隐私政策 / Privacy Policy

morelove.me
版本 / Version： 2.0
生效日期 / Effective Date： 2026-04-01
最后更新 / Last Updated： 2026-04-01

中文版

1. 引言与数据控制者身份

morelove.me（以下简称"我们"、"本站"或"MoreLove"）致力于保护您的个人数据隐私。本隐私政策依据以下法律法规制定：

• 马来西亚《2010年个人数据保护法》（PDPA，Act 709） 及其 2024 年修正案
• 马来西亚《2024年消费者保护（电子贸易交易）条例》
• 参考 欧盟《通用数据保护条例》（GDPR） 相关要求（适用于欧盟/欧洲经济区用户）

数据控制者信息：

使用我们的网站及服务，即表示您了解并同意本政策所述的数据处理方式。对于特定数据处理活动（如 AI 虚拟试穿），我们将在相关功能处单独征求您的明确同意。

2. PDPA 七大原则遵从声明

本政策严格遵循马来西亚 PDPA 的七大个人数据保护原则：

📋 2024 年修正案新增要求： 强制数据泄露通知、强制任命数据保护官（DPO）、数据可携带权、生物识别数据被纳入敏感数据范畴、违规罚款上限提高至 RM 1,000,000。

3. 数据收集范围

3.1 您主动提供的数据

3.2 自动收集的数据

3.3 AI 虚拟试穿功能数据（未来功能）🔬

⚠️ 此功能尚在规划阶段。上线前将发布单独的数据处理补充条款并征求您的明确单独同意。

AI 试穿功能的法律合规承诺：

1. 明确同意： 每次使用试穿功能前，均需您点击确认同意，您可随时撤回
2. 目的限制： 照片数据仅用于生成虚拟试穿效果，绝不用于 AI 模型训练、广告定向或任何其他目的
3. 最小化处理： 不提取、不存储面部生物特征模板；不进行面部识别或身份关联
4. 无第三方共享： 照片和处理结果不与任何第三方共享（包括供应商、广告商、关联公司）
5. PDPA 合规： 2024 年修正案将生物识别数据纳入敏感个人数据，我们严格遵守更高的保护标准
6. GDPR 合规： 对于欧盟用户，面部数据属于 GDPR 第 9 条特殊类别数据，我们以明确同意为处理基础，并已完成数据保护影响评估（DPIA）
7. 数据保护影响评估（DPIA）： 上线前将完成并记录完整的 DPIA

4. 数据使用目的

5. 第三方数据共享

我们不会出售您的个人数据。以下情况下，我们可能与第三方共享必要数据：

跨境数据传输保障：

根据 PDPA 2024 修正案，跨境数据传输需确保接收方提供"实质相似"的数据保护水平。我们通过以下方式保障您的数据安全：

• 与所有第三方签订 数据处理协议（DPA）
• 要求第三方遵守 与 PDPA 同等或更高 的数据保护标准
• 对于欧盟用户，采用 标准合同条款（SCCs） 作为跨境传输的合规机制
• 定期审计第三方的数据安全措施

6. Cookie 政策

6.1 我们使用的 Cookie 类型

6.2 具体 Cookie 清单

6.3 Cookie 管理

• 首次访问： 您将看到 Cookie 同意横幅，可选择接受或拒绝非必要 Cookie
• 随时管理： 通过网站底部的"Cookie 设置"链接随时更改偏好
• 浏览器设置： 您也可以通过浏览器设置管理或删除 Cookie
• Google Analytics 退出： 可安装 Google Analytics Opt-out Browser Add-on

7. 数据保留期限

🗑️ 数据删除： 超过保留期限的数据将被安全删除或不可逆匿名化。您可随时请求删除您的个人数据（法律要求保留的除外）。

8. 您的权利

根据马来西亚 PDPA 及 2024 年修正案，您享有以下权利：

行使权利的流程：

1. 发送邮件至 privacy@morelove.me，说明您要行使的权利
2. 我们可能需要验证您的身份（防止未授权访问）
3. 我们将在 21 个工作日内 回复您的请求
4. 对于复杂请求，可能需要额外时间，但我们会及时告知进展

对于欧盟/欧洲经济区用户的额外权利（GDPR）：

• 被遗忘权（Right to Erasure）： 在特定条件下请求删除个人数据
• 数据可携带权： 以结构化、常用、机器可读的格式接收数据
• 向监管机构投诉的权利： 您有权向所在国的数据保护监管机构投诉

9. 未成年人保护

• 我们的服务面向 18 岁及以上 的用户
• 我们不会故意收集 18 岁以下未成年人的个人数据
• 如我们发现意外收集了未成年人的数据，将立即删除
• 如果您是家长/监护人，发现您的未成年子女向我们提供了个人数据，请立即联系 privacy@morelove.me，我们将在 48 小时内 采取删除措施
• 对于 AI 试穿功能，我们将实施年龄验证机制，禁止未成年人使用

10. 数据安全措施

我们采取多层次安全措施保护您的个人数据：

技术措施：
- 🔒 全站 SSL/TLS 加密（HTTPS）传输所有数据
- 支付信息由 PCI-DSS Level 1 合规 的第三方支付网关（Stripe）处理
- 密码以 bcrypt 单向哈希 存储，无法被反向解密
- 数据库访问采用 最小权限原则 和 加密存储
- AI 试穿功能的照片数据采用 端到端加密，在 隔离沙盒环境 中处理

管理措施：
- 员工签署 保密协议 并接受数据保护培训
- 数据访问权限严格控制，仅授权人员可访问
- 定期进行安全审计和漏洞扫描
- 数据泄露应急响应计划已建立并定期演练

数据泄露通知（2024 修正案要求）：
- 如发生数据泄露，我们将 尽快 通知马来西亚个人数据保护专员
- 如泄露可能对您造成严重影响，我们也会及时通知您
- 通知内容包括：泄露性质、影响范围、已采取的补救措施

11. 政策变更通知机制

• 我们可能不时更新本隐私政策
• 重大变更： 通过网站横幅公告 + 注册邮箱邮件通知，提前 30 天 告知
• 非重大变更： 更新网站上的政策页面和"最后更新"日期
• 重大变更包括：数据收集范围扩大、新增第三方数据共享、更改数据保留期限等
• 变更生效后继续使用我们的服务，即视为您接受更新后的政策
• 如您不同意更新后的政策，可联系我们注销账户并删除数据

12. 投诉途径

如果您对我们的数据处理方式有疑虑或投诉：

第一步：联系我们
- 📧 邮箱：privacy@morelove.me
- 响应时间：21 个工作日内

第二步：向监管机构投诉
- 马来西亚个人数据保护专员公署（JPDP / PDPC）
- 地址：Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, Federal Government Administration Centre, 62100 Putrajaya, Malaysia
- 电话：03-8000 8000（MyGCC）/ 03-7456 3888（JPDP 热线）
- 邮箱：aduan@pdp.gov.my
- 网站：https://www.pdp.gov.my

第三步（适用于欧盟用户）：向所在国数据保护监管机构投诉

13. 联系我们

如有任何隐私相关问题或请求：

English Version

1. Introduction & Data Controller Identity

morelove.me ("we," "us," "our," or "MoreLove") is committed to protecting the privacy of your personal data. This Privacy Policy is established in accordance with:

• Malaysian Personal Data Protection Act 2010 (PDPA, Act 709) and its 2024 Amendment
• Malaysian Consumer Protection (Electronic Trade Transaction) Regulations 2024
• EU General Data Protection Regulation (GDPR) references (applicable to EU/EEA users)

Data Controller Information:

By using our website and services, you acknowledge and agree to the data processing practices described in this policy. For specific data processing activities (such as AI virtual try-on), we will seek your separate explicit consent at the point of use.

2. PDPA Seven Principles Compliance

This policy strictly adheres to the seven personal data protection principles under Malaysia's PDPA:

📋 2024 Amendment Updates: Mandatory data breach notification, mandatory Data Protection Officer (DPO) appointment, right to data portability, biometric data classified as sensitive personal data, maximum penalties increased to RM 1,000,000.

3. Data We Collect

3.1 Data You Provide

3.2 Data Collected Automatically

3.3 AI Virtual Try-On Data (Future Feature) 🔬

⚠️ This feature is currently in the planning stage. A separate Data Processing Addendum will be published and your explicit, separate consent will be obtained before launch.

AI Try-On Legal Compliance Commitments:

1. Explicit Consent: Requires your click-to-confirm consent before each use; you may withdraw consent at any time
2. Purpose Limitation: Photo data is used solely for generating virtual try-on results—never for AI model training, ad targeting, or any other purpose
3. Data Minimization: No facial biometric templates are extracted or stored; no facial recognition or identity matching is performed
4. No Third-Party Sharing: Photos and results are not shared with any third party (including suppliers, advertisers, or affiliates)
5. PDPA Compliance: The 2024 Amendment classifies biometric data as sensitive personal data; we adhere to the higher protection standards
6. GDPR Compliance: For EU users, facial data falls under GDPR Article 9 special category data; we use explicit consent as the processing basis and have completed a Data Protection Impact Assessment (DPIA)
7. DPIA: A full Data Protection Impact Assessment will be completed and documented before launch

4. How We Use Your Data

5. Third-Party Data Sharing

We do not sell your personal data. We may share necessary data with third parties in the following circumstances:

Cross-Border Data Transfer Safeguards:

Under the PDPA 2024 Amendment, cross-border data transfers must ensure the recipient provides "substantially similar" data protection. We safeguard your data through:

• Signing Data Processing Agreements (DPAs) with all third parties
• Requiring third parties to comply with data protection standards equivalent to or higher than the PDPA
• For EU users, implementing Standard Contractual Clauses (SCCs) as the cross-border transfer compliance mechanism
• Regular auditing of third-party data security measures

6. Cookie Policy

6.1 Types of Cookies We Use

6.2 Specific Cookie List

6.3 Cookie Management

• First Visit: You'll see a cookie consent banner where you can accept or decline non-essential cookies
• Anytime Management: Change your preferences via the "Cookie Settings" link in the website footer
• Browser Settings: You may also manage or delete cookies through your browser settings
• Google Analytics Opt-out: Install the Google Analytics Opt-out Browser Add-on

7. Data Retention Periods

🗑️ Data Deletion: Data exceeding retention periods is securely deleted or irreversibly anonymized. You may request deletion of your personal data at any time (except data required by law).

8. Your Rights

Under the Malaysian PDPA and its 2024 Amendment, you have the following rights:

Process for Exercising Your Rights:

1. Send an email to privacy@morelove.me specifying the right you wish to exercise
2. We may need to verify your identity (to prevent unauthorized access)
3. We will respond within 21 business days
4. Complex requests may require additional time; we will keep you informed of progress

Additional Rights for EU/EEA Users (GDPR):

• Right to Erasure ("Right to be Forgotten"): Request deletion of personal data under specific conditions
• Data Portability: Receive your data in a structured, commonly used, machine-readable format
• Right to Lodge a Complaint: You have the right to complain to the data protection supervisory authority in your country

9. Protection of Minors

• Our services are intended for users aged 18 and above
• We do not knowingly collect personal data from anyone under 18
• If we discover we have inadvertently collected data from a minor, we will delete it immediately
• If you are a parent/guardian who discovers your minor child has provided personal data to us, please contact privacy@morelove.me immediately — we will take deletion measures within 48 hours
• For the AI virtual try-on feature, we will implement age verification mechanisms to prevent use by minors

10. Data Security Measures

We implement multi-layered security measures to protect your personal data:

Technical Measures:
- 🔒 Full-site SSL/TLS encryption (HTTPS) for all data in transit
- Payment information processed by PCI-DSS Level 1 compliant third-party gateways (Stripe)
- Passwords stored using bcrypt one-way hashing (cannot be reversed)
- Database access follows least privilege principle with encrypted storage
- AI try-on photo data uses end-to-end encryption, processed in isolated sandbox environments

Administrative Measures:
- Employees sign confidentiality agreements and receive data protection training
- Data access is strictly controlled; only authorized personnel may access data
- Regular security audits and vulnerability scanning
- Data breach emergency response plan established and regularly tested

Data Breach Notification (2024 Amendment Requirement):
- In the event of a data breach, we will notify the Malaysian PDPC as soon as practicable
- If the breach is likely to cause serious harm to you, we will also notify you promptly
- Notification will include: nature of the breach, scope of impact, and remedial measures taken

11. Policy Change Notification

• We may update this Privacy Policy from time to time
• Material Changes: Notified via website banner + email to registered accounts, 30 days in advance
• Non-Material Changes: Updated policy page and "Last Updated" date on our website
• Material changes include: expanded data collection scope, new third-party data sharing, changes to data retention periods
• Continued use of our services after changes take effect constitutes acceptance of the updated policy
• If you disagree with the updated policy, you may contact us to delete your account and data

12. Complaint Channels

If you have concerns or complaints about our data processing practices:

Step 1: Contact Us
- 📧 Email: privacy@morelove.me
- Response time: Within 21 business days

Step 2: Complain to Regulatory Authority
- Malaysian Personal Data Protection Commissioner (JPDP / PDPC)
- Address: Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, Federal Government Administration Centre, 62100 Putrajaya, Malaysia
- Phone: 03-8000 8000 (MyGCC) / 03-7456 3888 (JPDP Hotline)
- Email: aduan@pdp.gov.my
- Website: https://www.pdp.gov.my

Step 3 (For EU Users): Complain to your national Data Protection Supervisory Authority

13. Contact Us

For any privacy-related questions or requests:

本政策同时提供中文和英文版本。如两个版本之间存在不一致，以英文版本为准。
This policy is provided in both Chinese and English. In the event of any inconsistency between the two versions, the English version shall prevail.

MoreLove.me | 版本 2.0 | 最后更新 2026-04-01