Privacy Policy

Who we are

LOCAFI is a brand of Newstead Ecom Enterprise, which operates this website at mylocafi.com. For anything in this policy, write to contact@mylocafi.com.

This website does not ask you to sign up

There is no account, no newsletter sign-up and no contact form on this site. We do not ask for your name, address, phone number or payment details here, so there is nothing of that kind for us to store.

Analytics and ad measurement, only if you accept

We use two services, and only if you accept them. Google Analytics 4, from Google, helps us understand how people use this website and which websites and campaigns bring them here, so that we can improve the site and our marketing. The Meta Pixel, from Meta, measures how our Facebook and Instagram ads perform (see “The Meta Pixel” below). Both are off by default. When you first visit, a banner asks whether you accept them; it is one choice for both. Unless you choose “Accept”, neither is loaded, no analytics or advertising cookies are set, and nothing is stored in your browser for them. The site works the same whether you accept or not.

If you accept, Google Analytics records:

• · the pages you view, with each page's title, the website that sent you here, and the language you have chosen on the site;
• · whether you scroll to near the bottom of a page, and how long each page is on your screen;
• · taps on links that take you off this site, including where the link goes, such as WhatsApp or Shopee;
• · which WhatsApp or Shopee button you tap, which part of the page it is in, and, where relevant, the product it is for (LOCAFI MINI, LOCAFI Slim or one of our accessories), the use it is for, the insole length you chose for the Children’s Tracking Insole, and the source reference added to a WhatsApp message (see “When you message us or shop on Shopee”);
• · which product, use (for example children, older family members, pets, cars or luggage) and accessory sections come into view on your screen;
• · how you reached the site: the source and campaign behind your first, latest and current visit (explained below).

What else Google Analytics receives

Like any online service, Google Analytics also receives technical details from your browser: a random ID kept in a cookie on your device; the type, brand and model of your device; its operating system and browser, with their versions; your screen size and language; the date and time of each visit and action; and your approximate location (country, region and city), which Google works out from your IP address.

This is not anonymous. The random ID lets Google Analytics recognise your browser when you come back, but it does not tell us your name or how to contact you.

We never send Google Analytics your name, email address, phone number, home address or payment details, or anything you write to us on WhatsApp. This website has no forms to fill in. Before analytics can see a page address, our site removes sign-in codes and anything that looks like an email address or phone number from it. Analytics never runs on the private admin, sign-in or password-reset pages, or in a browser that is signed in to the admin area.

Where your visit came from

If you accept, our site also notes how you reached it: the website you came from (for example Google, Facebook or Instagram), or the campaign details in the link you followed (such as utm_source or utm_campaign). If the link carried a click code from Google, Facebook or TikTok, as ad links do, it notes which of the three it was. Our site does not keep the code itself (the Meta Pixel does keep a Facebook or Instagram click code, in its _fbc cookie; see “The Meta Pixel”).

These details are sent to Google Analytics each time you tap a WhatsApp or Shopee button, so that we can see which campaigns lead to enquiries and Shopee visits. Google Analytics also receives the campaign details of the page you first arrived on. Our site does not send these records to Meta, but the Meta Pixel reads the page address (including any campaign details still in it) and the website you came from by itself (see “The Meta Pixel”).

To do this, it keeps three records in your browser, each with the page you arrived on and the date:

• · First visit: how you reached the site on your first visit after accepting analytics. It is not overwritten while it is valid. It expires 90 days after that visit: our site then stops using it, and on your next visit replaces it with a record of that visit.
• · Latest visit: the most recent campaign or website that brought you here. A new campaign or website replaces it; coming back the same way restarts its 90 days; a direct visit (typing the address or using a bookmark) never replaces it, and is recorded here only when there is no such record yet. It expires 90 days after it was last updated.
• · Current visit: how you reached the site this time. It is cleared when you close the browser tab.

Google's role, and how long data is kept

Google provides Google Analytics to us and processes this data on its own servers, which may be outside Malaysia, to produce reports for us. Our staff can see those reports. How Google itself uses information from websites that use its services, including this one, is explained at policies.google.com/technologies/partner-sites.

We use Google Analytics for measurement only, not for advertising. Google signals is switched off, so Google does not use signed-in Google account data to link your devices or to add demographics to our reports. Collection of user-provided data (such as email addresses or phone numbers) is switched off, and so is ad personalisation.

We have set Google Analytics to keep this data for 14 months. Data about each visit is deleted automatically 14 months after the visit; the data linked to your browser ID is kept until 14 months after your most recent visit, because each new visit restarts that period. Summary reports built from it, such as the number of visits in a month, do not identify you and are not affected by these limits.

The Meta Pixel (Facebook and Instagram)

If you accept, the Meta Pixel sends Meta only these events:

• · each page you view (except as described in the next section);
• · that the LOCAFI MINI or LOCAFI Slim product card came into view on your screen;
• · that you tapped a Shopee button for LOCAFI MINI or LOCAFI Slim, and which of the two. This only means that you went to our Shopee listing: Meta is never told that you bought anything, or for how much. Taps on the Shopee buttons for our accessories are not sent to Meta.

What else the Meta Pixel receives, and what it never does

We send Meta no event about which uses (such as pets or cars) or accessories you looked at, and nothing about your WhatsApp taps. The page address the Meta Pixel reads can still show the section or campaign link you arrived through (for example a link to the pet collar). Nothing about children or older family members is ever sent to Meta: if the page address or the website you came from mentions them — as the links in our campaigns about children and older family members do — the Meta Pixel is not loaded, or, if it is already running, sends nothing more in that browser tab until a page is loaded again. The same applies if a page address ever contains something that looks like an email address or phone number. Google Analytics still works as described above.

Like Google Analytics, the Meta Pixel also receives technical details from your browser: the address of the page and the website you came from; a random ID kept in a cookie on your device (_fbp); if the link you followed from Facebook or Instagram carried a click code (they add one to ads and to many ordinary links), that click code (_fbc); your device, browser and screen details; the date and time; and your IP address. Where your browser allows it, the request to Meta also carries Meta's own cookies from facebook.com, for example if you are logged in to Facebook or Instagram, and Meta may connect this to your account. Those cookies are Meta's: our site cannot read or delete them, and you can manage them in your browser or in your Facebook or Instagram settings. This is not anonymous.

We never send Meta your name, email address, phone number, home address or payment details, or anything you write to us on WhatsApp. Meta's advanced matching, which would send such details, is not used, and the pixel does not collect buttons or page content by itself (automatic events are switched off). The Meta Pixel never runs on the private admin, sign-in or password-reset pages, or in a browser that is signed in to the admin area.

Meta processes this data on its own servers, which may be outside Malaysia. We use it to see how our Facebook and Instagram ads perform. Meta may also use it, under its own terms, to show our ads to people who have visited this website, and to improve its own advertising services. How Meta uses it, how long Meta keeps it, and how to control the ads you see are explained at facebook.com/privacy/policy.

No other advertising trackers

This website does not use the TikTok Pixel or any other advertising tracker. The Meta Pixel is the only advertising tracker on the site, and Google Analytics is the only analytics service. If we ever add another, we will update this policy first, and it will only run if you accept it.

Cookies and storage the site uses whatever you choose

These are part of the site itself and are used whether or not you accept analytics. Each is set only when it is needed.

• · Your language (locafi.lang, browser storage): so the site opens in the language you picked. Kept until you clear your browser data.
• · Your choice about analytics and ads (locafi_consent, cookie): so that we do not ask again on every page. Kept for up to 12 months; some browsers, such as Safari, delete it sooner, and we then ask again.
• · Staff sign-in (a sign-in cookie and a marker in browser storage, plus a short-lived code in browser storage while a password is being reset): only set when our own staff sign in to the private admin area or reset their password.

Cookies and storage used only if you accept

These are created only after you choose “Accept”, and deleted from this browser if you later reject or withdraw your acceptance.

• · Google Analytics cookies (_ga, and a second cookie whose name starts with _ga_): a random ID that lets Google Analytics recognise your browser, and the state of your current visit. Each lasts up to 2 years from your most recent visit (some browsers, such as Safari, delete them much sooner).
• · Meta Pixel cookies (_fbp, and _fbc if the link you followed from Facebook or Instagram carried a click code): a random ID that lets Meta recognise your browser, and the click that brought you here. Each lasts up to 90 days after it was last set (some browsers, such as Safari, delete them sooner).
• · Campaign details on arrival (locafi_landing, cookie): if you have already accepted and arrive through a link with campaign details (such as utm_campaign), our site moves those details (and, for a campaign about children or older family members, the ad-click code too, keeping only which kind of click it was) out of the page address, so that Google Analytics still receives the campaign details but the Meta Pixel cannot read them. Deleted as soon as the page has read it, and after 30 seconds at most.
• · First and latest visit (locafi.attr.v1, browser storage): see “Where your visit came from”. Each record expires 90 days after it was written or last updated, and our site deletes or replaces it on your next visit after that.
• · Current visit (locafi.attr.session, locafi.attr.seen and locafi.attr.handover, browser storage for this tab only): how you reached the site this time, and short codes for the pages this tab has already counted, so that reloading a page or going back to it is not treated as a new arrival from the same website or campaign, and does not bring the Meta Pixel back to a page reached through a link about children or older family members. (Each page you view, including a reload, is still sent to Google Analytics as a page view, and to the Meta Pixel except as described in “What else the Meta Pixel receives, and what it never does”.) When you accept and the page reloads to start the Meta Pixel, locafi.attr.handover carries how you reached the site across that reload (without any ad-click code), and is deleted as soon as the reloaded page has read it. Cleared when you close the tab.

Accepting, rejecting and changing your mind

The “Accept” and “Reject” buttons sit side by side, and the site works the same whichever you choose. Until you choose, neither service is loaded and nothing is stored for them, and the banner stays at the bottom of the screen. When you accept, the page reloads once, so that the Meta Pixel only ever starts in a page loaded after your choice.

Your choice is remembered for up to 12 months in the locafi_consent cookie, for this browser on this device only. After that, or if your browser deletes the cookie sooner, if you clear your cookies, or if we add something that needs your permission, we ask again. (If you had rejected, your refusal still stands when we add something: nothing new runs until you choose otherwise.)

You can change your choice at any time with “Cookie settings” at the bottom of every page, or with the button below. If you withdraw an earlier acceptance, Google Analytics and the Meta Pixel stop at once (the page reloads if either had already loaded), and we delete the cookies they set on this site (_ga, _ga_…, _fbp and _fbc) and the first, latest and current-visit records from this browser.

Withdrawing cannot remove what Google Analytics or Meta has already received: Google deletes it under the 14-month rule above, and Meta under its own terms. If you want Google Analytics data deleted sooner, write to us before you withdraw or clear your cookies: withdrawing deletes the browser ID from this browser, and without that ID we cannot find your data (see “Your rights”).

When you message us or shop on Shopee

Every enquiry button on this site opens WhatsApp or your email app. If you send us a message we will see your WhatsApp display name and number, or your email address, along with whatever you write. We use it to answer you and to keep track of your order. Messages sent through WhatsApp also pass through WhatsApp itself, under their own privacy terms.

If you have accepted, a WhatsApp message prepared by our site may end with a short, non-personal source reference, such as [Ref: LCF-A7K3]. You can delete it before you send.

When you tap such a button, our site also keeps that reference on our own server for 90 days, together with the same campaign and website details it keeps in your browser (see “Where your visit came from”), so that we can tell which campaign led to an order you place with us on WhatsApp. It holds no click code, nothing else from the page address beyond the page you arrived on, and no personal detail, and we do not send it to Meta, Google or anyone else. For a page about children or older family members, only the reference is kept, without where you came from.

The Shopee buttons take you to our LOCAFI listings on Shopee, where your browsing and any purchase are handled by Shopee under its own privacy policy. If you have accepted, Google Analytics and the Meta Pixel record only that you tapped the button, as described above — not what you do on Shopee or what you write on WhatsApp.

The LOCAFI App is separate from this website

Location information from a tracker is handled inside the LOCAFI App and its own service, not by this website. This site never receives or displays the location of any tracker. What the app collects, and how long it keeps it, is governed by the app's own terms, which you agree to when you set it up.

Your rights

Under Malaysia's Personal Data Protection Act 2010 you may ask what personal data we hold about you, ask us to correct it, or ask us to delete it. Write to contact@mylocafi.com and we will respond. If we are holding an order record we still need for tax or dispute purposes, we will tell you that rather than quietly keep it.

This includes analytics data collected from your browser. Because Google Analytics stores a random browser ID rather than your name, we will tell you how to find that ID so that we can locate the data. This only works while the ID is still in your browser — before you withdraw analytics or clear your cookies. What the Meta Pixel sent is held by Meta: you can see and control how Meta uses it in your Facebook or Instagram settings, as explained at facebook.com/privacy/policy.

Direct orders on mylocafi.com

When you order directly, we collect your name, WhatsApp number and delivery address, the products and quantities, and the language you used. We use them only to deliver the order, contact you about it, handle returns and after-sales support, and keep the business's accounting records.

If you accepted analytics, the order also records how you reached the site, for example a campaign name and whether you came from an ad click (never the click ID itself). If you did not, none of this is recorded.

The website never collects your email, IC or other ID number, card details, passwords or payment screenshots. Payment proof is sent on WhatsApp. For a refund we ask on WhatsApp only for the bank details needed for the transfer; the website keeps only the amount, the date and the transfer reference.

Your order page opens only with its private link. It shows the order and its status, never your name, phone number or address. The order pages are not measured by analytics or advertising tools.

Your delivery details are shared with the courier (Ninja Van) to deliver the order. Order records are kept by our database provider, Supabase, in Singapore, for as long as needed for the order, after-sales support and the business's legal and accounting records.