Trim Privacy Notice for Customers
Customers and barbers each have their own privacy notice. This page is only for customers.
CATALYST Design Sdn Bhd (SSM 1455613-U), trading as Trim, operates a home barbering subscription platform in Malaysia. Trim is the data controller for the personal data described here.
This notice is for Trim customers. It explains what we collect about you, why, who sees it, how long we keep it, and what you can ask us to do about it. It is written under the Personal Data Protection Act 2010.
Barbers who take jobs through Trim have their own separate privacy notice. This one does not cover them.
Notice version 2026.08.31, last updated 31 August 2026
What we collect
Your name, phone number and email address.
The home address where you want your cuts, and any access notes you give us, such as a gate code, which floor you are on, or where to park.
Your plan, the people named on it, and your booking history.
A reference for each payment. Your card number never reaches us.
Your ratings and notes about visits, and anything you send us through Support.
Messages you send in the app about a visit.
We collect only what the service needs, and we do not buy personal data about you from anyone else.
Why we collect it
To take your booking and send a barber to the right home. To take your payment and to run your plan and its renewals. To keep everyone safe during a visit, and to respond if something goes wrong. To answer support requests and to resolve complaints and disputes. To prevent fraud and to meet our legal and tax obligations. To improve service quality using your ratings.
Where we rely on your consent you can withdraw it. Where we need the data to deliver the service you asked for, or because the law requires it, we will tell you if withdrawing means we can no longer provide the service.
Who can see your address
Your home address is the most sensitive thing we hold, so access to it is deliberately narrow.
Ops staff with a need-to-know role can see full addresses. A barber sees your address only for a job assigned to them, and only for as long as that job needs it. Access ends when the job is completed, except where the address forms part of a dispute or incident record. Barbers are barred by their service agreement from keeping, sharing or reusing your address, or contacting you afterwards about anything other than that job, and that obligation continues after they stop working with Trim.
Children on your family plan
A family plan can include children. For a child we hold only the name you give us and the fact that they are a child. We do not collect a child's date of birth, phone number, email, IC or photograph.
You must be the child's parent or guardian, or have their permission, and an adult aged 18 or over must be present for the whole visit. A barber sees only the child's name on the job.
A child's details are deleted when they are removed from the plan or when the plan is closed.
Adults on your Family plan
If you name another adult on a Family plan, we hold their name and the booking history attached to them.
That adult can ask us for a copy of what we hold about them, ask us to correct it, or ask to be removed from the plan, by emailing privacy@trim.my or through Support. We do not need the account holder's permission to answer that adult about their own data.
The account holder confirms they have that adult's permission to give us the name and to book cuts for them.
Messages in the app
When you send a message in the app about a visit, including through Support, we store it so the visit can run and so we can look into a complaint, a grievance, or a safety issue.
Ops staff with a need-to-know role can read a conversation when they are investigating something. A barber sees only the conversation for the job they are on. We do not read messages as a matter of routine.
We keep those messages for 2 years after the visit, then delete them, unless they form part of a dispute or incident record, in which case we keep them for 7 years.
Who else we share it with
We do not sell your personal data and we do not share it for advertising.
We use a small number of service providers who process data on our behalf and only on our instructions: Supabase, for our database and file storage. Stripe, for card payments. Expo, for sending push notifications to your phone. A maps provider, so we can send a barber to your home.
We give the barber assigned to your visit only what they need to do the job: your name, your address, your access notes, and who is being cut.
We also share data where the law requires it, including LHDN for tax and e-invoicing, and DOSH or another authority where an incident during a visit has to be reported. We will share data with the police or a court where we are legally obliged to, or where someone's safety is at immediate risk.
Where your data is stored
Some of the service providers above store or process data on servers outside Malaysia.
Where that happens we only use providers that give your data protection comparable to what the PDPA requires, we put contractual protections in place with each of them, and we remain responsible for your data. We do not move your data to another country simply because it is cheaper or more convenient.
How long we keep it
Your name, phone, email and home address: while your account is active, then 12 months after it is closed.
Your terms and privacy acceptances, and your booking and payment records: 7 years, because tax law and proof of consent require it. Then deleted or anonymised.
Your ratings and visit notes: 2 years after the visit.
Messages about a visit: 2 years after the visit, or 7 years if they form part of a dispute or incident record.
Incident and safety reports about a visit to your home: 7 years, or longer where DOSH or another authority requires it.
When a retention period ends we delete the data, or anonymise it so it can no longer identify you.
How we protect it
Access is role-based, so staff only see what their role needs. Data is encrypted in transit and at rest by our hosting providers. Card numbers never reach our systems: Stripe handles them and we hold only a reference. Access to production data is logged, and changes to compliance records are written to an audit trail.
If something goes wrong
If a security breach happens that affects your personal data, we will investigate and contain it immediately.
We will notify the Personal Data Protection Commissioner without undue delay, and in any event within 72 hours of becoming aware of the breach.
We will tell you directly, within 7 days, where the breach is likely to cause you significant harm. We will explain what happened, what data was involved, what we have done about it, and what you should do.
Your rights
You can ask us to: give you a copy of the personal data we hold about you; correct anything that is wrong or out of date; delete your data, where we are not required to keep it for a reason in the retention section; stop using your data for a particular purpose, or withdraw a consent you gave us; explain a decision you think was made unfairly.
We will respond within 21 days. If we cannot do what you asked, we will tell you why.
You can also complain to the Personal Data Protection Commissioner if you are not satisfied with how we handled your request.
Marketing messages
Booking reminders, visit updates, and plan or payment messages are part of the service. They are not marketing.
We only send promotional messages — offers, new areas, or similar — if you turn Offers on in Account in the app. That toggle is off unless you turn it on. You can turn it off at any time. You can also email privacy@trim.my and we will stop using your data for direct marketing. That is your right under section 43 of the PDPA.
Turning Offers off does not stop booking or plan messages.
The website
This notice also covers trimclub.co and the legal pages on it.
The site uses only what it needs to load and to keep you signed in where a page requires it. We do not run advertising pixels or sell website data. If that changes we will update this notice and, where the law requires it, ask before we use a cookie that is not strictly necessary.
Our Data Protection Officer
Denise Khaandor is Trim's Data Protection Officer. She is accountable for how Trim handles personal data, and is your point of contact for anything in this notice, including access requests, corrections, complaints and breaches.
The fastest way to reach her is the Support section of the app, which creates a written record of your request. You can also email privacy@trim.my.
Changes to this notice
If we change this notice we will publish a new version and ask you to read it in the app. Every version is stored with its number and date, and we keep a record of which version you agreed to and when, so we can always show you exactly what you were told.
How we ask for consent
You are shown this notice and asked to agree to it at signup, before any booking. Your agreement is recorded with the notice version and a timestamp.
The customer terms of service are a separate document from this notice. The barber service agreement and the barber privacy notice are separate again. None of these documents are merged.
App diagnostics
The apps send us a small record when something breaks, when a screen is slow, and when you move around the app. That includes crash text, the phone model and system version, how long the app took to open, which screens you opened, what you typed in in-app search, and the names of actions such as booking or cancelling.
We do not put your address, phone number, card number, or chat messages in these records. We keep them for 90 days, then delete them. We use them only to find bugs and make the apps more reliable.