1. Who we are

MEIRAN is operated by an individual in Japan who is the data controller (the “Operator”). This policy explains how we handle personal data, in line with Japan's Act on the Protection of Personal Information and Malaysia's Personal Data Protection Act 2010 (PDPA).

2. Data we collect

Account data: email address, phone number (verified by SMS one-time code), password (stored hashed by our authentication provider), and optional profile details such as name, date of birth and gender.

Content you submit: reviews, photos you attach, bookmarks and likes, and messages you send through the Contact form.

Usage data: when you tap a salon's booking/WhatsApp link we log the event (which salon/menu/style) so the Operator can measure interest; we do not see the content of your WhatsApp conversation. We also keep a language preference cookie and login session cookies.

3. Why we use it

To create and secure your account and verify you are a real person; to show your reviews and bookmarks; to respond to inquiries; to connect you with salons; to prevent abuse and spam; and to improve the Service. We do not sell personal data.

4. Who we share it with

Service providers that process data on our behalf: Supabase (database and authentication), Twilio (SMS verification) and Cloudflare (hosting and delivery). These providers may process data outside your country, including outside Malaysia and Japan.

Reviews you post are public and show the display name you provide. When you contact a salon via WhatsApp, the information you send goes to that salon under its own practices. We may disclose data when required by law.

5. Cookies

We use only essential cookies: a login session cookie and a language preference cookie. We do not currently use advertising or analytics cookies. If that changes we will update this policy.

6. Retention and security

We keep account data while your account is active and delete it after you ask us to close the account, except where we must retain it by law or for abuse prevention. Unverified sign-ups are deleted automatically after a short period. We use access controls and encrypted connections, but no system is perfectly secure.

7. Your rights

You may request access to, correction of, or deletion of your personal data, and may withdraw consent, by using the Contact page. You can also edit most profile data from My Page. Some features cannot work without the data they need.

8. Children

The Service is not directed at children under 13 and we do not knowingly collect their data.

9. Changes

We may update this policy; the latest version is always on this page with its update date.

10. Contact

For privacy requests or questions, please use the Contact page of the Service.