Privacy Policy

1. Personal data we collect

• Account and business details: your name, email address, phone number, password (stored in encrypted form), and the shop or business information you provide.
• Content you upload: the images, videos and playlists you add to display on your screens.
• Device and technical data: information from paired screens and the apps you use, such as a device identifier, model and operating system version, app version, pairing code, connection status, IP address, and log and diagnostic data.
• Usage data: basic analytics about how you use the Service, such as features used and actions taken.
• Payment data: billing name, business registration details and transaction records. Card and banking details are processed by our third-party payment provider. We do not store full card numbers.
• Support data: the information you provide when you contact us for support.

We do not ordinarily collect sensitive personal data (as defined in the PDPA), and we do not knowingly collect precise location, contacts, photos beyond the media you deliberately upload, or health data. If we ever need to collect sensitive personal data, we will first obtain your explicit consent.

2. Our apps and device permissions

Our Android TV app and mobile apps request only the permissions needed to run the Service, for example network access to sync content, and storage access to cache media for offline playback. The TV app pairs with your account using a one-time code shown on the screen. The apps do not access your contacts, and they do not track you across other companies' apps or websites for advertising. Any data collected through the apps is used for the purposes set out in this Notice.

3. How we use your personal data

We process your personal data to: create and manage your account; provide, operate and sync the Service across your screens; process payments and issue invoices; provide customer support and communicate with you about the Service; keep the Service secure, prevent fraud and misuse, and troubleshoot problems; improve and develop the Service; comply with our legal and regulatory obligations; and, where you have consented, send you service updates or marketing.

4. Source of your personal data

We collect personal data mainly directly from you when you sign up and use the Service. Some device, technical and usage data is collected automatically from your use of the Service and your paired screens. Payment confirmation data may be received from our payment provider.

5. Consent and withdrawal

We process your personal data on the basis of your consent and where otherwise permitted or required by law. You may withdraw your consent at any time by contacting us. Please note that withdrawing consent may limit or prevent your continued use of the Service.

6. Is providing your data obligatory

Certain personal data (for example, your account and billing details) is required for us to provide the Service. If you do not provide it, we may be unable to offer the Service to you. Other information is optional, and you can choose not to provide it.

7. Disclosure to third parties

We may disclose your personal data to the following classes of third parties, only as needed to operate the Service: cloud hosting and infrastructure providers; our payment gateway provider; communication, email and messaging providers; analytics and diagnostics providers; and our professional advisers. We may also disclose personal data where required by law, to enforce our terms, or to protect the rights, safety and property of OutDeck, our users or the public. We do not sell your personal data.

8. Third-party services and analytics

The Service relies on third-party providers such as cloud hosting and our payment gateway. We may use analytics and crash-reporting tools to understand usage and improve reliability. These providers process data on our behalf under agreements that require them to protect it and use it only for the agreed purposes.

On our public website we use Google Tag Manager and Google Analytics 4 to measure how visitors find and use the site (for example pages viewed, referral source, and whether a visitor starts a demo). This may collect a randomised identifier, approximate location derived from your IP address (which is anonymised and not stored by us), device and browser type, and the pages you visit. Analytics cookies are set only after you consent: by default they are disabled (Google Consent Mode), and you choose whether to allow them via the banner shown on your first visit. These tools are not loaded on the signed-in app. Google processes this data as described in its own privacy policy; typical retention is up to 14 months. You can withdraw consent at any time by clearing the cookie for this site.

9. Transfers outside Malaysia

Some of our service providers may be located outside Malaysia. Where personal data is transferred abroad, we take steps intended to ensure it receives a level of protection consistent with the PDPA.

10. Direct marketing

You may ask us at any time to stop processing your personal data for direct marketing purposes, and we will comply with your request. Marketing emails include an unsubscribe option.

11. Security

We take practical technical and organisational steps to protect personal data against loss, misuse, unauthorised access, modification and disclosure. These include encryption in transit, access controls and the encrypted storage of credentials. No method of transmission or storage is completely secure, but we work to safeguard your data.

12. Retention

We keep personal data only for as long as necessary for the purposes described above, or as required by law (for example, tax and accounting records). Free demo workspaces and their content are removed automatically after the demo period ends. When personal data is no longer required, we take steps to destroy or permanently delete it.

13. Accuracy

We take reasonable steps to keep your personal data accurate, complete, not misleading and up to date. Please help us by keeping your account information current.

14. Your rights

Subject to the PDPA, you have the right to: access your personal data and request a copy; correct inaccurate or incomplete data; withdraw your consent; limit the processing of your data, including for direct marketing; and request data portability where applicable. We will respond to access and correction requests within the period allowed by the PDPA. A prescribed fee may apply to an access request. To exercise any right, contact us using the details below.

15. Account and data deletion

You can delete your account and associated personal data at any time. You may request deletion from within the app or dashboard, or by emailing privacy@outdeck.app from your registered address. When you delete your account, we delete or anonymise your personal data and your uploaded content, except for records we are required to keep by law (such as invoices) and information needed to resolve disputes or enforce our agreements, which we retain only for as long as necessary. We will confirm once the deletion is complete.

16. Children's privacy

The Service is a business tool intended for use by businesses and adults. It is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

17. Data breach notification

If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and, where required, the affected individuals, in accordance with the PDPA.

18. Data Protection Officer

We have appointed a Data Protection Officer who oversees our compliance with the PDPA. You can contact the Data Protection Officer at dpo@outdeck.app.

19. Complaints

If you have any concern about how we handle your personal data, please contact us first. You also have the right to lodge a complaint with the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi Malaysia).

20. Cookies

Our website uses essential cookies to keep you signed in and to keep the Service secure. With your consent, our public website also sets analytics cookies through Google Tag Manager and Google Analytics 4 (see section 8); these are off by default and only enabled if you accept them in the consent banner. A small cookie records your consent choice so we do not ask again. We do not use cookies for third-party advertising.

21. Changes to this Notice

We may update this Notice from time to time. When we do, we will revise the "Last updated" date above, and significant changes may be communicated to you or shown in the app.

22. Language

This Notice is provided in English.

23. Contact us

Outsens Enterprise (operator of OutDeck). For questions about this Notice or your personal data, email privacy@outdeck.app.