Privacy Policy

Last updated: 21 October 2026

1. Who we are

Savor Transform is a plant-based meal programme run by Savor of Life (“Savor”, “we”, “us”), Savor Restaurant, 38G, Jalan 28/70a, Desa Sri Hartamas, 50480 Kuala Lumpur, Malaysia. We are responsible for your personal data under Malaysia’s Personal Data Protection Act 2010 (PDPA).

2. What we collect

We don’t collect your bank card numbers. Payments are made by bank transfer or e-wallet through your own banking or e-wallet app.

3. How we use it

• To confirm your booking, verify your payment and arrange your start date.
• To prepare your meals safely, taking your allergies and dietary needs into account.
• To deliver your meals to the right place at the right time.
• To provide consultations, guidance and support that are part of your programme.
• To show your programme and progress in My Programme, and to let you rate dishes.
• To improve our menu and service, using feedback and anonymised, combined information.
• To reply to your questions and send you messages about your programme.
• To meet legal, tax and accounting obligations.

We’ll only send you marketing messages if you’ve agreed to receive them, and you can stop them at any time by telling us.

4. Health information

Information about your physical health is “sensitive personal data” under the PDPA. We only process it with your explicit consent, which you give at checkout, and only to tailor your meals, guidance and consultations and to keep you safe.

Only team members involved in your programme can see it. You can choose what health information to share. Some services, such as consultations and blood test reviews, may not be possible without it. You can withdraw your consent at any time by contacting us.

5. Who we share it with

We only share your data when it’s needed to run your programme, with:

• Our team, including our kitchen, nutrition and support staff.
• Delivery partners, who receive your name, phone number, address and delivery instructions.
• Healthcare partners, such as a laboratory or doctor providing blood tests or consultations included in your programme.
• Service providers who host and run our website and systems: Vercel (website hosting), Supabase (customer database and login), Google (web fonts and maps links) and Meta (WhatsApp, if you message us there).
• Authorities, if the law requires it.

We don’t sell or rent your personal data.

6. Storage and transfers outside Malaysia

Our customer database is hosted in Singapore, and our website is served through global data centres, including in the United States. Where your data is processed outside Malaysia, we use providers that protect it with security and contractual safeguards, as permitted under the PDPA.

7. How long we keep it

We keep your personal data while you’re a customer and for up to 2 years after your last programme ends, so we can support future bookings and answer questions. We keep payment and accounting records for 7 years, as Malaysian law requires. After that we delete or anonymise it. You can ask us to delete your data earlier, unless we must keep it by law.

8. Your rights

Under the PDPA, you can:

• Access the personal data we hold about you.
• Correct data that is inaccurate, incomplete or out of date.
• Withdraw consent or limit how we use your data, including for marketing.
• Ask us to delete your data, where we don’t need to keep it by law.

Contact us using the details below. We’ll reply within 21 days. We may need to confirm your identity first.

9. Information stored on your device

We don’t use advertising or tracking cookies. Our website stores a small amount of information in your browser so that it works properly: keeping you logged in to My Programme and our team dashboard, and saving parts of the site so it loads faster and can be added to your home screen. You can clear this at any time in your browser settings. Doing so will log you out.

10. Security

We protect your data with encrypted connections (HTTPS), secure one-time login links, and database rules that let each customer see only their own programme. Access for our team is limited to approved staff. No system is completely secure, so please keep access to your email account private, because it’s used to log in.

11. Changes to this policy

We may update this policy from time to time. We’ll change the date at the top and, for significant changes, let customers know by email or WhatsApp.

12. Contact us