Privacy Policy

Last updated 13 July 2026 · Operated by Hefes LLC

Ringkasan (Bahasa Melayu)

AgroX ialah pasar komoditi pertanian tanpa nama (double-blind). Kami mengumpul data yang perlu untuk menjalankan pasaran, tidak pernah mendedahkan identiti pembeli kepada penjual (atau sebaliknya), dan mematuhi Akta Perlindungan Data Peribadi 2010. Anda boleh minta salinan atau pemadaman data anda pada bila-bila masa.

1. Who we are

AgroX is an AI-first, double-blind agricultural commodity marketplace for Malaysia, operated by Hefes LLC(“we”, “us”). This policy explains what personal data we process and your rights under Malaysia’s Personal Data Protection Act 2010 (PDPA).

2. Data we collect

Identity (via Veri5 Passport): name, email, phone, wallet address, account id.
Profile: entity type, land size, and — for sellers/transporters — payout bank details.
Activity: crops, farm events (including geolocation you choose to share), offers, orders, standing wants, messages, and assistant conversations.
Financial: escrow and payout records. Card details are handled by Stripe — we never store them.

3. How we use it

To operate the marketplace (matching, orders, escrow, logistics, traceability), to send you match notifications you have opted into, to run FAMA/government intelligence in aggregated, anonymized form only, and to meet legal obligations.

4. Anonymity (double-blind)

Buyers and sellers never learn each other’s identity — this is enforced in our systems, not just our policy. Transporters receive delivery details only, never commercial identity. Government dashboards show aggregated data; no individual counterparty is identifiable.

5. Sharing & processors

We do not sell your data. We use processors to provide the service: Anthropic(AI assistant), Stripe (payments), Veri5 (identity & traceability). Some processing occurs outside Malaysia; we take steps to protect your data in transit and at rest.

6. Retention

We keep transaction and financial records for as long as required by law. Other personal data is kept only as long as needed to provide the service, and minimized when you delete your account.

7. Your rights (PDPA)

You can access and export your data, correct it, and request erasure. Manage this from your Account → Privacy & datapage, or contact us. Erasure anonymizes your personal data and closes your account; records we must keep by law are retained without your personal details.

8. Security

Encrypted transport (TLS), signed payment callbacks, role-based access with audit logging, and secrets kept out of source. See our engineering notes for detail.

9. Contact

Questions or requests: [email protected].