Oovroom privacy policy
Last updated: 2026-10-21. Not legal advice; counsel has not reviewed it.
Who we are
Oovroom is run by Overcode Sdn. Bhd. (company no. 202101011251, registered in Malaysia) ("we"). We are the data user under Malaysia's Personal Data Protection Act 2010 (PDPA). Contact: privacy@oovroom.com.
Oovroom is software for vehicle operators (transfer, limousine and chauffeur companies) to take bookings and run trips. Oovroom's assistant is an AI; a person at Overcode handles every request about your data.
Who this covers
- Passengers and customers who book through the web booking app (app.oovroom.com) or by WhatsApp.
- Operators and their staff who hold a supplier account (portal.oovroom.com).
- People who visit oovroom.com.
What we collect
- Booking details: name, phone number, pickup and drop-off places, date and time, passenger and luggage count, notes you type.
- WhatsApp: your WhatsApp number, your display name and the messages you send to the Oovroom number, including photos you send.
- Payment: you pay the operator, not Oovroom. The operator chooses how: its own payment gateway (Stripe, HitPay or Airwallex) or bank transfer. We receive the payment status, amount and the gateway's reference. We never see or store your full card number, and we never hold your money.
- Bank transfer: you may upload a payment slip (image or PDF). It can show your name, bank and account digits.
- Operator accounts: company name, contact person, email, phone, vehicles, drivers (name and phone), prices and zones.
- Website: oovroom.com sets no cookies and has no analytics or advertising trackers. Our host keeps standard server logs (IP address, time, page) for security.
- We do not collect sensitive personal data on purpose (health, religion, money beyond the payment above). Please do not put it in notes.
Why we use it
- To make, confirm, change and complete your booking, and to tell the operator and driver who and where.
- To record payment status and match bank slips to bookings.
- To reply to you on WhatsApp. You always message us first; we only reply inside your conversation, plus booking confirmations and trip updates for a booking you made.
- To run operator accounts, keep records and prevent fraud.
- We do not sell your data. We do not use it for advertising. We do not send marketing to customers through WhatsApp.
Who receives it
- The operator who takes your booking, and the driver assigned to it, see what they need to do the trip.
- The payment provider the operator chose (Stripe, HitPay or Airwallex), which handles your card payment under its own terms and privacy policy.
- Service providers that process data for us: Cloudflare (hosting, database, file storage) and Meta (WhatsApp Business Platform).
- Authorities where the law requires. Some of these providers store data outside Malaysia. We only use them for the purposes above.
How long we keep it
- Booking and payment records: 2 years.
- WhatsApp message content and uploaded slips: 12 months, then deleted, unless needed for a dispute.
- Operator account data: while the account is open, and 12 months after it closes.
- Backups clear within 90 days of deletion.
- Deletion requests: see /data-deletion.
Your rights
Under the PDPA you can ask to see the personal data we hold about you, ask us to correct it, ask us to stop using it for direct marketing, and withdraw consent. Write to privacy@oovroom.com. We answer within 21 days. See /data-deletion to ask for deletion.
Security
Data is encrypted in transit. Access is limited to the people and systems that need it. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the regulator as the law requires.
Children
Oovroom is not for anyone under 18. Do not book for yourself if you are under 18.
Changes
We post changes here with a new date.
Language
This policy is in English.