Privacy Policy

This Privacy Policy explains how Aeris ("we", "us", or "our") collects, uses, discloses, and protects personal data when you use our Service. It applies to all users — business owners (admin accounts) and their end customers who interact via the public chat widget.

We are committed to complying with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

2.1 Account Data (Admin Users) — When you register: email address and password, subscription and billing details, locale and timezone preferences.

2.2 Business Configuration Data — Business name, description, profile settings, appointment categories, availability windows, menu items, staff records, locations, rental units, FAQ entries, module settings.

2.3 Operational Data — Conversation and message history (including AI responses), food orders, appointments, shift records, inventory movements, scheduled task configurations, pending actions and job logs.

2.4 Usage and Analytics Data — Daily AI request counts, session activity (timestamp, IP address, country via GeoIP, browser/device), system event logs.

2.5 Guest / End-Customer Data — Chat messages, name/email/phone if provided during booking or order, IP address and country. We act as a data processor for end-customer data on your behalf; you are the data controller and are responsible for informing your customers.

We do not sell your personal data to third parties.

We share data with the following third parties solely to operate the Service:

We require all sub-processors to maintain appropriate data protection standards.

After retention periods expire, data is permanently deleted and cannot be recovered.

• Encryption in transit: All data is encrypted via HTTPS/TLS.
• Encryption at rest: Data stored in Supabase (Postgres) is encrypted at rest by Supabase.
• Access control: Row-Level Security (RLS) policies enforce per-account data isolation.
• API key management: Secrets are stored as environment variables and never exposed to clients.
• Authentication: Managed by Supabase Auth with JWT-based bearer tokens.

No system is completely secure. In the event of a data breach, we will notify you as required by applicable law.

The Service uses browser localStorage for session preferences (developer mode toggle, invoice acknowledgement state) and authentication tokens (managed by Supabase SSR).

We do not currently use third-party tracking cookies or advertising pixels.

Under the PDPA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Delete your personal data (subject to legal retention requirements)
• Withdraw consent where processing is based on consent
• Data portability — request an export of your data before account deletion

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

EU/EEA users: This Service is not specifically directed at EU residents. If you have EU customers, consult a GDPR specialist regarding your obligations as a data controller.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. Contact us if you believe we have inadvertently collected data from a minor and we will delete it promptly.

Your data may be processed outside Malaysia (e.g. the US, where Anthropic and Supabase infrastructure may be hosted). We take reasonable steps to ensure adequate protection is in place, including contractual safeguards with sub-processors.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice at least 14 days before taking effect. The "Last updated" date at the top always reflects the current version.

For questions, concerns, or requests regarding this Privacy Policy:

Email: [email protected]
Company: AerisOS Technologies · 202603112170 (MA0345698-U)

We aim to respond to all privacy-related enquiries within 30 days.