Privacy Policy
Effective date: 1 June 2026
TACNow is committed to protecting your privacy and complying with the Personal Data Protection Act 2010 (PDPA) of Malaysia.
1. Information We Collect
Account data: When you register, we collect your email address and organisation name. We do not collect payment card details directly — top-ups are currently processed via manual invoice.
API usage data: We log API requests including timestamps, project identifiers, response codes, and delivery status.
Phone number data (your end users): When you use the API to send OTPs, we receive the recipient phone number in transit. We do not store full phone numbers.
2. What We Do Not Store
- Full phone numbers are never persisted. We store only:
- A SHA-256 hash of the phone number (for deduplication)
- The last 4 digits in masked form (e.g.
****6789) for your delivery logs
This means TACNow cannot reveal, leak, or sell your users' phone numbers — we simply don't have them.
3. Data Retention
Delivery log records (including masked phone numbers and message status) are retained for 90 days from the date of creation.
Phone number records are automatically purged 90 days after creation. This purge is irreversible and automatic — no manual action is required from you or your users.
Account data (email, organisation) is retained for the lifetime of the account and 30 days after deletion.
4. How We Use Your Data
We use the data we collect to:
- Provide and operate the Service
- Send transactional emails (delivery failure alerts, low-balance notifications)
- Investigate abuse and enforce our Terms of Service
- Comply with legal obligations
We do not sell your data or use it for advertising.
5. PDPA Compliance
TACNow is built for PDPA compliance:
| PDPA Principle | How TACNow complies |
|---|---|
| Purpose limitation | Data used only for service delivery |
| Data minimisation | Full phone numbers never stored |
| Retention limit | Logs purged after 90 days |
| Access rights | Contact us to request your data |
| Security | Data encrypted in transit (TLS 1.3) and at rest |
Data residency: All data is stored in Malaysia.
6. Your Rights
Under the PDPA, you have the right to:
- Access personal data we hold about you
- Correct inaccurate personal data
- Delete your account and associated data
- Withdraw consent to processing
To exercise these rights, email privacy@tacnow.co.
7. Third-Party Services
We use the following third-party services to operate TACNow:
| Service | Purpose |
|---|---|
| Alibaba Cloud SMS | SMS delivery carrier |
| PostgreSQL (self-hosted) | Data storage |
| Redis (self-hosted) | Rate limiting and queuing |
These providers are bound by their own privacy and security policies. We do not share personal data with any third party beyond what is necessary to deliver the Service.
8. Security
We protect your data using:
- TLS 1.3 encryption in transit
- Encryption at rest for all stored data
- API key hashing (keys are never stored in plaintext)
- IP allowlists and rate limiting
If you discover a security vulnerability, please disclose it responsibly at security@tacnow.co.
9. Changes to This Policy
We will notify registered users by email before making material changes to this Privacy Policy. Continued use of the Service constitutes acceptance.
Contact
Privacy enquiries: privacy@tacnow.co