Privacy Policy - AUREXIS

1. Who we are

This notice is given by AUREXIS RESOURCES, a sole proprietorship registered in Malaysia (registration no. 202603246644, PG0593444-M), owned by Dominic Belavendram ("we"), under the Personal Data Protection Act 2010 (PDPA). Our correspondence address is Bagan Serai, Perak, Malaysia.

This notice is also available in Bahasa Malaysia.

For any privacy question or request, contact Dominic Belavendram at [email protected].

2. What personal data we collect

Account details: your name and email address. If you sign in with Google, we receive your name and email address from Google.
Organisation and role: the organisation you belong to and your role in it.
Acceptance records: which versions of our Terms and this Privacy Policy you accepted, and when.
Billing records: your plan, payments and refunds. Card and bank details are handled by our payment providers; we never see or store your full card details.
Activity records: a record of important actions in your organisation (for example, a plan change or a member added), with the time and who did it.
Your business data: what you and your colleagues enter into the workspaces. It may contain personal data about other people, such as staff or customers.
Messages: what you send us when you contact us.
Technical data: our hosting and service providers keep technical logs, such as IP addresses, for security and to keep the service running.

3. Why we use it

to create and run your account and your organisation's workspaces;
to keep AUREXIS secure and each organisation's data separate;
to take payments, give refunds and keep the records the law requires;
to provide the AI features when you use them;
to answer your questions and send you service messages, such as payment receipts and changes to these documents.

We do not sell personal data, and we do not use it for advertising.

4. Is it required?

Your name and email address are required to create an account. Without them we cannot provide AUREXIS to you. Everything else you enter is up to you.

5. Who we share it with

Only the service providers we need to run AUREXIS, and only for that purpose:

Supabase (database and sign-in) and Cloudflare (hosting and security);
our payment providers, currently Stripe (payments);
Resend (sending emails);
Web3Forms (delivering the feedback you send us from the in-app feedback form);
our AI provider, currently Anthropic, but only what you send when you use an AI feature;
Google, if you choose to sign in with Google.

We may also disclose personal data where the law requires it, or to our professional advisers under a duty of confidence.

6. Processing outside Malaysia

Some of these providers store or process data outside Malaysia. We use established providers that protect the data they process.

7. How long we keep it

Account details and acceptance records: for as long as your account exists.
If your organisation is closed: its data is kept for 6 months so it can be exported, and then deleted.
Payment, refund and audit records: for as long as the law or our accounts require.

8. Your rights

You can ask to see the personal data we hold about you, ask us to correct it, and ask us to limit how we use it or to stop using it. Email [email protected]. We will reply within 21 days. We may need to confirm your identity first.

You can correct your name in AUREXIS yourself. If your personal data is in another organisation's workspace, we may refer your request to that organisation.

9. Security

Connections to AUREXIS are encrypted. Each organisation can see only its own data, and this is enforced by the database, not only by the screen. Important actions are recorded. No system is perfectly secure, but we work to protect your data and will act promptly if something goes wrong.

10. Cookies

AUREXIS uses no advertising or analytics cookies. See our Cookie Notice.

11. Changes to this notice

Each version has a date. When we publish a new version, you will be asked to read and accept it before you continue using AUREXIS.