1. About this Notice
1.1 This Notice explains how native.cards uses cookies and other storage in your browser. It supplements our Privacy Notice and should be read with it. native.cards is the name and brand under which Platehaus Sdn. Bhd. operates the Platform; "we", "us" and "our" mean Platehaus Sdn. Bhd.
1.2 It applies to native.cards and to every page served under the native.cards domain, including the pages of a business at its own native.cards web address.
1.3 A complete, itemised list of everything the Platform keeps in your browser, with each name, purpose and lifetime, is published at https://native.cards/legal/browser-storage (Bahasa Malaysia: https://native.cards/ms/legal/browser-storage). That list is generated from the Platform itself and is the authoritative inventory. This Notice describes the categories and your choices.
2. What these technologies are
(a) A cookie is a small text file that a website asks your browser to keep and to send back with later requests.
(b) Local storage and session storage are areas in which a website can keep information in your browser. Session storage is cleared when you close the tab; local storage remains until it is cleared.
(c) Cache storage and a service worker allow a website to keep a small set of files so that it can be installed to, and opened from, your home screen.
3. What we do not use
3.1 No advertising or analytics trackers. The Platform does not place advertising cookies, analytics cookies, tracking pixels, tag managers, session-recording tools or social media plug-ins in your browser, and does not use cookies to follow you across other websites.
3.2 No sale of browsing data. We do not sell or share information kept in your browser with advertisers.
3.3 Where a business shares information with an advertising platform, it does so only with your separate agreement, and the sharing takes place between servers; nothing is placed in your browser for that purpose. See section 10 of the Privacy Notice.
4. What we use, and why
All cookies set by the Platform are first-party cookies: they are set by native.cards and are not readable by other websites.
4.1 Strictly necessary
These are required for the Platform to work and to keep it secure. The Platform cannot function properly without them.
| Purpose | What is kept | How long |
|---|---|---|
| Keeping you signed in | A sign-in session cookie, set separately for native.cards and for each business's web address; signing in at one is carried to the others (see the next row) | Until you sign out; otherwise up to 400 days from your last visit |
| Carrying your sign-in between native.cards and a business's web address | Session storage noting that this address has already checked whether you are signed in; it holds a time and a fingerprint of the sign-in, not your name or email | Until you close the tab |
| Completing sign-in with Google or Apple | A short-lived verification cookie | A few minutes |
| Keeping other business accounts signed in on the same browser, so a person who works in more than one can switch between them | A cookie that scripts on the page cannot read, holding each account's email, the business it works in and its sign-in, sealed so that only native.cards can open it; members' accounts are never kept in it | 31 days; an account unused for 30 days is dropped, and all of them go when the browser signs out from disuse |
| Recognising a browser that has signed in to your account before, so that WhatsApp sign-in needs no extra step on it | A cookie that scripts on the page cannot read, holding a random identifier, set separately for native.cards and for each business's web address; we keep with your account only a one-way value derived from it | 400 days from the last sign-in on that browser; forgotten sooner when you sign out your other devices or use the “Not you? Sign out everywhere” link in a WhatsApp reply |
| Signing in or verifying your telephone number with WhatsApp | A cookie holding a random secret that links this browser to the attempt, and a cookie marking that an attempt is waiting; neither holds your name, email or number | 15 minutes at most |
| Connecting a QR code you scanned to the pages that follow | A cookie holding the code and a random number | 2 hours |
| Letting the same browser add or manage a card after you open an emailed link | Secure session cookies | 10 to 15 minutes |
| Remembering that you entered the passcode for an identification page | A cookie for that page | Until the passcode changes, or 12 hours |
| Confirming that the approval coming back from a service a business is connecting (for example a point-of-sale system) is the one that was started | A verification cookie for each connection | 10 minutes |
| Keeping an unfinished joining form while your email address is verified | Session storage holding the details you have typed | Until you close the tab or finish joining |
| Preventing a request from being carried out twice after a lost connection | Session storage markers | Until you close the tab |
4.2 Functional
These remember choices and what your device has already shown, so that the Platform behaves as you expect. They do not track you across websites.
| Purpose | What is kept | How long |
|---|---|---|
| Crediting your joining to the member who invited you | A cookie holding the invitation code | 30 days, or until you join |
| Crediting your joining to a social media reply you followed | A cookie holding a signed reference to that reply | 7 days, or until you join |
| Telling a new device from one that has opened an identification page before, for the security of the card holder | A cookie holding a random number; only a one-way digest of it is recorded | 400 days |
| Remembering which program a business's dashboard is showing | A cookie | 1 year (and a marker lasting a few seconds when switching) |
| Signing a business page out after 30 days without use, or after 12 hours where the browser was last used for the scanner or the Counter | A cookie holding the time of your last request on a business page and whether it was at the counter | 31 days |
| Hiding a list of suggestions you have put away | A cookie | 1 day |
| Remembering whether the list beside a dashboard page shows names or only icons | A cookie | 1 year |
| Showing a celebration once only, and remembering the last area you used | Local storage | Until cleared |
| Keeping a live Family Account invitation link | Local storage | Until the link expires (48 hours) |
| Recovering unsaved design work in the business dashboard | Local storage | Until saved or discarded |
| Remembering notices already shown and articles already read | Local storage | Until cleared |
| Allowing the counter scanner to be installed to a home screen | Cache storage and a service worker holding icons and a name only | Until replaced |
5. Other parties
5.1 Cloudflare Turnstile. Certain forms are protected against automated abuse by Cloudflare Turnstile. When such a form is displayed, your browser loads a check from Cloudflare, which receives your IP address and technical signals about your browser and device in order to decide whether you are a person. Cloudflare acts as our service provider for this purpose.
5.2 SecurityScorecard. Certain public pages of native.cards display a security rating badge supplied by SecurityScorecard, which is loaded from its servers and therefore receives your IP address and browser details.
5.3 Sign-in, wallet and maps. If you choose to sign in with Google or Apple, to save a card to Apple Wallet or Google Wallet, or to open a map link, you leave the Platform and the provider concerned applies its own cookies and policies.
5.4 No other party's code is loaded by the Platform. A technical policy enforced by the Platform prevents any other source from loading.
6. Your choices
6.1 Strictly necessary storage cannot be switched off within the Platform, because the Platform cannot operate without it. By using the Platform you agree to its use.
6.2 You can delete or block cookies and other storage through your browser's settings. If you do, you may be signed out, an unfinished form may be lost, and some features may not work.
6.3 Signing out at any address signs you out at native.cards and at every business's web address.
6.4 We do not respond to browser "Do Not Track" signals, because the Platform does not track you across websites.
7. Changes
We will update this Notice, and the itemised list referred to in clause 1.3, when what the Platform keeps in your browser changes. The date at the top of this Notice shows when it was last revised.
8. Contact
Questions about this Notice: admin@native.cards.
Questions about this document: support@native.cards. All legal documents