Privacy Policy

1. Who we are

CariLori (carilori.com) is responsible for your personal data. The business that runs CariLori is named in our Terms of Use. Contact us at support@carilori.com.

2. Personal data we collect

• Your account: your name and email address. Your password is held by our sign-in provider in scrambled (hashed) form; we never see it. You can also add your company name and phone number.
• Requests you post: the job details (service, hire type, town and state, dates, pickup point, destination, itinerary and description), the contact name and phone or WhatsApp number you enter, the number of suppliers you allow, and when you agreed to share your contact details.
• Supplier listings: company name, contact name, phone number, base location, services and areas covered (with their own words about each service, other services they offer, and the vehicles and machines they have, including tow truck capacity), description, year founded, logo, cover photo and photos, and the account email. Suppliers may also give us their SSM registration number and SSM document.
• Contacts and reports: which suppliers opened a customer's contact details, the outcomes each side records, blocks, reports and anything you send us.
• Technical data: your IP address, which we use to limit repeated attempts and keep only in scrambled (hashed) form, information about your browser and device that Cloudflare's robot check uses to tell people from bots, and the cookies described below. When you create an account, we also record where you first came from (for example Google, TikTok or one of our own links) and the first CariLori page you opened.

We don't collect sensitive personal data such as health, religious or biometric information, and we don't use advertising trackers. To count visits, we may use Cloudflare Web Analytics, which doesn't use cookies or follow you across other websites.

3. Where it comes from

Mostly from you. If you choose "Continue with Google", Google gives us your name and email address. Other users may give us information about you, for example in a report, and Cloudflare tells us the result of the robot check.

If you ask us by WhatsApp, phone or email to post a request for you, we post it with the details you give us, including your name and phone number, only after you agree that matching suppliers may contact you. Suppliers then contact you directly, as with any request, and you can ask us at any time to change or close it.

4. Why we use it

• to create your account and sign you in;
• to show supplier profiles in the public directory;
• to match requests with suitable suppliers and let them contact the customer, up to the customer's limit;
• to show requests and supplier profiles in each reader's language: what customers and suppliers write is translated automatically into English, Bahasa Melayu and Chinese (the original is always one tap away), and we remember the language you choose to read;
• to send emails about your account, such as sign-up confirmation and password reset (each with a link and a 6-digit code), and, if you list a business, emails about new requests that match it (you can turn these off in Settings → Notifications);
• to catch a mistyped email address before we send anything to it: while you type it on the sign-in, sign-up or password pages, only the part after the @ (for example gmail.com) is looked up in Cloudflare's public DNS to see whether it can receive email, and it isn't stored;
• to keep CariLori safe: stopping spam, bots, fraud and abuse, reviewing reports and suspending accounts;
• to answer your questions and requests, to improve CariLori, and to learn which of our advertising and promotion brings people to it;
• to meet our legal obligations and to establish or defend legal claims.

We don't sell your personal data, and we won't use it to send you marketing without your agreement.

5. What is public, and who can see what

• Anyone: supplier profiles (company name, location, description, year founded, logo, cover photo, photos, services and areas, vehicles and machines, and the supplier's own words about them, but never the supplier's phone number, email or SSM details), and each request's title, service, vehicle or machine (including any the customer types under Others), hire type, town, state and when it was posted. If you leave the title blank, it is made from the vehicle, service and town; your description is not public.
• Registered suppliers: also a request's description and dates. Suppliers whose services and areas match also see the first name of the request's contact person, in Find work and in their job alert email.
• Matching suppliers you allow, up to your limit: your contact name, phone and WhatsApp number, pickup point, destination and itinerary for that request. Once a supplier has seen them, we can't take them back, and the supplier is responsible for how they use them.
• Customers: the names of the supplier companies that opened their contact details. We also email the customer each one's contact person, phone number and profile link, so they know who is calling.
• The CariLori admin: account, request and listing details as needed to run and moderate CariLori, including SSM documents. Every time an SSM document is opened, it is logged.

6. Who we share it with

• suppliers who match your request, as explained above;
• service providers that run CariLori for us: Cloudflare (hosting, database, file storage, security, the robot check, checking that an email domain can receive email, and sending our emails), Supabase (sign-in and account emails), Google (Google sign-in: the sign-in and sign-up pages load Google's sign-in button from Google, so Google can see that you opened them), TypeSafe (only when you select Fill in the form for me or type a request on the home page: it reads your job description, with phone numbers, emails and WhatsApp links removed first, and suggests the form's answers) and Anthropic (its Claude AI translates what customers and suppliers write in requests and business profiles: a request's title, description, duration and typed vehicle, and a profile's description, service notes and typed services and vehicles, with phone numbers, emails and links removed first; names, phone numbers and addresses are never sent). They may use the data only to provide their service to us;
• the police, courts, regulators or others when the law requires it, or when it is needed to protect someone's rights or safety;
• a buyer or successor if the CariLori business is transferred. We would tell you first.

7. Transfers outside Malaysia

Our service providers may store or process data outside Malaysia, for example in Singapore, the United States or other countries where Cloudflare operates. When that happens, we take steps so that your data stays protected to a standard similar to the PDPA.

8. How long we keep it

• We keep your personal data while your account is open, and only as long as we need it for the purposes above.
• Request contact history is kept after a request closes, so that both sides can still record outcomes and report problems.
• If you delete your account (Delete account in your account settings) or ask us to, it is hidden straight away and your personal data is deleted or anonymised 14 days later. Until then you can keep the account with the link we email you. A supplier can close only their business in the same way. We may keep what we need to handle an open report or dispute, to stop a suspended person from coming back, or to meet a legal obligation (for example which Terms you agreed to, and a record that the account was deleted), and only for as long as we need it. People who already received your phone number through CariLori keep their own copy.
• Every night we make a private backup copy of the database and the uploaded files, so that we can recover from a mistake or an attack. Each copy is deleted automatically after 90 days, so information you deleted can remain in these backups for up to 90 days. We use them only to restore CariLori.

9. How we protect it

CariLori uses encrypted connections (HTTPS). Sign-in sessions and IP addresses are stored only in scrambled (hashed) form. SSM documents are private, and only the CariLori admin can open them. Phone numbers and email addresses are hidden in admin lists, and admin actions are logged. Logos and photos are saved without hidden details such as the camera's location, and documents that contain scripts are refused.

No system is perfectly secure. If a data breach is likely to cause significant harm, we will tell the Personal Data Protection Commissioner and the people affected, as the law requires.

10. Your rights and choices

• See your data: ask us for a copy of the personal data we hold about you.
• Correct it: change most details yourself in your account settings or the supplier portal, or ask us to correct them.
• Withdraw consent or limit use: close a request to stop new suppliers seeing your contact details, turn alerts off in your notification settings, or ask us to stop using your data for a particular purpose. If you withdraw consent we need to run CariLori, we may not be able to keep your account open.
• Delete your account: use Delete account in your account settings (or Settings in the supplier portal), or ask us to do it, as described above. Suppliers can close only their business there too.

Email support@carilori.com from the address on your account. We will reply within 21 days. If you are unhappy with our answer, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

What you must give us: your name and email address are needed to create an account. A contact name and phone number are needed to post a request, because otherwise suppliers can't contact you. Suppliers need business details, services and areas to be listed. Everything else, such as your phone number on your account, a logo, cover photo, photos and SSM details, is optional. If you don't give us required information, we can't provide that part of CariLori.

11. Cookies and browser storage

• ph_session keeps you signed in for up to 30 days.
• ph_auth_flow is used for about 10 minutes when you open the sign-in or sign-up page, for signing in with Google.
• On the sign-in and sign-up pages, Google's sign-in button may use Google's own cookies.
• Cloudflare may set cookies it needs for security and the robot check.
• carilori_src remembers for 30 days where you first came from (for example Google, TikTok or one of our own links) and the first page you opened. It is saved with your account if you sign up. If you sign up with email, we keep it with a scrambled (hashed) copy of your email address until you open the link or enter the code from the confirmation email, for at most 30 days.
• Your browser remembers your language choice, and keeps an unsent request draft until you post it.

We don't use advertising cookies or cookies that follow you across other websites.

12. Children

CariLori is for people aged 18 and over. We don't knowingly collect personal data from children.

13. Changes to this policy

We will post any changes here and update the date at the top. If we make an important change, we'll tell you on the website or by email.

14. Contact us and language

Email support@carilori.com.

This notice is available in English and Bahasa Melayu. If the two versions differ, the English version applies.