Who we are
This site is operated by DOKTAHOO TECHNOLOGY, a sole proprietorship (trade name) registered with the Suruhanjaya Syarikat Malaysia and based in Selangor, Malaysia. We are the data controller for the personal data described here, under the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024, which came into force on 1 January 2025 and renamed the former "data user" role.
Visiting this site
This site sets no cookies and loads no advertising scripts. Fonts are served from our own domain, so reading a page sends no request to a font or advertising provider.
We use PostHog to understand how the site is used: which pages are read, where visitors come from, which links are clicked, whether the contact form was sent, and any errors the page hits. It records the pages you visit, your browser and device type, an approximate location derived from your IP address, and, for some visits, a replay of how the page was used with everything typed into forms masked. It runs without cookies: a random visit identifier is kept in your browser's session storage and is deleted when you close the tab, so separate visits are not linked to each other or to you. It is not used for advertising. If your browser sends a Do Not Track signal, PostHog is not used at all.
The QR code on a Doktahoo business card opens doktahoo.com/hi, which passes you straight on to WhatsApp. On the way it counts the scan in PostHog: the time, your device type and an approximate location derived from your IP address, under a fresh random identifier, so one scan is never linked to another or to you.
The site is hosted on Cloudflare. As with any web host, Cloudflare processes technical information such as your IP address, browser type and the pages requested, in order to deliver the site and protect it from abuse. We do not use that information to identify or profile visitors.
The contact form
The contact page has a form. It collects only what you type or tick: your name, your email address, your message and, if you choose, the type of work, timeline, budget and visibility. There is no hidden field that profiles you.
The form is protected by Cloudflare Turnstile, which checks that a person rather than a script is submitting it. Turnstile is designed to work without tracking you across sites; it inspects technical signals from your browser and may store a short-lived token so it does not have to ask twice. Your message is then sent byCloudflare's email service to our @doktahoo.com address, which Cloudflare forwards to a Google (Gmail) mailbox where we read and answer it. None of these is used to advertise to you.
When the form is sent, we email a short confirmation to the address you gave. It contains nothing you wrote, only the time we received it and how we will reply.
You do not have to use the form. Email and WhatsApp reach the same person.
When you contact us
If you email hi@doktahoo.com or message us on WhatsApp, we receive what you choose to send: usually your name, contact details and a description of your project. We use it to reply, and to prepare a proposal if you ask for one. We do not add you to a mailing list.
Projects we work on
If we work together, we keep the contact, contract and billing details needed to deliver the project and issue invoices. Where a project gives us access to your systems or your customers' data, we handle it only as instructed for that project, under the terms agreed for it.
Where we work for an agency, on a project for a business the agency serves, the agency or that business decides how the data is used, and we handle it only as the agency instructs, under the agreement for that engagement.
Who else is involved
- Cloudflare hosts this site, provides the Turnstile anti-spam check, sends messages from the contact form, and receives and forwards email sent to our @doktahoo.com addresses.
- Google provides the Gmail mailbox where email to those addresses, including contact-form messages, is read and answered.
- WhatsApp (Meta) carries messages you choose to send there, under its own terms.
- PostHog provides the site analytics described above, with data held in the United States.
Some of these providers may process data outside Malaysia. We do not sell or rent personal data to anyone.
How long we keep it
Enquiries that do not lead to a project are deleted once they are no longer needed to follow up. Contract and billing records are kept for as long as Malaysian tax and accounting law requires.
Your rights
Under the PDPA you can ask what personal data we hold about you, ask us to correct it, and withdraw your consent for us to process it. The 2024 amendment also gives you a right to ask us to transmit your personal data to another data controller, where that is technically feasible and the data is in a format we can send. Write tohi@doktahoo.com and we will respond within the period the Act requires.
The Act requires a data protection officer only where a data controller carries out large-scale processing of personal data. We do not, so none is appointed; enquiries go to the address above.
If something goes wrong
Since 1 June 2025 the Act requires us to notify the Personal Data Protection Commissioner of a personal data breach as soon as practicable, and to tell you directly if the breach is likely to cause you significant harm. We will do both.
Changes
If this site starts using cookies, changes its analytics, or changes how messages reach us, this policy will be updated first and the date at the top will change.