MSuper Privacy Policy

This policy explains how META TECH CO., LTD. ("we", "us", "our") handles personal information in the MSuper app and the services in it. We are responsible for your information. You can contact us about it at info@mteckh.com.

1. Who this policy covers

• people who use the MSuper app;
• people who shop in our stores and gave their details at the till — our store system shares them with MSuper, so your account is ready if you sign up with the same phone number.

2. What we collect

Information you give us

• Your account: your mobile number, which we confirm by SMS; your name; a password and a 6-digit PIN, which we store only in a scrambled form we cannot read back. If you choose to add them: your e-mail address, date of birth, gender, profile photo and language. We ask for your date of birth before you buy alcohol.
• Addresses: the address, a label, the name and phone number of the person receiving, and the point on the map.
• What you tell us when you contact us.

Information created when you use MSuper

• your orders, payments, M Giftcard top-ups and transactions, M Coins, rewards, offers and promo codes used, and referrals;
• your favourites;
• which banners and offers you were shown, and which you tapped;
• the notifications we sent you;
• the partner discounts you claim: which partner and branch, when, the result of the location check, and which of your signed-in devices made the claim;
• the SMS messages we sent you — the phone number, why we sent it and whether it arrived, but not its text.

Information from your phone

• Sign-in and security: your phone's model, its operating-system and app versions, an ID for this installation of the app, your IP address, the approximate city and country that IP address points to, how you signed in, and when you last used the app. We use this to protect your account and to show you the Devices screen.
• Notifications: a token that lets us send push notifications to your phone, and your phone's model, such as iPhone 15.
• Passkeys: we store only the public part of a passkey. The private part never leaves your phone.
• Face ID and fingerprint are handled by your phone. We never receive them. If you use Face ID to approve payments, your PIN is kept in your phone's secure storage, on that phone only.
• Location, only while you are using the app and only if you allow it. Your phone uses it to find the branches near you — which decides whose prices you see — to sort branches at checkout, to show nearby partner shops, and to fill in your address. When you claim a partner discount at a partner whose branches have their location set, the app sends us your location once, at that moment, so we can check that you are at one of its branches. We keep which branch was nearest, how far you were from it and how accurate your phone said the reading was, and whether your phone reported that an app was setting its location, but not where you were. When your phone works out that you are within 75 metres of a store, the app may offer that store's Wi-Fi; asking us for the Wi-Fi details tells us you are near that store, but we do not keep that. The first time you allow location, we save it as your address; you can change or delete it. We never collect your location in the background.
• Camera, only when you use it: to scan QR codes and to take a profile photo.
• Photos, only the ones you pick: a profile picture, or a picture of a QR code you want to scan, which is read on your phone.
• Crash and error reports: when the app or our server runs into an error, a report of what failed — the screen or request, the app version, your phone's model and system version, and your account number. Never your name, phone number, messages, password, PIN or payment details. We use these only to find and fix faults.
• Products you look at are remembered on your phone only, to suggest products in M-Mart. They are sent to us only as part of the request for suggestions, and we do not keep them. You can switch this off, or clear the list, under Browsing history.

Information from others

• Our store system: your details and purchases at our tills, if you are also a store customer.
• ABA Bank: confirmation of your top-up payments — the amount and the transaction reference. We do not send ABA your name, phone number or e-mail.

3. How we use it

• To provide our services — your account, orders, payments, M Giftcard, M Coins and offers.
• To keep your account and money safe — confirming your phone number, spotting new sign-ins, pausing payments after wrong PINs, and preventing fraud.
• To check your age — we sell alcohol only when your date of birth shows you are 18 or older, and if it shows you are under 18 we do not show you alcohol in the app. Once saved, your date of birth cannot be changed in the app; contact us to correct it.
• To personalise the app — suggesting products based on what you ordered in the last 180 days, showing the prices of branches near you, and choosing which offers and banners to show you. For that we may use your gender, and groups such as whether you hold M Coins or work for our group. We send you a message on your birthday.
• To contact you — about your orders, payments and account, and about offers unless you turn them off.
• To meet our legal duties — such as keeping accounting records, and answering lawful requests from the authorities.
• To improve MSuper — using statistics that do not identify you, such as which products are often bought together.

We do not sell your personal information. The app has no advertising trackers and uses no cookies.

Decisions about you. The order in which products and offers are shown to you is decided automatically. It does not affect your rights.

4. Who we share it with

We share only what each of them needs:

• Our store system (Odoo): it sends us the name, phone number, e-mail and language of store customers. We send it records of payments and M Coins — with your phone number or store-customer number — so our stores and accounts work.
• The till system in our stores, run by [GITS]: when you pay at a till with MSuper, it receives the amount, the result and your customer number.
• Staff at our branches: your name and phone number when they hand over your order.
• Partner shops: when you show a partner discount pass, the staff see your first name and part of your phone number on your screen. We do not send partners your details.
• The company that runs the store you buy from. Some M-Mart stores are franchises run by other businesses. They receive what they need to prepare and hand over your order, such as your name, phone number and what you bought.
• PlasGate, which sends our SMS messages: your phone number and the message.
• Expo, Apple and Google, which deliver push notifications: your device's notification token and the message. Apple also receives the order updates shown in Live Activities.
• Google Maps, which shows maps and finds addresses. The map on your phone loads from Google, so Google sees your phone's internet address and the area shown. Addresses and locations you look up go to Google through our server, without anything that identifies you.
• Our e-mail provider, [e-mail provider], which sends receipts: your e-mail address and the receipt.
• ABA Bank (PayWay), which processes top-ups: the payment only.
• Sentry, in the United States, which collects our crash and error reports for us: the report described in section 2.
• [Hosting provider], which stores our data and backups.
• Authorities, when the law requires it, and others when we need to enforce our terms, prevent fraud, or protect the safety of our customers, staff or anyone else; our professional advisers; and a company that takes over our business, which must protect your information as this policy says.

5. Where your information is kept

Your information is stored on [our servers in … / Amazon Web Services in Singapore], and our backups on [Amazon Web Services in …]. Where it is kept outside Cambodia, we protect it with [contracts and security measures]. By using MSuper, you agree to your information being kept and handled outside Cambodia in this way.

6. How long we keep it

• Your account details: while your account is open. When you delete your account, we delete or anonymise them 30 days later (see Deleting Your Account).
• Orders, payments and M Giftcard records: for [X years], as accounting and tax law require. After you delete your account, they are kept without your name or contact details.
• Information about other people that you give us, such as the person named on an address: only as long as we need it for that purpose.
• Signed-in devices: for 30 days after a device signs out.
• Notifications, the SMS log, and records of banners and offers shown to you: for [X months].
• Partner discount claims: for [X months], so we can answer questions from partners and spot misuse.
• Backups: for [X days].
• Server logs: for [X days].

7. How we protect it

• All traffic between the app and our servers is encrypted.
• Passwords and PINs are stored only in a scrambled form we cannot read back.
• We limit what each member of staff can see to what their job needs, and we limit repeated attempts to sign in or guess a PIN.
• If a security breach puts your information at risk, we will tell you, and the authorities where the law requires.

No system is perfectly secure. If you think your account or information is at risk, contact us straight away.

Your profile photo is stored at a web address that is not published anywhere, but anyone who has that address can open it.

8. Your choices

• Offers: we send offers — deals, new stores and your birthday gift — by push notification. Turn them off at any time in Profile → Notifications. Messages about your orders, payments and account security always come through. We do not send offers by SMS or e-mail.
• Permissions: turn location, camera, photos, notifications and Face ID on or off in your phone's settings.
• Your information: see it in the app, correct it, ask for a copy, or delete your account — see Your Data Requests and Deleting Your Account.

9. Children

MSuper is not meant for children under 13, and people aged 13 to 17 need a parent's or guardian's permission to use it (see the Terms of Service). We do not knowingly collect information from children under 13. If we learn we have, we will delete it.

10. Changes to this policy

We will publish any change here, with its effective date. If a change matters to you, we will tell you in the app before it takes effect.

11. Contact us

• Privacy questions and requests: info@mteckh.com
• Phone: +855 92 777 113, [Support hours]
• Post: META TECH CO., LTD., Phum 7, Veal Vong, Prampi Makara, Phnom Penh, Cambodia
• If you are not happy with our answer, you can complain to [Complaints authority].