Privacy Policy
BidSwap
Last Updated: 5 August 2026 · Effective Date: 5 August 2026
1. Introduction
1.1. This Privacy Policy explains how BidSwap collects, uses, stores, protects, and discloses your personal data when you use our website and marketplace platform located at https://bidswap.my (the Platform).
1.2. BidSwap is a live social marketplace where users can bid cash on items or swap items with other users in real time. We are committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (Act 709) of Malaysia (PDPA) and all applicable data protection laws.
1.3. By creating an account, accessing, or using BidSwap, you acknowledge that you have read, understood, and consent to the collection and processing of your personal data as described in this Policy. If you do not agree, you must not use the Platform.
1.4. This Policy forms part of and should be read together with our Terms of Service, available at https://bidswap.my/terms.
1.5. BidSwap is operated by BidSwap. [SSM Registration Number: To be updated upon registration] Contact Email: admin@bidswap.my
2. Personal Data We Collect
We collect the following categories of personal data:
2.1 Registration and Account Data
- Full name (first name and last name)
- Email address
- Username
- Password (stored securely by Keycloak using PBKDF2 with SHA-256 — BidSwap does not store your password in plain text)
- Email verification status
- Social login linkage status (Google, Facebook)
- Account creation date and time
If you register via a social login provider (Google, Facebook), we receive your name, email address, and profile identifier. We do not receive your social media password.
2.2 Profile Data
- Display name (publicly visible, 30-day change cooldown)
- Malaysian state (16 states/federal territories)
- Bio (short text)
- Preferred meetup location
- Avatar / display picture
- Profile cosmetics (colour, frame)
2.3 Listing Data
- Listing title (up to 150 characters)
- Description
- Starting price (MYR)
- Minimum bid increment
- Duration
- Category (23 options)
- Buy-it-now / Reserve price (optional)
- Item condition
- Up to 5 images (WebP, max 5 MB each)
- 8-character listing code
- Status, view count, total bids
2.4 Bidding and Swap Data
- Bid amount, listing, timestamp
- Swap offers: offered items, target listing, timestamp
- Accepted swap partner and outcome
- Trade completion: timestamps, cash/swap outcome
2.5 Communication Data
- Messages between users (Q&A during active auctions, post-sale chat)
- Message content, sender, recipient, timestamp, read status
- Feedback/support tickets and replies
- Reported messages flagged for moderation
2.6 Review and Rating Data
- Star rating (1–5)
- Review comment
- Reviewer and reviewee identifiers
- Aggregate seller/buyer rating averages on profiles
2.7 Reporting Data
- Reporter user ID
- Target type/ID (listing/user/message)
- Reason (Scam/Fraud, Joy-bidding, Inappropriate Content, Harassment, Rules Violation, Code Coercion, Other)
- Details and description
- Evidence URLs (if provided)
- Resolution status and notes
2.8 Interaction Data
- Listing views (counted once per viewer per listing per day; the listing owner's own visits are not counted)
- Likes on listings and profiles
- Watchlist/bookmarks
- Notification preferences
2.9 Merit, Demerit, and Account Standing Data
- Merit points from platform activities
- Rank progression (9 ranks: Newbie → Legend)
- Demerit points for violations
- Account standing (active/suspended/banned)
- Complete point history
- Throttle event logs (anti-abuse)
- Referral data
2.10 Cosmetics and Virtual Items
- Owned cosmetics (frames, colours)
- Equipped cosmetics
- Unlock history
2.11 Technical and Usage Data
Automatically collected: IP address (for security, rate-limiting, and error diagnosis/debugging), browser type and version, pages visited and timestamps, referring URL, JWT session information.
We do not collect GPS or device-level geolocation. We do not use browser fingerprinting. Location is limited to the Malaysian state you voluntarily select in your profile.
3. Cookies and Tracking Technologies
3.1 Essential Cookies (Strictly Necessary)
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
| kc_token | JWT authentication token | 1 hour | First-party |
| Keycloak session cookies | SSO session management | Session | First-party (Keycloak) |
| rememberMe | "Remember Me" persistence | Up to 30 days | First-party (Keycloak) |
| bs_visitor | Randomly generated ID used only to count a listing view once per day, so view counts are not inflated by page refreshes | 1 year | First-party |
Set with SameSite=Strict, except bs_visitor which uses SameSite=Lax so that listings opened from a shared link still count correctly. Transmitted exclusively over HTTPS.
bs_visitor contains a random identifier only. It holds no personal information, is never shared with third parties, is not used for advertising or profiling, and is not used to track you across other websites. Signed-in users are counted by their account instead, and this cookie is not set for them.
3.2 Analytics — Google Analytics 4
GA4 collects pages visited, session counts, approximate location (country/city from IP), device type, browser, OS, referral source, and interaction events. Processed by Google; may be transferred to the US. Opt out: https://tools.google.com/dlpage/gaoptout.
3.3 Advertising — Google AdSense
Google AdSense serves ads, limits frequency, and measures effectiveness. Opt out of personalised ads: https://adssettings.google.com. Data practices: https://policies.google.com/privacy/partners.
3.4 Third-Party Resources
Google Fonts / Material Symbols loaded from Google CDN; IP address transmitted. Google states Fonts data is not used for ad targeting.
3.5 Local Storage
localStorage used solely for theme preference (light/dark). No PII stored.
3.6 Managing Cookies
Browser settings allow blocking/deleting cookies. Essential cookies (kc_token) required for login. Analytics/advertising cookies optional. More info: https://www.allaboutcookies.org.
4. How We Use Your Personal Data
- Provide and operate the Platform (accounts, listings, bids, swaps, messaging, trade confirmations)
- Authenticate and secure your account
- Facilitate transactions (BidSwap does not process payments — payment/exchange occur off-platform)
- Display your public profile (display name, avatar, bio, state, listings, reviews, rank)
- Operate the merit/demerit reputation system
- Moderate the Platform (reports, violations, demerits, suspensions, bans)
- Communicate with you (email verification, password reset, security notifications, feedback replies via Brevo)
- Improve the Platform (Google Analytics)
- Serve advertising (Google AdSense)
- Comply with legal obligations and enforce Terms of Service
- Send in-app notifications (outbid, messages, trade updates, merit/demerit alerts)
5. Legal Basis for Processing
Under the PDPA 2010: General Principle (specific lawful purposes), Notice and Choice (consent via registration), Disclosure (no unauthorised sharing — see Section 6), Security (reasonable measures — see Section 7), Retention (time-limited — see Section 8), Data Integrity (corrections upon request — see Section 9), Access (right to view — see Section 9).
6. Data Sharing and Disclosure
We do not sell your personal data. Data shared only as follows:
6.1 Service Providers
| Provider | Purpose | Data Shared |
|---|---|---|
| Keycloak (self-hosted) | Authentication | Name, email, username, password (hashed), social login status |
| Brevo (Sendinblue) | Email delivery | Email address, name, email content |
| Google Analytics 4 | Analytics | Usage data, IP (anonymised), device info |
| Google AdSense | Advertising | Ad identifiers, browsing behaviour, IP |
| Google Fonts / Material Symbols | Font/icon loading | IP address |
| Tailscale | Network infrastructure | Traffic metadata |
All providers restricted from using your data for other purposes.
6.2 Social Login Providers
Google, Facebook: we receive name, email, profile identifier. We do not access your social media password, contacts, or messages.
6.3 Legal Requirements
We may disclose data to comply with law, protect rights/safety, or investigate fraud/violations.
6.4 What We Do NOT Do
- Sell your data
- Rent your data
- Share for third-party marketing
- Process payments or handle financial data (credit cards, bank accounts)
7. Data Storage and Security
7.1 Storage: Data stored on BidSwap-operated servers in a PostgreSQL database.
7.2 Measures:
- HTTPS/TLS via Caddy reverse proxy (encryption in transit)
- PBKDF2+SHA-256 via Keycloak (password hashing)
- JWT with PKCE S256, SameSite=Strict cookies (authentication)
- Caddy rate-limiting + application velocity throttle (abuse prevention)
- Role-based access control (admin/moderator roles)
- Server-side image processing (WebP format)
7.3 Limitations: No method is 100% secure. In case of a notifiable breach, we will inform you and authorities as required by law.
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account |
| Listing data | Retained as trade history |
| Reviews | Retained for the life of the account |
| Chat messages | Deleted 90 days after listing ends |
| Reports | Auto-closed 90 days if unresolved |
| OG share images | Deleted after listing completion |
| Server access logs | 90 days, then rotated |
| Merit/demerit history | Duration of account |
| Feedback tickets | Until resolution, then archived |
Account deletion: data deleted/anonymised within 30 days, except where retention is required by law.
9. Your Rights
Under the PDPA 2010:
9.1 Right to Access
Request your data: email admin@bidswap.my with subject "Data Access Request." Response within 30 days.
9.2 Right to Correction
Update profile via account settings, or email admin@bidswap.my for other corrections.
9.3 Right to Deletion
Email admin@bidswap.my with "Account Deletion Request." Identity verified; processed within 30 days. Some data may be retained for legal/business purposes.
9.4 Right to Data Portability
Request a machine-readable copy (CSV/JSON): email admin@bidswap.my with "Data Portability Request."
9.5 Right to Withdraw Consent
Withdraw consent at any time — may affect Platform access or require account deactivation.
9.6 How to Exercise
Email: admin@bidswap.my. Verified requests answered within 30 days.
10. Minors and Children's Privacy
10.1. BidSwap is not for children under 16. You must be 16+ to create an account.
10.2. Ages 16–17 require parental/guardian consent. By creating an account, you confirm consent.
10.3. We do not knowingly collect data from under-16s. If discovered, we delete it promptly.
10.4. Parents: contact admin@bidswap.my to request deletion.
10.5. Bidding involves real money (MYR). Under the Age of Majority Act 1971 and Contracts Act 1950, under-18s have limited contractual capacity. BidSwap does not assume liability for minor transactions.
11. International Users
11.1. Operated from Malaysia. Prices in MYR, timestamps in Asia/Kuala_Lumpur.
11.2–11.3. Accessible globally. By using BidSwap from outside Malaysia, you consent to data transfer and processing in Malaysia where laws may differ.
11.4. EEA/UK users: BidSwap does not target these markets but makes reasonable efforts to comply where required.
12. Third-Party Links
Platform may link to third-party sites. We are not responsible for their privacy practices.
13. Changes to This Privacy Policy
13.1. We may update this Policy. Effective upon posting with updated date.
13.2. Material changes notified via Platform notice or email. Continued use = acceptance.
13.3. Review periodically.
14. Contact Us
BidSwap
Email: admin@bidswap.my
Website: https://bidswap.my
Governed by the laws of Malaysia, including the Personal Data Protection Act 2010 (Act 709).