Privacy Policy

Version 2026-10-27.1 · effective 27 October 2026

1. Who we are

This notice is given by AUREXIS RESOURCES, a sole proprietorship registered in Malaysia (registration no. 202603246644, PG0593444-M), owned by Dominic Belavendram ("we"), under the Personal Data Protection Act 2010 (PDPA). Our correspondence address is Bagan Serai, Perak, Malaysia.

This notice is also available in Bahasa Malaysia.

For any privacy question or request, contact Dominic Belavendram at hello@getaurexis.com.

2. What personal data we collect

  • Account details: your name and email address. If you sign in with Google, we receive your name and email address from Google.
  • Organisation and role: the organisation you belong to and your role in it.
  • Acceptance records: which versions of our Terms and this Privacy Policy you accepted, and when.
  • Billing records: your plan, payments and refunds. Card and bank details are handled by our payment providers; we never see or store your full card details.
  • Activity records: a record of important actions in your organisation (for example, a plan change or a member added), with the time and who did it.
  • Your business data: what you and your colleagues enter into the workspaces. It may contain personal data about other people, such as staff or customers.
  • Messages: what you send us when you contact us.
  • Technical data: our hosting and service providers keep technical logs, such as IP addresses, for security and to keep the service running.

3. Why we use it

  • to create and run your account and your organisation's workspaces;
  • to keep AUREXIS secure and each organisation's data separate;
  • to take payments, give refunds and keep the records the law requires;
  • to provide the AI features when you use them;
  • to answer your questions and send you service messages, such as payment receipts and changes to these documents.

We do not sell personal data, and we do not use it for advertising.

4. Is it required?

Your name and email address are required to create an account, and an organisation name is required to create an organisation. Without them we cannot provide AUREXIS to you. To buy a plan, payment details are needed; our payment provider collects them, not us. Everything else you enter is up to you.

5. Who we share it with

Only the service providers we need to run AUREXIS, and only for that purpose:

  • Supabase (database and sign-in) and Cloudflare (hosting and security);
  • our payment providers, currently Stripe (payments);
  • Resend (sending emails);
  • Web3Forms (delivering the feedback you send us from the in-app feedback form);
  • our AI provider, currently Anthropic, but only what you send when you use an AI feature;
  • Google, if you choose to sign in with Google.

We may also disclose personal data where the law requires it, or to our professional advisers under a duty of confidence.

6. Processing outside Malaysia

Some of these providers store or process personal data outside Malaysia. We transfer it to them because it is needed to provide AUREXIS to you, and we make sure each transfer meets the requirements of the PDPA, including section 129, and take the required steps to protect the data.

7. How long we keep it

  • Account details (your name, email address and sign-in) and records of your memberships and invitations: for as long as your account exists. You can ask us to delete your account by emailing hello@getaurexis.com from your account's email address. When we receive your request we stop using your account details for any other purpose, check that the request comes from you, and complete the deletion within 21 days. We delete your name, email address and sign-in, or replace them so they no longer identify you; activity records keep the action and the time but no longer identify you. Copies in our service providers' backups are removed as those backups expire. Deleting your account does not delete what an organisation has entered in its own workspace, such as your name in a project: ask that organisation, or we may refer your request to it. The records listed below are kept after deletion for the reasons given. If you are the only owner of an organisation, ownership must be passed on or the organisation closed first.
  • Records of your acceptance of our Terms and this policy (which version, when, and the technical identifiers recorded with it): kept for up to 6 years after your account is deleted, so that we can show what was agreed if a dispute arises, and used for nothing else.
  • Your organisation's business data, if the organisation is closed: kept for 6 months so it can be exported, then deleted within one month after that. The organisation's name is kept with our records; if it is a person's name, we will replace it on request.
  • Export copies: kept until the organisation's business data is deleted, although they cannot be downloaded after 14 days.
  • Payment, refund and invoice records: 7 years from the end of the year they relate to, as Malaysian tax law requires.
  • Activity records (who did what in an organisation, and when): kept with the organisation's records. Once your account is deleted, they no longer identify you.

8. Your rights

You can ask to see the personal data we hold about you, ask us to correct it, and ask us to limit how we use it or to stop using it; we act on these requests as the law provides. You can also withdraw your consent, ask us to delete your account as described in section 7, or ask for a copy of your personal data in a commonly used format, where this is technically feasible. Email hello@getaurexis.com. We will reply within 21 days. We may need to confirm your identity first.

You can correct your name in AUREXIS yourself. If your personal data is in another organisation's workspace, we may refer your request to that organisation.

9. Security

Connections to AUREXIS are encrypted. Each organisation can see only its own data, and this is enforced by the database, not only by the screen. Important actions are recorded. No system is perfectly secure. If we have reason to believe that a personal data breach has occurred, we will notify the Personal Data Protection Commissioner as soon as practicable, as the law requires. Where the breach causes or is likely to cause you significant harm, we will also tell you without unnecessary delay.

10. Cookies

AUREXIS uses no advertising or analytics cookies. See our Cookie Notice.

11. Changes to this notice

Each version has a date. When we publish a new version, you will be asked to read and accept it before you continue using AUREXIS.