Last Updated: 1 January 2026
Effective Date: 1 January 2026
Privacy Policy
Compliance: This Privacy Policy is designed to comply with the Malaysian Personal Data Protection Act 2010 (PDPA), the European Union General Data Protection Regulation (GDPR), and applicable international data protection standards.
1. Introduction
Kalori API ("we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at kalori-api.my and our API services (collectively, the "Service").
By using our Service, you consent to the collection and use of your information in accordance with this Privacy Policy.
2. Data Controller
For the purposes of the PDPA and GDPR, Kalori API is the data controller responsible for your personal data.
Data Controller
Kalori API
Email: privacy@kalori-api.my
Website: https://kalori-api.my
3. Information We Collect
3.1 Information You Provide
When you register for an account or use our Service, we may collect:
- Account Information: Name, email address, username, profile picture
- Authentication Data: Information from third-party login providers (Google, Apple, X/Twitter)
- Communication Data: Support inquiries, feedback, and correspondence with us
3.2 Information Collected Automatically
When you access our Service, we automatically collect:
- Usage Data: API call logs, endpoints accessed, request timestamps, response times
- Device Information: IP address, browser type, operating system, device identifiers
- Log Data: Server logs, error reports, access patterns
3.3 Information from Third Parties
When you authenticate using third-party services, we may receive:
- Google: Name, email, profile picture
- Apple: Name, email (may be private relay)
- X (Twitter): Username, display name, profile picture, email (if authorized)
We only request the minimum information necessary to provide our Service.
4. How We Use Your Information
We use your personal data for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Account creation and management | Contract performance |
| API access and authentication | Contract performance |
| Usage monitoring and rate limiting | Legitimate interest |
| Service improvements and analytics | Legitimate interest |
| Security and fraud prevention | Legitimate interest / Legal obligation |
| Customer support | Contract performance |
| Legal compliance | Legal obligation |
5. Data Sharing and Disclosure
We do not sell your personal data. We may share your information only in the following circumstances:
- Service Providers: Trusted third parties who assist in operating our Service (hosting, analytics, payment processing)
- Legal Requirements: When required by law, court order, or government authority (including Malaysian regulatory bodies)
- Safety and Security: To protect our rights, property, or safety, or that of our users or the public
- Business Transfers: In connection with a merger, acquisition, or sale of assets (with prior notice to users)
- With Your Consent: Where you have explicitly agreed to the disclosure
6. International Data Transfers
Your data may be transferred to and processed in countries outside Malaysia, including countries in the European Economic Area (EEA) and other regions.
When transferring data internationally, we ensure:
- Adequate safeguards are in place (e.g., Standard Contractual Clauses for EU transfers)
- Compliance with PDPA cross-border transfer requirements
- Data protection standards equivalent to those in Malaysia
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Account Data: Retained while your account is active and for 30 days after deletion request
- API Usage Logs: Retained for 90 days for security and analytics purposes
- Financial Records: Retained for 7 years as required by Malaysian tax law
- Legal Hold Data: Retained as required by ongoing legal proceedings
8. Your Rights
Under the PDPA and GDPR, you have the following rights regarding your personal data:
🔍 Right of Access
Request a copy of your personal data we hold
✏️ Right to Rectification
Request correction of inaccurate data
🗑️ Right to Erasure
Request deletion of your personal data
⏸️ Right to Restriction
Request limitation of data processing
📦 Right to Portability
Receive your data in a machine-readable format
🚫 Right to Object
Object to processing based on legitimate interest
To exercise these rights, contact us at privacy@kalori-api.my. We will respond within 21 days (PDPA) or 30 days (GDPR).
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (TLS/SSL)
- Encryption of data at rest
- Secure authentication mechanisms
- Regular security audits and assessments
- Access controls and principle of least privilege
- Employee training on data protection
While we strive to protect your data, no method of transmission or storage is 100% secure. We encourage you to use strong passwords and keep your credentials confidential.
10. Cookies and Tracking Technologies
We use cookies and similar technologies to:
- Maintain your login session
- Remember your preferences
- Analyze website usage and improve our Service
- Ensure security and prevent fraud
Types of Cookies We Use:
- Essential Cookies: Required for the Service to function
- Analytics Cookies: Help us understand how users interact with our Service
You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect Service functionality.
11. Third-Party Services
Our Service integrates with the following third parties:
- Logto: Authentication service
- Google (OAuth): Social login provider
- Apple (Sign in with Apple): Social login provider
- X/Twitter (OAuth): Social login provider
These services have their own privacy policies. We encourage you to review their policies to understand how they handle your data.
12. Children's Privacy
Our Service is not intended for individuals under the age of 13 (or 16 in the EU). We do not knowingly collect personal data from children.
If you believe we have collected data from a child, please contact us immediately at privacy@kalori-api.my, and we will take steps to delete such information.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.
For significant changes, we will provide notice via email or prominent announcement on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.
14. PDPA Notice (Malaysia)
In accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia:
- Your personal data is processed for the purposes stated in this Privacy Policy
- You have the right to access and correct your personal data
- You may limit the processing of your personal data by contacting us
- We will obtain your consent before processing sensitive personal data
- You may lodge a complaint with the Personal Data Protection Commissioner if you believe we have violated the PDPA
15. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:
Kalori API - Privacy Team
Email: privacy@kalori-api.my
General Inquiries: support@kalori-api.my
Website: https://kalori-api.my
By using Kalori API, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal data as described herein.