Privacy Policy

1. Scope and Our Role

PT Petalytix Teknologi Indonesia controls personal data needed to operate accounts, subscriptions, support, security, and our public services.

For customer, staff, vendor, booking, and other records entered by a merchant, the merchant decides why that data is used. AyaKasir processes it to provide the service on the merchant's instructions.

2. Personal Data We Process

Depending on the features you use, we may process:

• Account and registration data, such as name, email, phone or WhatsApp number, business name, category, province, city, account identifiers, roles, access settings, and password or PIN hashes.
• Google profile data, if you choose Google Sign-In, limited to the identifiers and profile details made available for authentication. We do not obtain access to your Google Drive, Gmail, or other unrelated Google services.
• Business-operation data, including products, prices, promotions, inventory, purchasing, vendors, customers, staff, bookings, cashier sessions, transactions, payment methods, debts, expenses, wallets, reports, receipts, branches, and uploaded business images.
• Subscription and payment data, including plan, billing period, invoice amount and status, payer contact, promotion or referral information, provider references, and verification results. AyaKasir does not receive complete card, bank-account, or e-wallet credentials entered directly with a payment provider.
• Online-order and AyaNaon data, including customer order details and, if publication is enabled, business category, address, coordinates, WhatsApp number, menu, price, availability, logo, photos, opening hours, and order link.
• Support, lead, and Aya assistant data, such as name, business name, location, contact details, questions, answer references, deletion requests, and support communications.
• Device and technical data, such as device type, operating system, app version, device or notification token, IP address where needed for security or rate limiting, page and feature usage, loading performance, and limited error diagnostics.

3. How We Obtain Data

We obtain data directly from you or an authorized user, automatically from the app or website, from a merchant that enters records about its customers, staff, or vendors, and from service providers such as Google or Xendit when you use the relevant feature.

4. Purposes and Legal Bases

We process personal data to provide and secure accounts and features; synchronize records; process and verify payments; apply subscriptions, limits, and promotions; provide support and communications; publish AyaNaon listings when enabled; prevent fraud and abuse; diagnose errors; improve reliability; comply with law; and establish, exercise, or defend legal claims.

Depending on the activity, the legal basis is performance of our agreement with you, your consent for optional processing, compliance with law, or our legitimate interests in operating and protecting the service while respecting your rights. You may withdraw consent for an optional feature without affecting processing already carried out lawfully.

5. Merchant-Provided Personal Data

A merchant is responsible for giving any required notice and having an appropriate legal basis before entering personal data belonging to customers, staff, vendors, or other people into AyaKasir. The merchant must also use AyaKasir's controls to help honor valid requests concerning that data.

6. Optional Public AyaNaon Listing

AyaNaon publication is optional and can be skipped during registration or managed later. If enabled, selected business information—including the store name, category, address, precise location pin, WhatsApp number, logo or photos, menu, prices, availability, opening hours, and order link—may be visible to the public and indexed by search engines.

Disabling the listing asks AyaNaon to hide it, but its reserved URL and temporary copies held by search engines, browsers, or other third parties may remain for a period outside our direct control.

7. Storage, Cookies, and International Processing

AyaKasir primarily uses Supabase for database, authentication, synchronization, and file storage. The web service is hosted through Vercel, and the mobile app may keep a local copy on your device for offline access. Necessary cookies, signed registration or payment state, and browser or app storage may be used for login, security, drafts, preferences, and service continuity.

Our providers may process data in Indonesia or other countries where they operate. Where a cross-border transfer occurs, we apply the safeguards required by applicable law. We do not sell personal data.

8. Service Providers and Other Recipients

We disclose only the data reasonably needed for the relevant service, which may include:

• Supabase for database, authentication, realtime synchronization, and file storage.
• Vercel for hosting, content delivery, server functions, web analytics, and performance measurement.
• Google for optional sign-in; Xendit or another disclosed payment provider for the payment flow you choose.
• Sentry and, on Android, Firebase Crashlytics for limited error diagnostics; our email provider for verification, reset, support, and deletion-request messages.
• OpenStreetMap for map tiles and the location picker; AyaNaon for an enabled public store listing; and WhatsApp when a merchant or visitor chooses that communication channel.
• Authorities, professional advisers, or another party when required by law, needed to protect rights and safety, or involved in a lawful corporate transaction.

9. Retention and Account Deletion

We retain personal data while the account or relevant service is active and for as long as reasonably needed for the purposes described here. Retention may continue where required for accounting, payment verification, security, fraud prevention, disputes, consent evidence, backups, or other legal obligations.

You may submit a deletion request through the Delete Account page or by email. After verifying the account holder, we normally review the request and begin the applicable deletion or anonymization process within seven business days. Some records may be retained where the law permits or requires it, and removal from backups, provider systems, or public caches follows their normal retention cycles.

Account deletion is not automatic when the form is submitted. We may contact you for identity verification or to explain records that cannot yet be deleted.

10. Your Rights

Subject to applicable law and relevant exceptions, you may use the rights below. Send a recorded request to ayakasir@petalytix.id. We may verify your identity and authority before responding. If your request concerns data controlled by a merchant, we may direct you to that merchant or assist it in responding.

• Receive information about processing, access your personal data, and obtain a copy.
• Complete, update, or correct inaccurate personal data.
• End processing, delete or destroy data, withdraw consent, or restrict processing where applicable.
• Object to a qualifying solely automated decision and obtain or transfer data in a commonly used format where technically possible.
• Submit a complaint or pursue another remedy available under applicable law.

11. Security

We use reasonable technical and organizational safeguards, including authentication, role-based access controls, password and PIN hashing, encrypted network transport, restricted database access, diagnostic-data minimization, and operational backups. No internet or storage system is completely secure, so users must also protect their devices, credentials, and staff access.

If a personal-data protection failure occurs, we will investigate, mitigate it, and provide notifications as required by applicable law.

12. Children's Privacy

AyaKasir is intended for adult business owners and authorized staff and is not designed for children to create or operate accounts. If you believe a child has provided account data directly to us, contact us so we can review and take appropriate action.

If a merchant uses AyaKasir to record a child's personal data in its own business operations, that merchant is responsible for the special protections and parent or guardian consent required by applicable law.

13. Changes to This Policy

We may update this policy when our services, providers, or legal obligations change. The new effective date will be posted here, and we will provide reasonable notice before a material change takes effect when required.

14. Contact

For privacy questions, rights requests, or account-deletion requests, contact PT Petalytix Teknologi Indonesia at:

ayakasir@petalytix.id