Privacy Policy

This policy explains what we collect when you use the Araso website, why we collect it, and the choices you have. It applies to the customer account features (registration, login, profile, favourites).

Last updated: 13 October 2026.

• Account details: your full name, email address and hashed password.
• Profile picture: the cropped image you choose to upload (optional).
• Favourites: the menu items you save to your favourites list.
• Technical logs: minimal server logs (timestamp, request path) used for security and troubleshooting.

We use your data solely to operate your Araso customer account: to authenticate you when you log in, to personalise the header with your profile picture, and to remember the dishes you have saved for future visits. We do not sell your data or share it with advertisers.

Passwords are stored as one-way hashes using PHP's password_hash() (bcrypt). We use prepared statements to prevent SQL injection, HTTP-only session cookies, CSRF tokens on state-changing requests, and file-type verification on all uploads.

We retain your account information until you delete your account. Accounts are not automatically deleted because of inactivity. Deleting your account removes your account record, profile picture and saved favourites from the live website.

Technical logs are used for troubleshooting and security. The current system does not automatically delete these logs after 30 days; their retention depends on the application and hosting configuration. Account deletion does not automatically remove technical log entries.

If backups are created, they may contain information from before your account was deleted. These copies remain until the backups are deleted or replaced under the configured backup retention settings. A fixed backup retention period has not yet been established for the live hosting environment.

You can update your name, email and profile picture from your profile page. You may change your password or delete your account at any time; deleting your account removes your profile and favourites from the live website. Technical logs and any backup copies are handled separately as described above.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) you have the right to access, correct or withdraw consent to the processing of your data.

For privacy questions or data requests, please contact Araso Restoran Terapung via the details listed on our location page.