Privacy policy
This policy explains what personal data HutPal collects, why, who sees it and how you control it. We follow Malaysia's Personal Data Protection Act 2010.
Who we are
HutPal is a Malaysian service based in Miri, Sarawak. It connects families with local home cooks, delivery riders and aircon servicemen. HutPal is responsible for the personal data described here. You can reach us at support@hutpal.com.
What we collect
Account: your name, email address and, if you sign in with Google, your profile picture link. Your WhatsApp number, which we ask for when you first order or apply as a partner. Orders: delivery area and address, house location if you share it, allergies you tell us, what you ordered, payment references and payment screenshots, and any complaint or refund details. Cooks, riders and servicemen: identity and certificate documents, kitchen photos and inspection records, kitchen address and location, and bank details for payouts. Optional: your phone's notification address if you turn on notifications, an approximate location (rounded to about 100 m) when you search for cooks near you, your number if you join the waitlist, a cook's name and number if you nominate them (only after you confirm they agreed), and bank details if you ask for cash back.
Signing in
You sign in with Google or with your email and a password. With Google we receive only your name, email address and profile picture link, to create your account and show who is signed in. We never see your Google password, contacts, Gmail or files, and we never use Google data for advertising. Our use of information received from Google follows the Google API Services User Data Policy, including the Limited Use requirements. Passwords are stored only as a secure one-way hash. You prove your WhatsApp number is yours by sending a short code from it to HutPal on WhatsApp.
How we use it
To run your account; to take, prepare and deliver orders and aircon bookings; to confirm payments and pay cooks, riders and servicemen; to check food safety and partner documents; to handle questions, complaints and refunds; to keep the service safe and prevent fraud; to keep the financial records the law requires; and to send you service messages about your orders. If you choose to follow a cook or join the waitlist, we tell you about new menus or a cook opening near you. You can turn these off at any time.
Who sees your data
Your cook and the rider delivering your order see your name, phone, address and house location, only for that order and on that day. For an aircon booking, only the serviceman confirmed for your job sees your name, phone and address. If you join a neighbourhood (jiran) group, its members see your first name only. HutPal staff see what they need to support you. We use trusted service providers to host the app, store data securely, send emails and messages, and handle sign-in. They act only on our instructions, under contract, and may not use your data for their own purposes. We disclose data to authorities only when the law requires it. We never sell your personal data and never share it for third-party advertising.
Where it is stored
Your data is stored on secure servers in Singapore and may be processed outside Malaysia by our service providers. Wherever it is processed, we make sure it is protected to the standard this policy describes.
How long we keep it
Order and payment records are kept for 7 years for tax and accounting. Delivery and job photos are deleted after 30 days. Servicemen's ID and certificate photos are deleted 90 days after we decide on their application. Location searches and waitlist entries are deleted after 12 months. Other personal data is deleted or anonymised when you close your account.
Cookies
We use only the cookies needed to run HutPal: keeping you signed in, remembering your language and area, and an anonymous visitor number so we can count visits without knowing who you are. We do not use advertising or cross-site tracking cookies.
Your rights
You can ask to see the personal data we hold about you, correct it, delete your account, withdraw your consent, or stop service updates. You can change your name, WhatsApp number and password yourself on the Account page. For anything else, email support@hutpal.com. We may ask you to confirm your identity, and we reply within 21 days.
Security
Data is sent over encrypted connections and stored with strict access controls. Documents, receipts and photos are private and shown only to the people who need them. Staff access is limited to their role and actions are logged.
Children
HutPal accounts are for adults aged 18 and over. We do not knowingly collect personal data from children.
Changes to this policy
If we change this policy we will update this page and the date below. For important changes we will also tell you in the app before they take effect.
Questions or requests about your data: email support@hutpal.com
See cooks near meLast updated 10 October 2026