Privacy notice
Last updated: 19 Oct 2026 · Version 2
Rumamai (rumamai.com) is operated by Aparoo Networks in Malaysia. This notice explains what personal data we handle when you use Rumamai: as a host who creates an event, as a member of a host's team, or as a guest who opens an invitation.
Hosts and guests
Hosts decide what goes on their event: the invitation text, photos, the guest list and the questions guests answer. Rumamai stores and shows this information for the host.
Hosts are responsible for having a reason to add their guests' details and for what they publish. If you are a guest and want your details or photos removed, ask the host. Hosts can remove guests and photos at any time, and a removed photo leaves the public page at once.
What we collect
- Your account: your e-mail address and display name. Your password is handled by the authentication service we use and is not stored in readable form.
- Event content that hosts enter: titles, names of the people the event is about, dates, places, photos, and gift or bank details that a host chooses to show.
- Guest details that hosts enter or guests send: guest and party names, an optional phone number or e-mail address for the host's list, RSVP answers and wishes.
- Guest photos: photos that guests upload, with an optional name. Photo details such as location data are removed when the photo is processed. A guest photo is only shown publicly after the host approves it, and the guest's name is only shown to the host's team.
- Payments: payments are processed by ToyyibPay. Rumamai never sees your card details or your online banking login. We keep records of orders and payments.
- Reports: when someone uses “Report this event”, we keep the report and, only if the reporter gives one, their e-mail address.
How we use it
We use this data to run Rumamai: to build and show invitations, collect RSVPs and wishes, let hosts manage their guests and photos, take payments, keep the service safe and answer support requests.
We send automated e-mail only to account holders and to team members a host invites, for example payment receipts, team invitations, security messages and reminders. Some reminders can be turned off in your account settings. We do not send marketing e-mail, and we do not track whether e-mails are opened or links are clicked.
Rumamai does not send e-mail or WhatsApp messages to guests. When a host shares an invitation, for example on WhatsApp, the host sends it from their own device.
Invitation views
Hosts can see how many times their invitation was viewed. We count views without cookies and without storing anything on your device:
- Your network address is turned into a keyed code that cannot be read back, so each network counts at most once per day. The address itself is never stored.
- The individual view records are kept for 90 days; after that only daily totals remain.
- If your browser sends Do Not Track or Global Privacy Control, your visit is not counted.
- We use no third-party analytics, advertising, tracking pixels or session recording.
- Invitation pages also measure how quickly they load and respond on the visitor's device, grouped only as phone, tablet or computer. No identifier, link or cookie is kept: only daily totals.
Hosts see numbers, not people. Visits by the host's own team and by Rumamai staff are not counted.
Where your data is kept
Rumamai is hosted with Supabase and Vercel in Singapore, so your data is transferred to and stored outside Malaysia. Automated e-mail is sent through a transactional e-mail provider, and payments go through ToyyibPay. These providers handle data only to provide their service to us.
When something goes wrong, a short technical error report (an error code, the page or task concerned and internal reference numbers, never your messages or guests' details) may be sent to an error monitoring service outside Malaysia. Encrypted backups of the database are kept with our code hosting provider; only Rumamai holds the key to open them.
How long we keep it
- Event content and guest details are kept until the host removes them or deletes the event.
- Individual invitation view records are kept for 90 days.
- A reporter's e-mail address is kept for at most 180 days.
- Order and payment records are kept for as long as the law requires, even after an event is deleted.
- Encrypted database backups are kept for 30 days and then deleted automatically.
- To delete your account, contact us and we will do it for you.
Your rights
Under Malaysia's Personal Data Protection Act 2010 you can ask us:
- for access to the personal data we hold about you;
- to correct data that is wrong or out of date;
- to stop or limit how we use your data, or to withdraw your consent;
- to look into a complaint about how we handled your data.
- to send your personal data to another organisation, where this is technically possible.
Send your request through the contact below. If you are a guest, you can also ask the host of the event directly.
If something goes wrong
If a personal data breach happens that is likely to cause you significant harm, we will tell you and the Personal Data Protection Commissioner as the law requires.
Changes to this notice
When we change this notice, we update it on this page and change the date and version at the top.
Contact us
Write to us at support@aparoo.my