Privacy Notice
This version is awaiting final review. Details marked "to be confirmed" will be added before paid plans start.
1. Who we are
to be confirmed (Company No. to be confirmed) runs AthenaPlus. For the personal data of our account holders and website visitors we are the data user. For the personal data that our customers enter about their own clients, our customer is the data user and we process it on their behalf as a data processor.
2. Personal data we collect
| Whose data | What | Where it comes from |
|---|---|---|
| Account holders and invited members | Name, email address, password (stored only as a one way hash, never in plain text), the organisation you belong to, your role | You, when you register or accept an invitation |
| Your organisation | Firm name, address, contact details, tax identification number (TIN), SST number, LHDN MyInvois client ID and secret (encrypted), email sender name and address, invoice branding | You, in Settings |
| Your clients (processed for you) | Company name, registration numbers, address, phone number, contact person's name, email and phone number, TIN, SST number, MSIC code, fee schedules, invoices | You, by typing or CSV import |
| Payments | Subscription plan, payment status, billing history. Card details are collected and held by Stripe, not by us | You and Stripe |
| Technical data | IP address, browser type, sign in times, error logs, email delivery status (delivered, bounced) | Your device, our servers and our email provider |
3. Why we use it
- To create and run your account and provide AthenaPlus (generating invoices, submitting them to LHDN MyInvois, emailing them to your clients).
- To take payment for your subscription and keep our own accounting records.
- To send you service messages: email verification, password resets, invitations, billing notices and important changes.
- To keep AthenaPlus secure, prevent fraud and fix problems.
- To meet legal obligations, such as tax record keeping and lawful requests from authorities.
We do not sell personal data and we do not use it for advertising. If we ever want to send marketing emails, we will ask for your consent first and you can opt out at any time.
4. Who we share it with
| Recipient | Why | Location |
|---|---|---|
| Fly.io (application hosting) and Neon (database) | Run AthenaPlus and store its data | Singapore |
| Stripe | Payment processing | Global |
| Twilio SendGrid | Delivering emails | United States |
| LHDN (Inland Revenue Board of Malaysia) | E-invoice submission, at your instruction | Malaysia |
| Google Fonts and jsDelivr | Fonts and icons on our website and in the app (they receive your IP address) | Global |
| Professional advisers and authorities | Where required by law or to protect our legal rights | Malaysia |
Our service providers may only use the data to provide their services to us.
5. Transfers outside Malaysia
Our servers and database are in Singapore, and our email provider is in the United States. We transfer personal data there only to providers that protect it to a standard at least equivalent to the PDPA, in line with section 129 of the PDPA.
6. How long we keep it
- Account and customer data: while your account is active, and for 90 days after it is closed so you can reactivate or request a copy. Then it is deleted.
- Our own billing and accounting records: 7 years, as required by Malaysian tax law.
- Backups are overwritten on a rolling basis.
- Invoices you submit to MyInvois are also kept by LHDN under its own rules.
7. How we protect it
Connections are encrypted (HTTPS). Passwords are stored only as hashes. LHDN client secrets are encrypted in the database and never written to logs. Each organisation can see only its own data. Access to production systems is limited to authorised staff. No system is completely secure, but if a personal data breach is likely to cause significant harm we will notify the Personal Data Protection Commissioner and affected people as the PDPA requires.
8. Your rights
You may ask to access or correct your personal data, ask for a copy in a commonly used format (data portability), withdraw consent, or limit how we process it. Email to be confirmed. We will reply within 21 days. We may charge a fee allowed by the PDPA for access requests, and we may need to verify your identity. If you are a client of one of our customers, please contact that firm first, as it is the data user; we will help it respond.
9. What happens if you do not give us data
Some data (your email address, your organisation's details, LHDN credentials for e-invoicing) is needed to provide AthenaPlus. Without it we cannot create your account or submit invoices for you.
10. Cookies
We use only strictly necessary cookies: one keeps you signed in (it expires after 30 minutes of inactivity or when you sign out), one protects forms against forgery, and a short lived one carries on-screen messages between pages. We do not use analytics or advertising cookies.
11. Changes and contact
We will post changes to this notice on this page and email account holders about important ones. Questions or requests: to be confirmed · to be confirmed, to be confirmed.
Notis Privasi
1. Siapa kami
akan disahkan (No. Syarikat akan disahkan) mengendalikan AthenaPlus. Bagi data peribadi pemegang akaun dan pelawat laman web kami, kami ialah pengguna data. Bagi data peribadi yang dimasukkan oleh pelanggan kami tentang klien mereka sendiri, pelanggan kami ialah pengguna data dan kami memprosesnya bagi pihak mereka sebagai pemproses data.
2. Data peribadi yang kami kumpul
- Pemegang akaun dan ahli yang dijemput: nama, alamat e-mel, kata laluan (disimpan hanya dalam bentuk cincang sehala, tidak pernah dalam teks biasa), organisasi dan peranan anda.
- Organisasi anda: nama firma, alamat, butiran hubungan, nombor pengenalan cukai (TIN), nombor SST, ID klien dan rahsia klien LHDN MyInvois (disulitkan), nama dan alamat penghantar e-mel, jenama invois.
- Klien anda (diproses bagi pihak anda): nama syarikat, nombor pendaftaran, alamat, nombor telefon, nama, e-mel dan nombor telefon orang yang dihubungi, TIN, nombor SST, kod MSIC, jadual yuran dan invois.
- Pembayaran: pelan langganan, status pembayaran dan sejarah bil. Butiran kad dikumpul dan disimpan oleh Stripe, bukan oleh kami.
- Data teknikal: alamat IP, jenis pelayar, masa log masuk, log ralat dan status penghantaran e-mel.
3. Tujuan kami menggunakannya
- Untuk mewujudkan dan mengendalikan akaun anda dan menyediakan AthenaPlus (menjana invois, menghantarnya ke LHDN MyInvois dan menghantarnya melalui e-mel kepada klien anda).
- Untuk menerima bayaran langganan dan menyimpan rekod perakaunan kami.
- Untuk menghantar mesej perkhidmatan seperti pengesahan e-mel, penetapan semula kata laluan, jemputan, notis bil dan perubahan penting.
- Untuk memastikan keselamatan AthenaPlus, mencegah penipuan dan membaiki masalah.
- Untuk mematuhi kewajipan undang-undang, seperti penyimpanan rekod cukai.
Kami tidak menjual data peribadi dan tidak menggunakannya untuk pengiklanan. Kami akan meminta persetujuan anda terlebih dahulu sebelum menghantar e-mel pemasaran, dan anda boleh menarik diri pada bila-bila masa.
4. Pihak yang menerima data
- Fly.io (pengehosan aplikasi) dan Neon (pangkalan data), di Singapura.
- Stripe (pemprosesan pembayaran).
- Twilio SendGrid (penghantaran e-mel), di Amerika Syarikat.
- LHDN, untuk penghantaran e-invois atas arahan anda.
- Google Fonts dan jsDelivr (fon dan ikon di laman web dan aplikasi kami; mereka menerima alamat IP anda).
- Penasihat profesional dan pihak berkuasa, jika dikehendaki oleh undang-undang.
5. Pemindahan ke luar Malaysia
Pelayan dan pangkalan data kami terletak di Singapura, dan pembekal e-mel kami di Amerika Syarikat. Kami hanya memindahkan data peribadi kepada pembekal yang melindunginya pada tahap sekurang-kurangnya setara dengan APDP, selaras dengan seksyen 129 APDP.
6. Tempoh penyimpanan
Data akaun dan pelanggan disimpan selagi akaun anda aktif dan selama 90 hari selepas akaun ditutup, kemudian dipadam. Rekod bil dan perakaunan kami disimpan selama 7 tahun seperti yang dikehendaki oleh undang-undang cukai Malaysia.
7. Perlindungan data
Sambungan disulitkan (HTTPS). Kata laluan disimpan dalam bentuk cincang sahaja. Rahsia klien LHDN disulitkan dan tidak pernah direkodkan dalam log. Setiap organisasi hanya boleh melihat datanya sendiri. Jika berlaku pelanggaran data peribadi yang mungkin menyebabkan kemudaratan yang ketara, kami akan memaklumkan Pesuruhjaya Perlindungan Data Peribadi dan individu yang terjejas seperti yang dikehendaki oleh APDP.
8. Hak anda
Anda boleh meminta untuk mengakses atau membetulkan data peribadi anda, meminta salinan dalam format yang biasa digunakan (kemudahalihan data), menarik balik persetujuan atau mengehadkan pemprosesan. Sila e-mel akan disahkan. Kami akan membalas dalam tempoh 21 hari. Jika anda ialah klien kepada salah seorang pelanggan kami, sila hubungi firma tersebut terlebih dahulu kerana firma itu ialah pengguna data.
9. Jika anda tidak memberikan data
Sesetengah data (alamat e-mel, butiran organisasi dan kelayakan LHDN untuk e-invois) diperlukan untuk menyediakan AthenaPlus. Tanpanya, kami tidak dapat mewujudkan akaun anda atau menghantar invois bagi pihak anda.
10. Kuki
Kami hanya menggunakan kuki yang benar-benar perlu: satu untuk memastikan anda kekal log masuk (ia tamat selepas 30 minit tidak aktif atau apabila anda log keluar), satu untuk melindungi borang daripada pemalsuan, dan satu kuki jangka pendek yang membawa mesej pada skrin antara halaman. Kami tidak menggunakan kuki analitik atau pengiklanan.
11. Perubahan dan hubungan
Perubahan pada notis ini akan disiarkan di halaman ini dan pemegang akaun akan dimaklumkan melalui e-mel tentang perubahan penting. Pertanyaan atau permintaan: akan disahkan · akan disahkan, akan disahkan.