Privacy Policy

This Privacy Policy explains how Shadow X Sdn. Bhd. collects, uses, discloses, stores, and otherwise handles personal data in connection with Shadow.

This is Shadow's general privacy policy. Shadow may publish country-specific privacy notices or addenda where local law, product design, payment flows, or regulatory obligations require more specific treatment.

1. Who We Are

Shadow X Sdn Bhd
Company No. 202601007158
1-19-03, Menara Bangkok Bank, Laman Sentral Berjaya, No. 105, Jalan Ampang, 50450 Kuala Lumpur, Malaysia

For privacy enquiries, contact: support@welcomeshadow.com

2. What We Collect

Account data such as name, username, email, phone number, and login identifiers.
Request data such as requests, offers, messages, attachments, reviews, complaints, and support communications.
Payment and payout data such as transaction identifiers, payment method tokens, and payout details.
Device, usage, and location data where needed for product, safety, fraud, or payment-enabled workflows.
Identity verification data where verification is required.

3. Identity and Biometric Verification

Where Shadow requires identity verification, Shadow may ask you to complete a flow operated by a third-party verification provider.

This may involve:

government-issued identity documents;
a live selfie or liveness check; and
metadata needed to confirm the verification result.

Where consent is required for identity or biometric processing, Shadow will ask for it in the relevant verification flow. If you do not provide required consent, you may be unable to use features that depend on verification.

4. How We Use Personal Data

Shadow may use personal data to:

create and operate accounts;
publish and manage marketplace activity;
facilitate messaging, matching, and support;
process payments, refunds, and payouts;
verify identity, prevent fraud, and protect users;
investigate complaints, disputes, and policy breaches;
improve platform performance and reliability;
comply with legal, regulatory, tax, accounting, and security obligations; and
send service communications and, where permitted, marketing communications.

Shadow may share personal data with:

payment, payout, identity, hosting, analytics, customer support, communications, mapping, or infrastructure providers;
professional advisers, auditors, insurers, or acquirers where needed for legitimate business purposes;
law enforcement, regulators, courts, or other authorities where required or reasonably necessary; and
other users, but only to the extent necessary for the marketplace function, such as profile, request, messaging, and completion information.

Shadow does not describe itself as selling personal data in the ordinary course of business.

6. Location and Trust Signals

Shadow may collect approximate or precise location data where product, safety, fraud, or payment controls require it. For providers, this can include selected request-related actions in payment-enabled flows, such as acceptance, start, completion, cancellation, or dispute-related review points.

7. Retention

Shadow keeps personal data only for as long as reasonably required for the purposes above, including account administration, payment records, dispute handling, fraud prevention, and legal compliance.

Different categories of data may be retained for different periods. Shadow may retain records for longer where required for tax, accounting, litigation, regulatory, or trust-and-safety reasons.

8. Security

Shadow uses reasonable administrative, technical, and organisational safeguards, but no system is completely secure. Users are responsible for maintaining the security of their own devices and account credentials.

9. Your Choices and Rights

Subject to applicable law, you may request access to and correction of your personal data, and you may request withdrawal of consent for processing that depends on consent. Some requests may be limited by legal obligations, platform security needs, or other lawful grounds.

Requests may be sent to support@welcomeshadow.com.

10. International Processing

Shadow and its service providers may process personal data outside Malaysia. Where Shadow transfers personal data across borders, Shadow will take steps it considers appropriate for the nature of the data and the transfer.

11. Country-Specific Supplements

Where local law requires different disclosures, rights handling, legal bases, complaint routes, or consent mechanics, Shadow may publish a country-specific privacy supplement. If a supplement conflicts with this general policy, the supplement applies for the relevant country or feature to the extent of that conflict.

12. Cookies and Similar Technologies

Shadow uses cookies and similar technologies as described in the Cookie Policy.

13. Updates

Shadow may update this Privacy Policy from time to time. The latest version will be published on Shadow's website or app.

Effective on 10 June 2026