Who we are
Noachis is operated by Astra Platforms Sdn Bhd, a company registered in Malaysia, registration no. 202601042256 (1704351-D), whose registered address is 7-2 Plaza Danau 2, Jalan 2/109F, Taman Danau Desa, 58100 Kuala Lumpur, Malaysia. For anything about your personal data, email megatarif@astraplatforms.com.
What we collect
Your account: email address, password (stored only as a one-way hash), username, display name, and anything you add to your profile.
What you post: videos, captions, comments, LIVE broadcasts and comments, products and store details.
What you do: who you follow and block, what you like, save, share and search for, and which videos you watch and for how long. Noachis uses what you watch to decide what to show you next.
Messages: the direct messages you send and receive, and the Noachis videos you share in them. Messages are text and shared videos only.
Your date of birth, to keep Noachis to people 13 and over and to give younger members stronger protections. It isn’t shown to anyone.
Shopping: your delivery addresses, your orders — which keep a copy of the delivery address used — your cart and saved products.
Earning: if you’re a creator, the affiliate links you share, clicks on them, and your commission and payouts — and your free samples, paid posts, marketplace listing and agency membership, if you use them.
Your gender, only if you choose to add it to your profile (you can remove it any time). It isn’t shown on your profile. Shops see it only added up with many other people, as rounded shares in the audience figures for their own LIVEs and videos — never for fewer than 20 people, and never who. It is in your data download, and deleting your account clears it.
Buying in a LIVE: only if you turn on Settings → Account privacy → Show when I buy in a LIVE (it is off unless you do), others watching a LIVE you order from may see “a***1 is buying” for a moment — the first and last letter of your username only (just the first for a short username), never your name, what you paid or where it goes. It is never shown if your account is private, nor to someone you blocked or who blocked you. When someone adds a LIVE’s product to their cart, the LIVE shows only “Someone just added …”, never who.
Where you shopped from: when you tap a product in a LIVE or a video, add it to your cart, or buy it, we note which LIVE or video it came from. Shops see totals for their own LIVEs and videos (taps, add to cart, orders and the age group, gender if given, and delivery state of their viewers — only for 20 or more people), never who. Taps and add-to-cart records are kept 180 days; an order keeps where it came from. If you follow someone with the + on one of their videos, we note which video it was, so they can see how many people their videos brought (a number, never who).
If you run a shop: a log of the changes you make in its affiliate tools (what, when and from which account), kept for a year and shown only to your shop.
Taps on a creator’s products: when you tap a product a creator tagged in a video, featured in a LIVE, or put in their showcase, or open their shared link, we keep the tap — with which video, LIVE or showcase it came from — for as long as it can earn them commission (usually 7 days, longer if it led to a purchase), and add it to a daily count. The shop sees how many taps and sales each video, LIVE and channel brought, never who tapped or bought.
Products you open: one record per product per day, kept 90 days, so a shop can see how many people visited its products. Shops see totals only, never who.
Flash Sale: if you tap “Remind me” on an upcoming Flash Sale, we keep that so we can tell you when it starts. While a shop’s Flash Sale runs, we note once whether its products were shown to you in the Flash Sale list, whether you tapped one there, and whether you opened one. The shop sees the number of reminders and these counts, never who. 90 days after the sale ends we delete these records and keep only the totals.
Vouchers: the vouchers you claim, when, how many times, and where you claimed them (a LIVE or a video, if there), and the order each was used on. Some vouchers are only for buyers who haven’t bought from that shop before, or who have bought from it recently: to offer those we check your paid orders with that shop — nothing else. Shops see totals of claims and use for their vouchers, and the orders that used them, as they see any of their orders. A follow prize voucher is only for people who follow the shop after the voucher was made: to offer it we check whether you follow that shop and when you first followed it — that first date is kept even if you unfollow, so unfollowing and following again doesn’t count as new.
Reviews: the rating, text, photos and video you post about an item you bought are public, under the product, with your username. Before a review video is stored we take out the place it was filmed, if your phone recorded one; photos are re-saved without their hidden details (such as location). Photos and videos you upload but don’t post in a review are deleted within a day. The shop sees your review with your username and the order it is for, and can reply publicly.
Shop Coins: the coins you get, use and get back — with the shop and order each is for, and when they expire. A shop running a Review Prize sees your username, the product and the coins your review earned, in its list of rewards.
Payments: the payment method you used for an order (for example card, online banking or e-wallet), as the payment provider reports it. The shop sees it on that order in its income records.
If you run a shop: your bank accounts for withdrawals (the account number is stored encrypted; only its last 4 digits are shown, also to you), and your shop’s balance — each order’s income, refunds, withdrawals and adjustments.
Seller verification, if you run a shop: your name as on your MyKad, your MyKad number, photos of the front and back of your MyKad and a selfie holding it — or, for a company, its name, SSM number and registration document. We use them only to check who runs the shop. The photos and the MyKad number are stored encrypted; only Noachis staff who check sellers can open them, and every time they do is recorded. Buyers and other users never see them; you and they see only “Verified seller”, and you see only the last 4 digits of the number. The photos are compared by a person, not by face-recognition software. If a submission is rejected or withdrawn, its photos are deleted when you send new ones, or 30 days after the decision; an approved one is kept while your shop exists and deleted with your account.
e-Invoices, if you ask for one for an order: the name, tax number (TIN), ID number (MyKad, SSM, passport or army ID), SST number, email, phone and address you give. They are kept with the order as a tax record (the ID number stored encrypted; only its last 4 digits are shown) and used only to issue the e-Invoice through LHDN. If you choose to save them for next time, the saved copy is deleted when you delete it or your account. Noachis doesn’t issue e-Invoices yet; requests are kept until it does.
If you run a shop: its tax number (TIN), SST number and business activity code, for the e-Invoices Noachis will issue for sales on Noachis.
Ads: shops can advertise their products in search and in the Shop. Ads are labelled “Ad” and are picked from what you searched or the shelf you’re on — not from a profile of you. When you tap an ad we keep the tap (with a scrambled form of your network address, changed daily) for 90 days, to charge the shop, stop fake clicks and count sales that came from the ad. Shops see totals only, never who.
Your devices: when you sign in, the IP address and browser or app details of that session, and a push notification token if you allow notifications.
What we don’t collect
Noachis doesn’t collect your location, contacts or phone number, except a phone number you add to a delivery address.
Noachis doesn’t sell your data.
Why we use it
To run your account and the features you use; to choose what appears in your feed; to take and deliver orders and pay creators; to keep Noachis safe — including reviewing reports and preventing fraud; and to understand, in aggregate, how Noachis is used.
Who we share it with
Other people see what you choose to make visible: your profile, and your posts unless your account is private.
Shop chats: a shop can set automatic messages — a welcome, an “outside working hours” message and FAQ cards with questions you can tap. They are sent in the shop’s name and labelled “Automatic message” or “Automatic answer”. If you write from a product’s page, the shop’s FAQ card for that product may be sent; otherwise the card may depend on the stage of your latest order with that shop (to ship, on its way, delivered). When you tap a question on a card, it is sent as your message. The shop sees counts of cards sent, questions tapped and answers rated helpful — not who did what in those figures — and it can read its own chats with you, as it always could.
Direct messages are seen by the people in the conversation. Noachis staff don’t read them — except a message that someone in the conversation reports, which a moderator reviews. Every time a moderator views a reported message, it is recorded. Messages are not end-to-end encrypted: they are stored by Noachis so they can be delivered, reported and reviewed.
Sellers you buy from see what they need to fulfil the order, including your delivery address.
Creators: when you ask a shop for a free sample, the address you choose is shown to that shop only once it approves you, and is removed 30 days after the parcel arrives or the request ends. If you list yourself in the KOL marketplace, shops see your profile name, follower count, the average plays of your last 10 public videos, and how many orders, sample videos and paid posts you have done — counts only. Listed creators can also appear in the weekly leaderboard shops see, ranked by sales through their links or plays of their product videos on Noachis, with sales shown as ranges (for example “RM1k – 3k”), never exact amounts. A shop can keep you in its own list of creators; it sees exact figures only for sales of its own products. If you buy a refundable sample, the shop sees that order like any other, and whether you posted the video. If you join an agency, it sees the same and what you earned on Noachis while a member, so you can settle its share. Shops looking for agencies see how many creators an agency has and its creators’ clicks, orders and sales on Noachis added together and shown as ranges — never one creator’s figures, and not at all where the total could point at a creator who isn’t listed in the KOL marketplace. Members who list themselves in the KOL marketplace can be named as the agency’s top creators.
Service providers process data on our behalf when they’re connected: a payment provider for purchases, a streaming provider for LIVE, and an AI provider. When AI features are on, the text of comments is sent for safety review, search queries are sent to understand what you’re looking for, and text you ask it to help with is sent to draft suggestions. If a shop turns on AI chat replies, your recent messages in that shop’s chat are sent to the AI provider together with the shop’s product details and your own orders with that shop (status, tracking and return status — never your address or payment details), so it can answer you; its messages are labelled “AI reply”. If a seller uses AI pictures, the product photo is sent to an AI image provider, and pictures made that way show “AI background”.
Songs on notes: when you look for a song for your note, what you type in the search is sent to the music catalogue (Apple’s iTunes Search) to find songs — not your name or account. Song previews and covers are played and shown straight from the catalogue’s servers, which see your device’s internet address, as any website you visit would. The song you choose is shown with your note to the people who can see your note.
Places on notes and in chats: when you choose a place to tag on a note or send in a chat, the app asks your phone for your location — only while the list is open, and only if you allow it — to list places near you. Noachis sends that position, rounded to about 100 metres, to Google Places to find nearby places; it is held in the server’s memory for a few minutes so the same list can be shown again quickly, and never stored in a database or linked to your account. What you type in the search goes to Google Places too, never your name or account. Only the place you pick (its name, address and map point, as Google gives them) is saved: on a note for 24 hours, shown to the people who can see your note; in a chat, to the people in that chat. “Open in Maps” opens Google Maps.
We may disclose data where the law requires it.
How long we keep it
Most of your data is deleted when you delete your account. Some records are kept because the law or safety requires it: orders and payments, creator earnings and payouts, moderation decisions about your account, and reports you filed. Content under an open moderation review is kept until the review ends.
When you delete your account, the messages you sent are emptied; the people you talked to keep what they wrote. When you unsend a message, its text is removed — unless it had already been reported, in which case it is kept for the moderator and hidden from both of you. A message removed by a moderator is hidden from both of you and kept as a record of the decision.
Your choices
Make your account private, so only people you approve see your posts. Block anyone. Turn off notifications for likes, comments, follows and reposts.
Choose who can message you: everyone, only people you follow, or no one. Messages from people you don’t follow arrive as requests, and they can send up to three until you accept. Noachis doesn’t show others when you’ve read their messages or when you’re online.
Clear your search history — which also removes your identity from the search records used for trends.
Download a copy of your data, including your watch history, from Account settings on the Noachis website.
Delete your account from the app or the website. You’ll be shown what is removed and what is kept before you confirm.
Children
You need to be 13 or older to use Noachis. We ask for your date of birth when you sign up; if you are under 13 you can’t create an account, and we don’t keep the date you entered.
Younger members get extra protection. If you are 13 to 15, your account starts private and direct messages are off — you can’t send or receive them. If you are 16 or 17, you can message only people you follow who also follow you back, and nobody else can message you. These rules apply even to conversations started earlier.
Your date of birth can’t be changed in the app once it is set, and it is never shown on your profile.
Security
Passwords are stored as one-way hashes. Staff access is limited by role, and every enforcement action is logged. Noachis is built to require encrypted connections once it runs in production. No system is perfectly secure.