not use any analytics service on this website, so we do not count your visit or track how you move between pages.

Cloudflare, our hosting and security provider, may set a strictly necessary cookie to tell people apart from automated bots. It protects the site and is not used for advertising or analytics.

The site’s editing area (/admin) is used only by our team. Signing in there uses a strictly necessary login token. Visitors to the public site do not get it.

We will update this page, and ask for your consent where needed, before we add any analytics, any other cookies, or embedded content from other companies, such as videos or maps.

App. The app stores data on your device to keep you signed in and remember your settings.

Children

The visitor app is meant for people aged 13 and over. If you are 13 to 17, you need a parent or guardian’s consent to create an account or make a purchase, and they act for you on your privacy rights. When you sign up, we ask only for your age group, not your date of birth. If you tell us you are 13 to 17, or your app store tells us you are under 18, your activity is never included in our anonymous statistics, and we do not send you marketing. Purchases are also controlled through the parental settings of Apple (Ask to Buy) and Google (Family Link). The Merchant app is only for adults acting for a business. If you think a child has given us personal data without consent, write to [email protected] and we will delete it.

Changes

We will post any change here with a new “last updated” date. If a change is significant, for example a new purpose or a new kind of data, we will tell you in the app or by email before it takes effect and, where the law requires, ask for your consent again. Earlier versions are available on request.

City requests

City requests, and an email if you add one, are collected only to plan expansion.

Contact

Aevum Digital Solutions (SSM 202603076487 (KT0610495-K)), Ipoh, Malaysia.

Data protection: [email protected]. General enquiries: [email protected].