platehaus.my Cookie Policy (v1)

Effective date: 2 Nov 2026

Version: v1.8 • Last Updated: 2 Nov 2026

Who we are / Data Controller: Platehaus Sdn. Bhd. (SSM: 202501045049) operating platehaus.my

Contact (privacy): support@platehaus.my

Registered Address:

CT-06-21 Subang Square Corporate Tower,
Jalan SS15/4G, SS15
47500 Subang Jaya
Selangor

This Cookie Policy explains how platehaus.my uses cookies, web beacons, and similar tracking technologies (collectively, "Cookies") on our website and in our services. This policy forms part of our Personal Data Protection (PDP) Notice and should be read alongside our Privacy Policy.

This Policy complies with Malaysia's Personal Data Protection Act 2010 (PDPA) principles and international best practices.

Bahasa Malaysia: A Bahasa Malaysia (BM) version will be provided. If there is any inconsistency, the English version controls.

1) What are Cookies?

Cookies are small text files that are placed on your device when you visit a website. They are widely used to make websites work more efficiently, provide information to the website owner, and enhance user experience. Similar technologies (local storage, session storage, web beacons, pixels) work in similar ways.

2) Types of Cookies We Use

We use the following categories of Cookies:

2.1 Essential / Strictly Necessary Cookies

Purpose: These Cookies are necessary for the website to function and cannot be switched off. They enable basic functions like page navigation, access to secure areas, and remembering your authentication status.

Examples:

Sign-in Session
- Name: sb-my-auth-token (and sb-my-auth-token-code-verifier while you sign in with Google)
- Purpose: Keep you signed in across pages
- Duration: Until you sign out (the session renews itself while you use the Platform)
- Type: Browser localStorage on platehaus.my, written by our authentication provider's software (Supabase)
Sign-in Return Page
- Name: platehaus_auth_return_path
- Purpose: Take you back to the page you were on after you sign in
- Duration: Until you close the browser tab
- Type: Browser sessionStorage
Ad Cookie Choice
- Name: ph_tracking_consent
- Purpose: Remember that you turned ad cookies off on this browser (see Section 5.2)
- Duration: 13 months
- Type: Secure first-party cookie
Cookie Notice
- Name: ph_cookie_notice_seen
- Purpose: Remember that you have seen the cookie notice
- Duration: Until you clear browser data
- Type: Browser localStorage

Legal basis: Necessity for the performance of a contract (providing our services).

Can you opt out? No—these Cookies are essential for the Platform to function.

2.2 Functional / Preference Cookies

Purpose: These Cookies allow the website to remember your preferences and choices (e.g., language, region, display settings) to provide enhanced, personalized features.

Examples:

Banner Dismissal Preferences
- Name: disclaimer-dismissed, homepage-disclaimer-dismissed, exploreBannerClosedAt, platehaus-3d-new-dismissed
- Purpose: Remember that you have dismissed informational or promotional banners
- Duration: 7 days (disclaimers), 14 days (Explore panel), until cleared (3D preview badge)
- Type: Browser localStorage
Order and Enquiry Records
- Name: payment_notice_sent:[order_id], platehaus_browser_actor_id
- Purpose: Stop the same payment notice being sent twice, and tell apart WhatsApp enquiries and checkouts made from the same browser (a random six-character ID)
- Duration: Until you clear browser data
- Type: Browser localStorage

Legal basis: Your consent (implied by continued use).

Can you opt out? Yes—you can delete these via your browser settings, but this will reset your preferences.

2.3 Analytics / Performance / Advertising Cookies

Purpose: These Cookies help us understand how visitors interact with our website, measure advertising performance, and improve the way our website and campaigns work. Depending on the tool, the data may be pseudonymous rather than fully anonymous.

Examples:

Google Analytics 4 (GA4)
- Provider: Google
- Cookie names: _ga, _ga_Q2BPQWBND8
- Purpose: Track page views, user interactions, and performance metrics
- Cookie duration: 13 months (33696000 seconds as configured)
- Data retention: Event-level data retained on Google's servers for up to 14 months
- Type: Secure first-party cookies, plus ga_purchase_tracked:[payment_id] in localStorage so a purchase is not counted twice
- Additional configuration:
  - IP addresses: Google Analytics 4 does not log or store IP addresses
  - Google Signals: Enabled (for audience insights)
  - Ad personalization: Disabled (allow_ad_personalization_signals: false)
  - Cookie update: Disabled (prevents automatic extension)
- Third-party: Yes (Google)
- Data processing location: Region configured in Google Analytics settings
Google Ads Conversion Measurement / Enhanced Conversions
- Provider: Google
- Cookie names: _gcl_au, _gcl_aw and other _gcl_* cookies (13 months), _gcl_ls (localStorage), and our own ph_gclid, ph_gbraid, ph_wbraid, ph_gad_source, ph_gad_campaignid, ph_utm (90 days), which keep the ad click and campaign details from the page you arrived on
- Purpose: Measure ad clicks and attribute verified conversions to the ad that led to them
- Data types: Click identifiers, landing path, conversion time/value/order identifiers, and hashed email / hashed phone number
- Event examples: Verified purchases and selected contact-intent / lead actions
- Storage: Secure first-party cookies plus secure server-side conversion logs. Google may also set its own cookies on google.com, doubleclick.net and googleadservices.com
- Additional configuration:
  - Enhanced Conversions: When a purchase follows a Google ad click, we send Google the SHA-256-hashed email address and phone number on the buyer's account so Google can match the purchase to the ad. They are not sent if ad cookies were turned off on that browser
  - Ad personalization: Disabled (ad_personalization: denied, allow_ad_personalization_signals: false)
- Can you turn it off? Yes. See Section 5.2
- Third-party: Yes (Google)
Platform Analytics (First-Party)
- Purpose: Track authenticated user interactions (searches, clicks, views, shortlist actions, recommendations)
- Availability: Only for logged-in/authenticated users
- Storage: Managed database infrastructure (server-side storage)
- Duration: Session-based tracking with server-side storage, retained per our data retention policy
- Data types: Event type, plate ID, metadata, user ID (authenticated users only), timestamp
- Third-party: No (first-party analytics infrastructure)
Vercel Web Analytics and Speed Insights
- Provider: Vercel (our hosting provider)
- Purpose: Count page views and measure how fast pages load
- Data types: Page URL, referrer, country, device and browser type
- Cookies: None
- Third-party: Yes (Vercel)

We do not use TikTok, Meta or any other advertising pixels.

Legal basis: Your consent, given by continuing to use the Platform after the cookie notice.

Can you opt out? Yes—see Section 5 ("Your Choices").

2.4 Sales Partner / Attribution Cookies

Purpose: These Cookies enable us to track referrals from our Sales Partners and attribute referrals to the correct Sales Partner when a sale is completed. This ensures accurate attribution and recognition for our sales partners.

Examples:

Sales Partner Referral Tracking
- Storage keys: listing-[plate_id], affiliate_referred_user, affiliate_referral_events, globalAffiliateProfile, referralCodes, and inviteSA (sessionStorage, while you register from a Sales Partner invite)
- Purpose: Store referral attribution data for Sales Partner commission tracking
- Attribution model: Last-click (default)
- Attribution window: 30 days (as displayed in Sales Partner dashboard, may be changed with notice)
- Duration:
  - Listing-specific referrals: Until authenticated user clicks processed (then cleared)
  - Referred user cache: 24 hours
  - Referral events cache: 1 hour
  - Global Sales Partner profile cache: 3 hours
- Type: Browser localStorage
- Third-party: No (first-party tracking)
Referral Code Processing
- Purpose: Capture and process referral codes from URL parameters or stored preferences
- Storage: Browser localStorage
- Duration: Session-based or until cleared

Legal basis: Legitimate interest (facilitating accurate Sales Partner attribution and recognition).

Can you opt out? Yes—you can clear local storage, but this may affect the accuracy of Sales Partner attribution if you return after a referral.

2.5 Confetti / Visual Enhancement Cookies

Purpose: These Cookies store preferences related to visual enhancements (e.g., celebration effects when items are sold).

Examples:

Sold Confetti Display
- Storage key pattern: confetti-[plate_id]-[order_id]
- Purpose: Prevent showing the same celebration animation repeatedly
- Duration: 1 hour (3600000 milliseconds)
- Type: Browser localStorage

Legal basis: Your implied consent through continued use.

Can you opt out? Yes—delete via browser settings.

2.6 Authentication & Security Cookies

Purpose: These Cookies maintain your secure login session and protect against unauthorized access.

Examples:

Sign-in Session
- See Section 2.1. The session is held in browser localStorage, not in a cookie
Bot Protection (Cloudflare Turnstile)
- Purpose: Check that a person, not a bot, is using sign-in, registration, checkout and other forms
- Where it runs: In a frame on Cloudflare's own domain, only on pages with those forms
- Third-party: Yes (Cloudflare)
Session Management
- Purpose: Track active sessions for security and fraud prevention
- Duration: Session-based
- Type: Server-side session management

Legal basis: Necessity for the performance of a contract and legitimate interest (security).

Can you opt out? No—these are essential for secure access.

3) LocalStorage & SessionStorage

In addition to HTTP cookies, we use Browser LocalStorage and SessionStorage to store data on your device. These are similar to cookies but remain stored until explicitly cleared.

We use LocalStorage/SessionStorage for:

Your sign-in session (sb-my-auth-token, sb-my-auth-token-code-verifier, platehaus_auth_return_path)
The cookie notice (ph_cookie_notice_seen)
Banner dismissal preferences (disclaimer-dismissed, exploreBannerClosedAt, homepage-disclaimer-dismissed, platehaus-3d-new-dismissed)
Order and enquiry records (payment_notice_sent:*, platehaus_browser_actor_id, ga_purchase_tracked:*)
Google Ads click linking (_gcl_ls)
Sales Partner referral tracking (listing-*, affiliate_referred_user, affiliate_referral_events, globalAffiliateProfile, referralCodes, inviteSA)
Confetti display preferences (confetti-*)

MyQRContact pages (/qr, /myqr) are covered by the MyQRContact Privacy Policy.

Duration:

SessionStorage: Automatically cleared when you close the browser tab
LocalStorage: Persists until you manually clear browser data or as specified per item

You can control LocalStorage and SessionStorage through your browser settings in the same way you control Cookies.

4) Third-Party Cookies & Services

We integrate with the following third-party services that may set their own Cookies:

Third-Party Service	Purpose	Types of Cookies Used	Privacy Policy
Google Analytics (GA4)	Website analytics	Analytics cookies	Google Analytics Privacy
Google Ads	Advertising measurement, conversion attribution, and enhanced conversion matching	Advertising / attribution cookies, first-party click identifiers, server-side conversion identifiers	Google Privacy Policy
Vercel	Hosting, page view counts and page speed	None (no cookies)	Vercel Privacy Policy
Supabase	Authentication, database, storage	Sign-in session in browser localStorage	Supabase Privacy
Cloudflare Turnstile	Bot protection verification	Runs on Cloudflare's own domain	Cloudflare Privacy

These third parties may collect information about your online activities across different websites over time. You can find more information about their practices in their privacy policies (linked above).

Note: Google Analytics 4 does not log or store IP addresses. Our Google tag keeps ad personalization disabled, including for Google Ads conversion measurement and Enhanced Conversions. See Section 2.3 for details.

5) Your Choices: Managing Cookies

5.1 Browser Controls

You can control and/or delete Cookies as you wish. You can delete all Cookies already on your device and set most browsers to prevent them from being placed. However, if you do this, you may have to manually adjust some preferences every time you visit the Platform, and some services and functionalities may not work.

Browser-specific instructions:

5.2 Turning Off Ad Cookies

Use Ad cookies on this browser at the bottom of this page. You need to be signed in to a Platehaus account to turn ad cookies off; turning them back on does not need an account. Turning ad cookies off:

stops Google Ads cookies being set on that browser and removes the ad click details already stored there;
stops your hashed email address and phone number being sent to Google; and
is saved in the ph_tracking_consent cookie on that browser only.

Google may still be told, without cookies or your contact details, that a purchase followed one of our ads. Sign-in, security and analytics keep working. Without an account, you can block or delete ad cookies through your browser settings (Section 5.1) or Google's opt-out tools (Section 5.3).

5.3 Opting Out of Google Analytics and Google Ads Measurement

If you wish to opt out of Google Analytics tracking or Google Ads measurement, you can:

Turn off ad cookies at the bottom of this page (Google Ads only; needs a Platehaus account; see Section 5.2)
Install the Google Analytics Opt-out Browser Add-on
Adjust your browser settings to block Cookies (see Section 5.1)
Clear your browser's local storage (this will remove stored data but may reset your preferences)

5.4 Clearing LocalStorage and SessionStorage

To clear LocalStorage and SessionStorage:

Open your browser's Developer Tools (F12)
Go to the "Application" or "Storage" tab
Select "Local Storage" or "Session Storage"
Right-click and choose "Clear" or delete specific entries

Alternatively, you can use your browser's "Clear browsing data" function (see Section 5.1).

6) Retention Periods

The specific retention periods for our Cookies are listed in Section 2 above. In summary:

Cookie Type	Retention Period
Sign-in Session	Until you sign out
Ad Cookie Choice	13 months
Functional Cookies	7-14 days (banner prefs)
Google Analytics Cookies	13 months
GA Event Data	Up to 14 months
*Google Ads Cookies (`_gcl_`)**	13 months
*Our Ad Click Cookies (`ph_`)**	90 days
Server-side Conversion Records	Retained per Privacy Policy
Sales Partner Referral Tracking	30 days (attribution window)
Confetti Display	1 hour
Sales Partner Cache	1-24 hours (varies)

Note: Some data collected via Cookies may be stored in our backend databases for longer periods as described in our Privacy Policy (e.g., transaction records retained for 7 years for legal compliance).

7) Children's Privacy

platehaus.my is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information and remove the account.

8) Updates to This Policy

We may update this Cookie Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we may:

Update the Effective date at the top of this Policy
Notify you in-app (for material changes)
Post the updated Policy on this page

Your continued use of the Platform after the updated Effective Date constitutes acceptance of the revised Cookie Policy.

9) Data Controller & Contact

Data Controller:
Platehaus Sdn. Bhd. (Company No. 202501045049)
Registered Address: CT-06-21 Subang Square Corporate Tower, Jalan SS15/4G, SS15, 47500 Subang Jaya, Selangor

Contact (Privacy):
Email: support@platehaus.my

For questions, concerns, or requests about our use of Cookies, please contact us using the information above.

10) Additional Resources

Related Documents:

External Resources:

11) Summary

Quick Summary:

We use Cookies, LocalStorage, and SessionStorage to make the Platform work, improve your experience, and analyze usage.
Essential Cookies cannot be disabled (they are necessary for the Platform to function).
Analytics and Tracking Cookies help us understand how you use the Platform.
Sales Partner Cookies track referrals to ensure accurate attribution and recognition for our partners.
You can control Cookies through your browser settings or by clearing browser data.
Google Analytics and Google Ads run with ad personalization disabled. We do not use TikTok, Meta or other advertising pixels.
Signed-in users can turn off ad cookies at the bottom of this page at any time. Anyone can block cookies in their browser settings.
Children under 18 are NOT PERMITTED to use the Platform.

Your Rights:

Under PDPA, you have the right to:

Access information about the Cookies we use
Object to certain types of data processing
Request deletion of non-essential data
File a complaint with JPDP

For more details, see our Privacy Policy.

Last Updated: 2 Nov 2026

[END OF AGREEMENT]