Privacy Policy

PeakPosts (“PeakPosts”, “we”, “us”) helps restaurants turn real diner moments into social content and measures the results. This policy explains what personal data we handle, why, and the choices you have. It applies to our website, our dashboard, and the in-venue content we capture on a client’s behalf.

We process personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA). Where we act for a restaurant, that restaurant is the data user and we are its data processor.

We collect only what we need to run the service:

• Account details — name, email, restaurant name, and login credentials for dashboard users.
• Diner content — photos, videos, and captions captured in venue, plus any handle or first name a diner chooses to share.
• Performance data — reach, engagement, bookings and walk-ins used to measure return on a campaign.
• Usage data — device, browser, and interaction logs collected automatically to keep the product secure and reliable.

We use personal data to:

• create, schedule and publish content across Rednote, TikTok and Instagram;
• report on the reach and revenue a restaurant’s content drives;
• operate, secure, and improve the dashboard and our service;
• respond to enquiries and provide support;
• meet legal, tax, and regulatory obligations.

We do not sell personal data, and we do not use diner content for any purpose beyond the restaurant’s campaign without consent.

Content featuring an identifiable diner is only captured and published with that diner’s consent, recorded at the time of capture. A diner may withdraw consent at any time by contacting us or the restaurant, after which we will stop using their content going forward and remove it from channels we control where reasonably possible.

Once content is reposted or saved by third parties on public platforms, we cannot guarantee its removal from those copies.

We share personal data only with:

• Social platforms (Rednote, TikTok, Instagram) when publishing content, subject to their own terms;
• Service providers that host, store, or process data for us under confidentiality and data-protection obligations;
• The restaurant client whose campaign the data relates to;
• Authorities where required by law or to protect our rights.

We keep personal data only as long as needed for the purposes above, or as required by law. Account data is retained for the life of the account and a reasonable period afterward; diner content is retained for the duration of the campaign unless consent is withdrawn earlier.

We use technical and organisational measures — encryption in transit, access controls, and least-privilege practices — to protect personal data against loss, misuse, and unauthorised access. No system is perfectly secure, but we work to keep yours safe and to notify you promptly of any breach that affects you.

Under the PDPA you may, subject to limits in the law:

• access the personal data we hold about you;
• correct data that is inaccurate or out of date;
• withdraw consent or limit how your data is processed;
• request deletion of content that features you.

To exercise any of these, email privacy@peakposts.com.

We use essential cookies to keep you signed in and a privacy-friendly analytics tool to understand how the site is used in aggregate. We do not use third-party advertising trackers. You can control cookies through your browser settings.

We may update this policy as our service evolves; material changes will be posted here with a new date. Questions about your privacy? Write to privacy@peakposts.com.