What We Collect and Why We Use It
We gather two broad categories of data. The first is account data — your registered name, email address, contact number and any identity document you submit during verification. The second is transactional data — payment method identifiers tied to Touch 'n Go eWallet, Boost or GrabPay,
-
1
deposit amounts in RM, and withdrawal request timestamps. We use this to process your transactions, confirm your identity and comply with obligations under applicable law in your jurisdiction. We also collect device-level signals: browser type, operating system, IP address and session duration. These help us detect
-
2
unusual access patterns and keep your account secure. We do not sell your personal data to third parties for their own marketing purposes. Data shared with payment processors — such as the networks behind GrabPay and DuitNow — is limited to what those processors need to
-
3
complete your transaction. Where you access our platform depends on local law, and eligibility is available only where local law permits. Retention periods vary by data type: account records are kept for as long as your account is active and for a period afterward as required
-
4
by applicable regulation; session logs are typically retained for a shorter window. You can request a copy of your data or ask us to correct inaccurate records at any time through our support channel.
Service availability depends on eligible regions and local law. Users should check local rules before opening an account.