Last updated: 30 September 2026

Who we are

amaboxly.com is run by Amaboxly Enterprise (SSM registration 202003003614 (003064642-U)), Ampang, Selangor, Malaysia. Our travel services (flight and hotel search, the Trip Planner) are provided by Amaboxly LLC, New Hampshire, USA. In this policy “we” means both companies.

Questions or requests about your data: email [email protected], WhatsApp +1 (603) 440-9886, or use the contact page.

What we collect

• Orders and account: your name, email, phone or WhatsApp number, billing and delivery address, what you ordered, payment status, order notes, and whether you asked for WhatsApp updates.
• Payments: payments are taken by Billplz (FPX online banking), senangPay (cards, FPX, buy now pay later) and Stripe (cards). They handle your card or bank login details; we never see or store full card numbers. We receive a confirmation and a payment reference.
• Refund bank details: if we owe you a refund, you give us the account holder name, bank and account number through the refund form on your account page. They are stored with your order and used only to make the transfer.
• Messages: anything you send us by WhatsApp, Telegram, email, the contact form or the product refund form.
• Cart reminders: if you enter your email (and optionally your WhatsApp number) in the “hold this cart” box on the cart page, we keep them to remind you about that cart.
• Reseller applications: name, WhatsApp number, email, where you sell, expected volume and, if you choose to give it, an IC or SSM number for verification.
• Trip Planner requests: the travel dates, destinations, travellers and preferences you enter.
• Reviews: the star rating and text you post after delivery, shown on the product page with your first name.
• Automatic data: IP address, device and browser type, the pages you view, how you reached the site (referring site, ad campaign) and a visitor identifier cookie. This is collected by our site and by the services listed below. See our Cookie Policy.

How we use it

• To fulfil your order: buying the item from the US store on your behalf, shipping, customs, delivery, and the payment, item status, balance and delivery updates we send you by email and, if you opted in, WhatsApp.
• To process refunds, returns and warranty questions.
• To answer your messages and provide customer service.
• To remind you about an unpaid order or a saved cart, by email or, only if you opted in, by WhatsApp. You can stop these at any time by telling us.
• To run the reseller programme and the Trip Planner service you applied for.
• To keep the site secure, prevent fraud and comply with tax and accounting law.
• To understand how the site is used (analytics) and to measure our advertising. We send purchase and page view events to Meta (Facebook and Instagram) and Google; contact details in those events are hashed (scrambled) before they are sent.

Who we share it with

• Delivery: Pos Laju and courier partners in Malaysia, FedEx for international orders, and the courier booking service we use to print labels. They receive your name, address and phone number.
• Payment providers: Billplz, senangPay and Stripe.
• Messaging and email: WhatsApp (Meta), Telegram and our email delivery service (Brevo) when we contact you.
• Hosting and security: our website host in the United States and Cloudflare, which protects and speeds up the site.
• Analytics and advertising: Google (Google Analytics, Google Tag Manager), PostHog and Meta. See the Cookie Policy for what they set.
• Authorities: if the law requires it, for example customs declarations or tax records.

We do not sell your personal data. The US stores we buy from do not receive your details.

Where your data is kept

Our website is hosted in the United States and we operate from Malaysia and the United States, so your data is processed in both countries. Some of the service providers above may process data in other countries under their own safeguards.

How long we keep it

• Order records, invoices and refund records: as long as Malaysian tax and accounting law requires, which is at least seven years.
• Your account: until you ask us to delete it.
• Cart reminder details: up to 30 days after the reminder.
• Messages: as long as needed to deal with your request, then as part of the order record if they relate to an order.
• Analytics data: kept by Google, PostHog and Meta for the periods set in their tools, mostly in aggregated form.

Your rights

Under the Personal Data Protection Act 2010 (Malaysia) and, where it applies, other data protection laws, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or out of date;
• delete your account and data, unless we must keep it for tax, accounting or legal reasons;
• stop sending you marketing or WhatsApp updates, at any time.

Write to [email protected] or message us on WhatsApp. We answer within a reasonable time and may ask you to confirm your identity first. You may also complain to the Personal Data Protection Department of Malaysia (JPDP).

Security

The site uses HTTPS encryption, is protected by Cloudflare, and access to order data is limited to the people who need it to serve you. No method of storage or transfer is completely secure, so we cannot guarantee absolute security.

Children

amaboxly.com is for adults aged 18 and over. We do not knowingly collect data from children.

Changes to this policy

When we change this policy we post the new version here with a new date. Important changes will be announced on the site.