No MOQ · 1-20 pcs printed in 3-5 working days · Self-collect in Denai Alam

Cookie Policy

Last updated 28 September 2026

What changed: we now describe the order reports we send to Google, Meta, TikTok and OpenAI, our 90-day visit cookie, how long we keep visit records, the Meta ad details we keep with WhatsApp chats, how we tell Google when a visitor from its ads starts a WhatsApp chat, and that our own visit record notes whether you stayed or tapped our phone number.

This Policy explains the cookies, scripts, and similar tracking technologies that BISHH MALAYSIA SDN. BHD.("BISHH") uses on bishh.co, why we use them, and the choices available to you.

Read this Policy together with our Privacy Policy.

1. What are cookies?

Cookies are small text files stored on your device when you visit a website. They let the website remember your actions and preferences over time. Similar technologies include local storage, session storage, tracking pixels, and SDKs embedded in the website or mobile app.

2. Categories of cookies we use

2.1 Strictly necessary (always on)

Required for the website to function. These cannot be switched off via our cookie banner because the site breaks without them.

  • Session cookies that keep you logged in
  • CSRF tokens to protect form submissions
  • Cart state (items you've added, print specifications)
  • Checkout step progress
  • Security and fraud-prevention cookies

2.2 Functional

Help remember your preferences and personalise your experience.

  • Saved shipping address (if you choose to save one)
  • Language and display preferences

2.3 Analytics

Help us understand how visitors use the site so we can improve it. Where used, these are configured to minimise the personal data they collect.

  • Google Analytics 4 (if active): page views, session duration, conversion funnel. Runs in the Google infrastructure.
  • Our own visit record(first-party, kept by BISHH): the page you landed on, the site or ad that sent you (including the ad click reference in the link, such as Google's click ID), and whether you stayed (opened a second page, scrolled halfway down a page, or kept it in view for 20 seconds), tapped WhatsApp or our phone number, added to cart or started checkout on that visit. Your browser keeps the link to this record in a cookie called bishh_sid. It lasts 90 days and starts again each time you visit. It is not switched by the cookie banner. When you pay for an order, or start a WhatsApp chat with us after clicking one of our Google ads, some of it is sent to ad networks as described in section 2.5. We keep the visit record for 12 months after your last visit and then delete it. For a visit that led to an order or a WhatsApp chat with us, we keep only which site or ad sent you, which page you landed on and when, without your IP address, browser or ad click reference.
  • Ad visit note: if you arrive from one of our ads, your browser keeps a note of that ad in local storage (bishh_ad_visit) for 90 days. In that time, a WhatsApp message you start from our site ends with a short line such as "Ref: K7Q2M9". When it reaches us, that line links the chat to your visit, so we know which ad it came from. You can delete the line before you send.

2.4 Marketing & advertising

Used to measure ad campaigns and show relevant content. The tags below load in your browser only after you accept optional cookies. Section 2.5 explains what our own servers send to ad networks when you pay for an order. That does not depend on the cookie banner.

  • Meta Pixel (if active): conversion tracking for Facebook and Instagram advertising.
  • TikTok Pixel (if active): conversion tracking for TikTok advertising.
  • Google Ads tag (if active): conversion tracking and remarketing for Google Ads.
  • ChatGPT Ads measurement pixel by OpenAI (if active): tells us when a purchase came from one of our ads on ChatGPT. It sets two cookies: __oppref, kept for 30 days, which remembers the ChatGPT ad you came from, and __obref, kept for 365 days, which OpenAI uses for ad measurement.

2.5 Paid orders we report to ad networks

Added 25 September 2026. When you pay for an order, our own servers tell some ad networks about the sale, so they can see which of our ads led to it. This is not done by a cookie or tag in your browser, and it happens whether or not you accepted optional cookies.

  • Google Ads: if the order came from one of our Google ads, we send Google the ad click reference from the link you clicked, our order number, the order value and the time you paid. We do not send your name or contact details. An order counts as coming from a Google ad when you paid within 90 days of the click, either on the visit that came from the ad or after a WhatsApp chat you started from that visit (we match the chat to the order by your phone number or BISHH account). If you start a WhatsApp chat with us from our website after clicking one of our Google ads, we tell Google the ad click reference and the time the chat started. We do not send your name, number or messages.
  • Meta (Facebook and Instagram): for every paid order, a scrambled (hashed) copy of your email address, phone number, first and last name, city, state, postcode and country, and of your BISHH account ID if you have one, plus the IP address and browser type of your visit, the order number, the items and the order value. If you accepted cookies and Meta's pixel set them, also Meta's own cookie IDs (_fbp, _fbc).
  • TikTok: for every paid order, a scrambled (hashed) copy of your email address and phone number, plus the IP address and browser type of your visit, the order number, the items and the order value.
  • OpenAI (ChatGPT ads): only for an order that came from one of our ads on ChatGPT, the ad click reference from the link you clicked, our order number, the order value and the time you paid. We do not send your name or contact details.

Hashing turns each detail into a code. Meta and TikTok compare those codes with the ones they hold for their own users, to match the sale to people who saw or clicked our ads.

For questions about these reports, or to ask us to delete the record of your visits to our website, email us at the address in section 7. Details already sent are held by Google, Meta, TikTok and OpenAI under their own privacy policies, and you can also use their own privacy settings.

3. Your choices

You can manage cookies in three ways:

  • Cookie banner on first visit: choose Accept to load Google Analytics (section 2.3) and the tags in section 2.4, or Essential only to keep them off. The banner does not switch our own visit record (section 2.3) or the order and chat reports in section 2.5.
  • Browser settings:all modern browsers let you block or delete cookies. See your browser's Help menu. Blocking strictly-necessary cookies will break checkout and other core flows.
  • Third-party opt-outs: Google Analytics opt-out at tools.google.com/dlpage/gaoptout; Meta advertising controls at facebook.com/adpreferences.

4. Local storage, session storage, and device identifiers

In addition to cookies, we may use browser local/session storage and device fingerprint data (IP, user agent) for fraud prevention and abuse detection, and to report paid orders to ad networks as described in section 2.5. These are treated with the same care as cookies under this Notice.

5. Do Not Track

Some browsers send a "Do Not Track" signal. Because there is no uniform industry interpretation of this signal, our site does not currently respond to it. We instead offer a choice in the cookie banner for the optional tags in section 2.4. It does not change the order and chat reports in section 2.5.

6. Changes to this notice

We may update this Notice as we add or remove tracking technologies. The latest version is always published at /policies/cookies with the date it was last updated.

7. Contact

Questions about cookies or tracking should be directed to sales@bishhmalaysia.com.