What DISIAR collects, why it is needed, who receives it, how long it is kept and the choices available to you.
The operator named below is DISIAR's data controller. This notice covers placement buyers, referrers, payout recipients, visitors and complainants. Contact the operator email for privacy questions, access, correction or complaints.
We receive the URL, category, public website or social-profile metadata, checkout document version and acceptance time, payment amount and time, Stripe IDs, checkout email, referral data, DISIAR metrics, security logs and support messages. For a manual payout, bank or Wise destination details are stored encrypted until the claim is resolved and can be decrypted only inside the authenticated admin dashboard.
Data comes from you, your browser, Stripe, the submitted public destination and our operational providers. We use it for checkout, 72-hour placement contributions, ranking, fraud and duplicate detection, referrals and manual payouts, complaints, security, audit, accounting and legal compliance.
The URL, amount, category and Stripe checkout data are required to buy placement. Checkout email is used for receipts, fulfilment and pseudonymous attribution. A referral account is controlled using its referral code plus a recovery key that its owner must save. You may choose not to buy, refer or request payout. You can block or clear cookies in your browser, but visitor estimates, referral attribution or saved preferences may then be unavailable or less accurate.
Listing name, URL, category, logo or avatar, preview, description, paid-placement label, score, rank, time, amount, views, clicks and CTR may be public. An authorised referrer dashboard also shows the destination for a paid conversion, payment amount, reward, status and attribution end date. It does not show the buyer's name or email. Emails, access tokens, full payment IDs, bank-account numbers and card data are not public.
A random visitor cookie can last up to 12 months; the server stores a hash to deduplicate visitors and estimate who is online. A signed last-touch referral-attribution cookie lasts up to 90 days. Opening another valid referral link replaces the previous code and restarts that period. The server stores a visitor hash, current code and switch time so a referrer can see active or replaced counts without buyer identity. After an attributed payment, a one-way checkout-email hash retains the latest attribution for eligible cross-device purchases until it expires or is replaced; raw email remains in the payment record for fulfilment. DISIAR installs no tracker on listed websites.
Data is shared as needed with Stripe for payments, a bank or Wise when a payout is sent, Cloudflare or infrastructure providers for hosting and security, and authorities where required. Providers may process data outside Malaysia under their own contracts and safeguards. We do not sell buyer contact data.
Transaction, advertising, refund, dispute and provider-event records are kept for at least three years, and longer where accounting, tax, claims, investigations or law require it. Click and view deduplication events are removed after about 45 days; pseudonymous visitor records are removed after 13 inactive months. A lawful public record may remain as all-time history.
We use HTTPS, hosted checkout, webhook signatures, hashed tokens, HttpOnly cookies, access controls and idempotency records. No system is risk-free. Subject to law, you may request access or correction, withdraw optional consent, object to certain processing, request eligible deletion, and complain to Malaysia's Personal Data Protection Commissioner.
DISIAR is not directed to anyone under 18. We may update this notice when features, providers or law change; the update date will be shown and material changes will receive reasonable notice before taking effect where appropriate.