Privacy Policy

1. Who is responsible

Epic Buzz Sdn Bhd operates TravelAgencyMY and is the data user under Malaysia's Personal Data Protection Act 2010 (PDPA). Contact: hello@travelagencymy.com.

2. What we collect

• Your enquiry. Name, email, phone, destination, dates, group size, budget range and anything you type in the notes.
• Agency accounts. Name, email and the listing claimed. Card details are handled by Stripe and never reach our servers.
• Analytics. Google Analytics, in aggregate — pages viewed, rough location, device type. Not used to identify you.

3. Who we share your enquiry with

This is the important part. When you submit an enquiry we email it to MOTAC-licensed travel agencies whose licence scope and location match your request. Usually that is several agencies, not one, so that you receive competing quotes. Each may contact you directly.

Agencies that have not subscribed see only the outline of your trip — destination, dates, number of travellers. Your name, phone and email are withheld from them. Subscribing agencies see your contact details so they can reply.

We tell agencies to use your details only to quote for that enquiry. If one adds you to a marketing list or contacts you about something else, tell us and we will remove their access.

4. Listing information about agencies

Agency listings are compiled from the public MOTAC licence register — business name, address, licence number, expiry and scope. This is public regulatory information. An agency may claim its listing to correct it, or ask us to remove it.

5. Processors we use

• Supabase — database and accounts
• Vercel — hosting
• Resend — email delivery
• Stripe — subscription payments; they handle card data, we never see it
• Google Analytics — aggregate usage

6. How long we keep it

Enquiries are kept for two years so agencies can reference past quotes and so we can resolve disputes. Account records are kept while the account is open and for seven years afterwards where tax law requires it. Ask us to delete sooner and we will, unless we are legally required to keep it.

7. Your rights

Under the PDPA you may ask for a copy of your data, ask us to correct it, ask us to delete it, or withdraw consent. Email hello@travelagencymy.com and we will respond within 21 days.

One honest limit: once an enquiry has been emailed to agencies, we can delete our copy but we cannot delete theirs. We can tell you which agencies received it so you can ask them directly.

8. Agency email

Every enquiry email to an agency carries a one-click unsubscribe link. Unsubscribing from enquiries is separate from unsubscribing from product updates, so muting one never silences the other.

9. Changes

We will update this page when our practices change, and change the date at the top. See also our Terms of Service.