Contents
Who we are
1.1.UgathSell is a secondhand marketplace for university students in Malaysia, run by an independent operator. We are not a registered company. We are responsible for the personal data described here under the Personal Data Protection Act 2010 (PDPA).
1.2.Questions, requests and complaints about your data: ugathsell.help@gmail.com.
What we collect
2.1.Your account. Your email address and a password, which our sign-in provider stores scrambled — we never see it. If you use Continue with Google, we receive your name, email address and profile photo from Google.
2.2.Your profile. The display name, photo, university and campus you choose.
2.3.Your listings. Title, description, price, category, condition, campus and photos.
2.4.Your messages. What you write to other members, and any photos or files you attach.
2.5.What you send us. Messages through the Contact page and their photos; reports and the screenshots you attach; appeals.
2.6.A record of profile changes. When you change your display name, photo or university, we keep the old and new value. This is how we spot someone changing their name to look like another member or like us.
2.7.Things you do on the site. Listings you save, your notifications, the members you block, and how many times each listing has been viewed — a count, not who viewed it.
2.8.Searches. The words typed into search and the university filter in use. These are not linked to you or your account.
2.9.Visitor statistics. How many times each page is opened, which country a visit came from, and the kind of browser and device used. These are counts, kept by our host's analytics; they set no cookies and are not linked to you or your account.
2.10.Technical logs. Our hosting and database providers keep standard server logs — IP address, browser type, the time of a request — for security and to fix problems.
An email address is the one thing you must give us: without it there is no account. Everything else is up to you, though a listing needs a title and a price.
Why we use it
3.1.To run your account and sign you in.
3.2.To show your listings and public profile to other people.
3.3.To deliver your messages and notifications — including an email when a message to you has waited unread for 15 minutes, at most one per conversation until you read it. You can turn these emails off in your profile's settings.
3.4.To keep the marketplace safe: looking into reports, removing listings that break the Marketplace rules, suspending accounts, deciding appeals, and stopping spam and impersonation.
3.5.To answer messages you send us.
3.6.To see, in total and never per person, how the site is used — the most common searches, for example — so we can improve it.
We do not sell your data. We do not use it for advertising, and we do not send marketing email.
Who can see it
4.1.Anyone, logged in or not: your display name, photo, university and campus, and your active listings. Do not put anything in these that you would not want public.
4.2.The member you are talking to: your messages to them.
4.3.Our moderators: account email addresses, the profile change record, reports, appeals and Contact messages. Moderators do not browse private chats. When a conversation is reported, a copy of its recent messages is attached to the report so a moderator can decide it. Listings and messages are also checked automatically for phrases common in scams, such as asking for payment before meeting: a listing with one is shown to moderators first, and for messages they see only how many of a member's messages had one and which phrases, never the messages.
4.4.Authorities, only when the law requires it, or to protect someone from serious harm.
The services we use
These companies handle data for us, only to run the site:
a)Supabase — our database, file storage and sign-in. Its servers for UgathSell are in Singapore.
b)Google — our emails are sent through Gmail, so your email address and the emails we send you pass through Google. Google also signs you in if you choose Continue with Google.
c)Cloudflare — the security check on the sign-up, log-in and password reset pages, which looks at your browser and device to tell people from bots.
d)Our web host — the company that serves the website to your browser, and counts visits for us as described above.
This means your data is stored outside Malaysia, in Singapore, and that emails and the security check pass through Google's and Cloudflare's servers in other countries. By using UgathSell you agree to that transfer. These providers are bound by their own security and data protection terms.
How long we keep it
6.1.Your account, profile and change record: until you delete your account.
6.2.Listings: a listing is shown for 60 days, then stays in My listings until you delete it or your account.
6.3.Notifications: 90 days once read, a year if never read.
6.4.Searches: 90 days.
6.5.Screenshots attached to reports: deleted some time after the report is decided, usually 90 days.
6.6.Server logs: as long as our providers keep them, typically a few days to a few weeks.
When you delete your account (Profile → Delete account), we delete your profile, listings and their photos, conversations and messages — including the other person's copy — your saved listings, notifications, blocks, appeals and change record. We keep reports you filed and our moderation decisions, with your name removed from them, so a decision still has its record. Messages you sent through the Contact page keep the name and email they were sent with; ask us and we will delete them.
Cookies and similar technologies
Like most websites, UgathSell keeps a small amount of information in your browser, using cookies and similar technologies, so that the site works as it should. We use them for things like:
a)keeping you signed in, and your account secure;
b)remembering your preferences, such as the filters you use and the listings you save;
c)keeping basic figures accurate, such as how often a listing is viewed.
These are needed for the site to work, and we do not use them for advertising. You can clear or block them in your browser settings, although some parts of the site, such as signing in, may then stop working. If we start using other kinds, we will update this policy first.
Your rights
8.1.See your data. Most of it is on your profile and in My listings. Email us for a copy of the rest.
8.2.Correct it. Edit your profile or listing at any time, or ask us.
8.3.Delete it. Delete your account from your profile, or ask us. A suspended account has to be appealed first, so a suspension cannot be escaped by signing up again.
8.4.Withdraw your consent. Delete your account, or ask us. We then stop using your data, apart from the records described in section 6.
8.5.Complain. Tell us first and we will try to put it right. You can also complain to the Personal Data Protection Commissioner of Malaysia.
Send requests to ugathsell.help@gmail.com from the email address on your account. We reply within 21 days.
Keeping it safe
9.1.Everything travels over an encrypted connection (HTTPS). Passwords are stored scrambled. Private data such as messages, reports and Contact photos can be read only by the people allowed to see them, enforced by the database itself. No system is perfectly secure: if a breach puts your data at risk, we will tell you and the Personal Data Protection Commissioner, as the law requires.
Age
10.1.UgathSell is for people aged 18 and over. If we learn that an account belongs to someone younger, we will delete it.
Changes to this policy
11.1.When we change this policy we update the date at the top. If a change affects how your data is used, we will say so on the site before it takes effect. The Terms of Use cover everything else about using UgathSell.