What Our Privacy Policy Actually Covers
Our privacy approach sits on a simple rule: we only hold what your account needs to run properly. When you fund your wallet through Touch 'n Go eWallet, Boost or GrabPay, we record the transaction reference and confirmation status — not your banking login, not your
-
1
wallet PIN. DuitNow and FPX transfers work the same way: the receiving bank or e-wallet handles the authentication, and we only see the result that lands in your account ledger. Device details — model, browser, rough session timing — help us flag unusual logins and protect
-
2
your account from unauthorised access. We keep this data for as long as your account stays open plus a reasonable period after closure, mainly to close out any pending withdrawal verification or dispute. Where local law sets a stricter standard for how long transaction records must
-
3
be kept, or restricts what we can share with a payment partner, that stricter standard applies — handling depends on local law and applies where local law permits. We do not sell your account data to third parties for marketing. Any sharing we do is limited
-
4
to what's needed to process a Touch 'n Go eWallet, Boost or GrabPay transaction, confirm your identity during an account check, or meet a lawful request from a payment partner or regulator. If anything above changes — how long we retain data, or who we share
-
5
it with — we'll update this page and note the date so returning members can see what's different.
Service availability depends on eligible regions and local law. Users should check local rules before opening an account.