Privacy Policy

1. Who we are

Teh Asli Hub ("we", "us") sells Expce Nine-Ingredient Herbal Tea (Te Sepuluh Harta) in Malaysia. We are the data user responsible for the personal data described on this page. You can reach us any time on WhatsApp at +60 11-5327 9353.

2. What we collect

When you place an order on our Buy page, we collect:

• Your name
• Your phone number (also used for WhatsApp)
• Your email address — only if you choose to give it
• Your delivery address, city, state and postcode
• What you ordered and how you chose to pay
• Any note you type into the order form

If you subscribe to our newsletter, we collect your email address only.

We do not collect card numbers, bank logins or any payment credentials on this website. Payment is arranged directly with you — cash on delivery or a transfer you make yourself.

3. Why we need it

• To confirm your order with you by phone, WhatsApp or email
• To deliver your parcel to the right address
• To answer your questions and handle any problem with an order
• To keep proper sales records
• To send you offers, only if you subscribed to our newsletter

4. Consent, and how to take it back

We only process your data on the basis of the consent you give when you tick the box on the order form, and to perform the order you asked us for. You may withdraw that consent at any time by messaging us on WhatsApp; we will stop processing your data and delete it unless we are required to keep a record by law. Ordering is entirely optional, and withdrawing consent after an order is complete costs you nothing.

5. Who we share it with

We keep your data to ourselves and our delivery partners. Specifically:

• Courier / delivery company — your name, address and phone number, so the parcel can be delivered.
• Meta Platforms (Facebook / Instagram) — for advertising measurement. See section 6 below for exactly what is shared.

We never sell, rent or trade your personal data, and we do not pass it to anyone else for their own marketing.

6. Cookies and tracking

There are two separate things on this site, and it is worth telling them apart.

Our own visit counter — no cookies

We count how many people visit which page so we know what to restock and what to write about. It runs on our own server: it sets no cookies, stores no IP address and no device details, and keeps only a random id in your browser's sessionStorage that disappears when you close the tab. If your browser sends "Do Not Track" or "Global Privacy Control", it does not count you at all.

Meta Pixel and Conversions API — advertising

We advertise on Facebook and Instagram, and we need to know which adverts actually lead to orders. For that we use the Meta Pixel and Meta's Conversions API. These share the following with Meta:

• Which page you viewed, when you added something to the cart, when you opened the Buy page
• When you submitted an order, its value and currency, and the order reference
• Your IP address and browser type, and the Meta cookies _fbp / _fbc
• For orders, a hashed (one-way scrambled, not readable) version of your email address and phone number, so Meta can tell whether that order came from an advert. We send only the hash — never the plain values.

Meta sets the _fbp cookie (typically valid about 90 days) and may set _fbc when you arrive by clicking one of our adverts. These are advertising cookies, not login cookies. You can see and control how Meta uses this at facebook.com/adpreferences, and read Meta's own privacy policy at facebook.com/privacy/policy. If you would rather not be tracked, you can also block third-party cookies or scripts in your browser settings — the shop will still work normally.

We do not run any other third-party analytics or advertising scripts on this site.

7. How long we keep it

Order records are kept for 24 months from the date of the order, so we can handle delivery problems, replacements and accounting questions. After that they are deleted. If you subscribed to the newsletter, your email address is kept until you unsubscribe — every message we send includes a way to unsubscribe. If you ask us to delete your data, we do it.

8. Your rights

Under Malaysia's Personal Data Protection Act 2010 you have the right to:

• Ask what personal data we hold about you, and get a copy
• Have anything wrong or out of date corrected
• Withdraw your consent and ask us to stop using your data
• Ask us to delete your data, subject to records we must keep by law
• Complain to us, or to the Personal Data Protection Department (JPDP) if you are not satisfied with our answer

To use any of these, just message us on WhatsApp at +60 11-5327 9353 and tell us what you need. We answer within a few working days.

9. Keeping it safe

Orders are stored on our own server and reachable only with our own password-protected dashboard. Access is limited to the people who need to confirm and ship orders. We do not keep card details because we never ask for them.

10. Children

This shop is not intended for children. Our tea is also not suitable for infants or young children — see the product page for details. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

If we change how we handle your data, we will update this page and change the "last updated" date at the top. Material changes will also be flagged in our newsletter.

12. Contact us

Questions about your data, or want it corrected or deleted? Message us on WhatsApp: +60 11-5327 9353.