Privacy Policy

Duta Integra Solutions (TR0325441-K) is a Sole Proprietorship registered under the Registration of Businesses Act 1956. We operate the Leish! platform connecting clients with beauty professionals across Malaysia.

Provided directly by you: • Account details: name, email, phone number, password (hashed) • Profile details (MUAs/studios): portfolio images, service listings, pricing, location, business registration details where applicable • Booking details: appointment date/time, service selected, special requests, location for mobile services • Payment details: processed by Billplz and HitPay — Leish does not store full card numbers • Communications: in-app chat messages, support enquiries Collected automatically: • Device and usage data: IP address, browser type, pages visited, referral source • Cookies and similar technologies for session management and analytics

• To create and manage your account and provider/client profile • To process bookings and payments, including escrow holding and release • To send booking confirmations, reminders, and service-related notifications (via Brevo) • To detect and prevent off-platform contact circumvention, fraud, and policy violations • To respond to support enquiries and resolve disputes • To improve the Platform through aggregated, anonymised analytics • To comply with legal obligations, including tax and business record-keeping requirements

We do not sell personal data. We share limited data only where necessary: • Between client and MUA/studio: contact and booking details needed to fulfil a confirmed booking • Payment processors: Billplz and HitPay, to process transactions • Infrastructure providers: Supabase (database/auth), Vercel (hosting), Cloudflare (DNS/security), Brevo (email), Sentry (error monitoring) • Legal or regulatory authorities, where required by Malaysian law

We retain account and booking data for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, and dispute-resolution obligations (generally up to 7 years for financial records, consistent with Malaysian tax requirements). You may request earlier deletion subject to Section 7.

We apply reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), row-level security on our database, and restricted access to production systems. No system is completely secure, and we encourage you to use a strong, unique password.

Subject to the PDPA, you may: • Request access to the personal data we hold about you • Request correction of inaccurate data • Withdraw consent to certain processing (e.g. marketing communications) • Request deletion of your account, subject to our legal retention obligations To exercise these rights, email support@leish.my. We aim to respond within 21 days as required by the PDPA.

We use essential cookies for login sessions and basic analytics cookies to understand Platform usage. You can control cookies through your browser settings; disabling essential cookies may affect Platform functionality.

Leish is not directed at individuals under 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact support@leish.my for removal.

We may update this policy periodically. Material changes will be notified via email or in-app notice at least 7 days before taking effect.