Catzonia Policy

Privacy Policy

Version privacy-2026-06-v1 Last updated 3 June 2026

In short. We collect only what we need to run your bookings, your spa visit, and your cat’s care record. We never sell your data. You can ask for your data, correct it, or delete it at any time by writing to privacy@catzonia.com.

1. Who we are

Catzonia (“we”, “us”, “our”) is operated by Catzonia Sdn. Bhd., a Malaysian-incorporated company. We are the data controller for personal data collected through catzonia.com and the CatzoApp ecosystem. Our registered office is in Selangor, Malaysia.

2. What we collect

  • Identity & contact: your name, mobile number (E.164), email (optional), and date of birth (used as our IC-substitute for the digital waiver).
  • Cat profile: cat name, skin condition, fur condition, your spa-picker selections, and any notes you add.
  • Booking & payment: outlet, date/time, service, deposit transactions (handled by Billplz — we receive only the transaction reference and status).
  • Device & usage: IP address, browser type, referrer URL, UTM parameters, and pages viewed. We use Cloudflare for delivery and security.
  • Analytics: PostHog (product analytics) and Google Tag Manager. Meta, TikTok and Google pixels fire only with your consent.

3. Why we collect it

  • To complete and remember your bookings — this is contract necessity.
  • To verify identity at the outlet without asking for IC numbers (date of birth + booking record).
  • To send transactional WhatsApp or email confirmations — only those tied to your booking.
  • To improve the website — aggregate analytics only.
  • To send marketing — only when you have ticked the marketing-consent box.

4. How we share data

  • CatzoApp / outlet POS: your booking flows to the outlet that will serve your cat. This is the same Catzonia organisation.
  • Billplz: our payment processor for deposits. They are a Malaysia-licensed payment service provider.
  • Supabase: our database provider. Data is stored in their EU/Singapore region with row-level security.
  • WhatsApp via Murpati: only the bare-minimum content (name, booking reference, outlet) for transactional messages.
  • We do not sell your data, rent it, or share it with advertisers in identifiable form.

5. Retention

Booking records: 7 years (Malaysian tax requirement). Cat care notes: 3 years after your last visit. Marketing consent: until you withdraw. Server logs: 90 days. After retention, records are anonymised or deleted.

6. Your rights (PDPA Malaysia 2010 + GDPR-equivalent)

  • Access: ask for a copy of the data we hold about you.
  • Correction: ask us to fix anything wrong.
  • Withdrawal of consent: stop marketing or analytics tracking at any time.
  • Erasure: ask us to delete — we’ll honour it for everything outside the 7-year tax retention requirement.
  • Portability: we’ll send your data as JSON if you ask.
  • Complain: to us, then to Malaysia’s Personal Data Protection Commissioner if unresolved.

7. Cookies

See our Cookie Policy for the cookie list, purposes, and how to refuse non-essential cookies.

8. Children

Catzonia bookings are for owners aged 18 and over. We do not knowingly collect data from anyone under 18. If you are a parent or guardian and believe a minor has supplied us with data, write to us and we will delete it.

9. Changes

We update this policy when our practices change. The version code at the top changes; we keep an archive of older versions on request. Material changes are announced via in-product banner.

10. Contact

Privacy queries: privacy@catzonia.com
Postal: Catzonia Sdn. Bhd., Data Protection Officer, Selangor, Malaysia.