Localhost Sdn Bhd

Privacy Policy

Last updated: 9 September 2026

This notice explains what personal data Localhost Sdn Bhd collects, why we hold it, and who we pass it to. It is issued under the Personal Data Protection Act 2010 ("PDPA").

One point first: some of the data you give us must be sent to a registry, and part of it can be published. Section 3 covers that — read it before you enter a contact.

1. What we collect

• Account data — name, email address, mobile number, password hash, and your two-factor secret.
• Contact data — the registrant, administrative, technical, and billing contacts for your domains: name, organisation, address, email, and phone.
• Eligibility documents — where a registry requires proof to hold a name, such as a business registration number for a restricted .my level.
• Order and billing data — domains ordered, amounts charged, and the payment reference. We do not store your card number or banking credentials.
• Technical data — IP address, device details, and logs of actions taken in your account.

Where a field is required, we cannot register the domain without it, because the registry will not accept the order.

2. Why we hold it

We use account and contact data to register and manage domains on your instruction, to authenticate you, and to send renewal notices. We use order data to bill you and to meet accounting and tax obligations. We use technical data to keep the service secure and to fix faults. We do not sell personal data, and we send marketing email only where you have opted in.

3. What goes to the registry

To register a domain we must send the registrant and contact details to the registry — MYNIC for .my, the relevant operator for others. The registry keeps them for the life of the registration and applies its own policy.

Registries publish some of this data through WHOIS or RDAP. What is published varies by namespace and changes as registry policy changes. We do not control it and cannot withdraw a name from a registry's public record. Give an address you are content to have associated with a domain publicly.

Registries operate outside Malaysia, so registering a domain transfers your data outside Malaysia. Placing the order is your consent to that. Withdrawing consent means we can no longer keep the domain registered for you.

4. Who else we disclose to

• Payment providers and banks — to take payment and handle refunds and chargebacks.
• Infrastructure and email providers — hosting, backup, and transactional email, acting on our instruction.
• Dispute providers, regulators, and courts — where a domain dispute is filed, or where we are legally required to disclose.

Each receives only the data it needs for that purpose.

5. How long we keep it

Contact data stays for as long as the domain is registered through us, because the registry requires it. Billing records stay seven years to satisfy tax law. Account and log data stay while your account is open and for a limited period afterwards. Data already held by a registry is subject to the registry's retention period, not ours.

6. Security

Access requires two-factor authentication. Traffic is encrypted in transit, passwords are stored hashed, and access to production data is restricted to the staff who need it. Where a breach affects your data and is likely to cause you significant harm, we notify you and the relevant authority. Keeping your own credentials secure is your responsibility.

7. Your rights

Under the PDPA you may ask us for a copy of the data we hold about you, ask us to correct it, or ask us to stop using it for marketing. Most of it you can view and correct directly in your account. For anything else, write to the address below — we respond within 21 days and may charge the prescribed fee for a data access request.

Two limits: data a registry requires for an active domain cannot be erased while that domain is registered, and records kept for tax purposes stay until that period ends.

8. Cookies

We set only the cookies the service needs — your session, your security token, and your interface preferences. We do not use advertising cookies. Blocking them prevents you from signing in.

9. Contact

Requests about your data go to

We may update this notice and will give notice before a material change takes effect.