This Privacy Policy explains how Asterovasys Solutions("we", "us") handles personal data when you use Digital Receipt (the website, application, and related services). We intend this notice to comply with Malaysia’s Personal Data Protection Act 2010 (PDPA). It is not a substitute for legal advice.
Data user: Asterovasys Solutions, Malaysia. Privacy requests: support@asterovasys.com.
1. Information we collect
- Account data: email address, hashed password, business profile (name, address, phone, optional tax identification / SST numbers, logo).
- Billing data: processed by Stripe. We store customer or subscription identifiers, plan, and payment status — not full card numbers.
- Product usage: receipts, line items, products, and customer details you enter (names, phone numbers, emails).
- Technical data: IP address and basic request logs for security, abuse prevention, and service operation.
2. Purpose and lawful basis (PDPA)
We process personal data to:
- Provide, maintain, and improve Digital Receipt
- Authenticate users and protect accounts
- Process subscriptions and send transactional emails
- Prevent abuse and enforce plan limits
- Comply with applicable law and respond to lawful requests
For merchant accounts, processing is generally necessary to perform the contract (your subscription) and for our legitimate interests in operating a secure service. Where PDPA requires consent (for example certain marketing), we will ask for it separately and you may withdraw consent by contacting us, without affecting processing that is required to run your account.
3. Your customers’ data on receipts
If you enter customer names, phones, or emails on receipts, you are the data user / controller of that information. We act as a service provider (data processor) to host and display it so you can issue and share receipts. You must have a lawful basis under PDPA (and any other applicable law) to collect that data, inform your customers as required, and set retention that matches your business.
4. Sharing and processors
We do not sell personal data. We use processors such as hosting providers (for example DigitalOcean), databases (PostgreSQL), email delivery (for example Resend), Cloudflare for DNS/CDN, and Stripe for payments. Those providers process data only to deliver their services to us.
5. Transfers outside Malaysia
Application and backup infrastructure may be located in Singapore or other regions. Payment and email providers may process data outside Malaysia. By creating an account you acknowledge this transfer as needed to provide the service. We take reasonable contractual and technical steps with providers to protect data.
6. Security
We use access controls, hashed passwords, HTTPS in production, and least-privilege practices for staff access. No method of transmission or storage is completely secure.
7. Retention and deletion
We retain account and receipt data while your account is active. You may export data or request account deletion from Settings (or by emailing support). Backup copies may persist for a limited period after deletion. Billing records may be kept as required for tax and accounting.
8. Your PDPA rights
Subject to PDPA exceptions, you may request to:
- Access personal data we hold about you
- Correct incomplete or inaccurate personal data
- Withdraw consent where processing is based on consent
- Limit processing where PDPA allows
Email support@asterovasys.com with the subject “PDPA request”. We may need to verify your identity. We aim to respond within a reasonable time.
9. Children
Digital Receipt is intended for businesses, not for children. Do not create an account if you are under 18.
10. Changes
We may update this policy. The “Last updated” date will change. Continued use after an update constitutes acceptance of the revised policy where permitted by law.