Privacy Policy

Last updated: 18 May 2026

This Privacy Policy explains how VynHous ("we", "us", "our") collects, uses, and protects personal data when you use the VynHous warehouse management software-as-a-service ("Service"). It aligns with the Malaysian Personal Data Protection Act 2010 (PDPA) and the EU General Data Protection Regulation (GDPR).

1. Who we are

VynHous is operated by Agilec Technology Sdn Bhd, registered in Malaysia. For data protection enquiries, contact our Data Protection Officer at success@agilectechnology.com or +60 19-215 3052, or via the Contact page.

2. Data we collect

• Account data: name, email, role, password hash, optional 2FA secret.
• Tenant data: company name, address, tax registration number, warehouse locations.
• Operational data: products, orders, customers, suppliers, inventory movements, shipments, returns, invoices.
• Billing data: subscription tier, payment method (held by Stripe — we do not store card numbers), invoice history.
• Usage data: authentication events, API requests, audit log entries.
• Support communications: email content, attachments.

3. Lawful basis for processing

• Contract performance: to provide the Service you have subscribed to.
• Legal obligation: audit trail retention, accounting records.
• Legitimate interest: product improvement, fraud prevention, security monitoring.
• Consent: marketing communications (opt-in only); push notifications (per-device opt-in).

4. How we use your data

• Provide, maintain, and improve the Service.
• Process payments and issue invoices.
• Send transactional emails (account verification, billing receipts, notifications you have opted into).
• Respond to support requests.
• Detect and prevent fraud or abuse.
• Comply with legal obligations.

5. Sub-processors

We use the following sub-processors to deliver the Service:

We require sub-processors to meet equivalent data protection standards. A complete list is maintained at /docs/legal/privacy (this page).

6. Data retention

• Active account: data retained while account is active.
• Cancelled account: 30-day grace for export, then permanent deletion (see GDPR documentation).
• Billing records: retained for 7 years to comply with Malaysian tax record requirements.
• Audit log: retained for 7 years for compliance purposes.

7. International transfers

Some sub-processors (notably Stripe, Resend, Inngest) are based in the United States. We rely on Standard Contractual Clauses (SCC) and equivalent safeguards to permit these transfers under GDPR.

8. Your rights

You have the right to:

• Access the data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (right to be forgotten).
• Port your data to another service.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interest.

To exercise these rights, use the in-app data export and account deletion tools under Settings → Account, or contact us via the Contact page.

9. Cookies

We use a single session cookie strictly necessary for authentication. We do not use third-party advertising, analytics, or marketing cookies in this version.

10. Security

• TLS 1.2+ for all data in transit.
• Encryption at rest for database and file storage.
• Row-level security (RLS) on every multi-tenant table.
• Two-factor authentication (TOTP) available on every account.
• Sensitive credentials (OAuth tokens, courier API keys) encrypted with pgcrypto.
• Immutable audit log of privileged actions.
• Quarterly security review of dependencies and configurations.

11. Children

The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from children.

12. Updates to this Policy

We may update this Privacy Policy from time to time. The current version is always available at /docs/legal/privacy. Material changes will be announced in-app and via email at least 14 days before they take effect.

13. Contact

For privacy enquiries, complaints, or data subject requests, contact:

Agilec Technology Sdn Bhd Email: success@agilectechnology.com Phone: +60 19-215 3052

Or use the Contact page.