beresbill

Privacy Policy

Last updated: 22 August 2026

This Privacy Policy explains how Allwayon Web Services (Business Registration No. 201403328157) ("we", "us", or "our") collects, uses, and protects information when you use BeresBill (the "Service"). It is intended to comply with Malaysia's Personal Data Protection Act 2010 ("PDPA").

1. Information We Collect

  • Account information: name and email address, managed via our authentication provider, Clerk.
  • Business and invoicing data: your business profile, client records, products, and invoices you create, including any tax registration numbers (TIN, BRN, MSIC codes) you enter for e-Invoice compliance.
  • Payment data: credit purchase records and transaction references. Card and bank payment details are handled directly by our payment gateways, ToyyibPay and Chip — we do not store your full payment card details.
  • Uploaded files: logos, QR codes, and receipts you upload, stored via Cloudflare R2.
  • Support conversations: messages and any attachments you send through in-app support chat, which are relayed to our support team via Telegram (see Section 4).
  • Usage data: basic technical logs (e.g. login activity) used for security and troubleshooting, and aggregate, cookieless website analytics (see Section 8 — Cookies and Analytics).

2. How We Use Your Information

  • To provide, operate, and maintain the Service.
  • To process credit purchases and generate invoices/receipts on your behalf.
  • To send transactional emails (e.g. payment confirmations, team invitations) via our email provider, Resend.
  • To detect and prevent fraud, abuse, or security incidents.
  • To respond to your support requests.

We do not sell your personal data to third parties.

3. Data Your Clients Provide

If you add your own clients' details (name, contact info, tax registration numbers) to generate invoices, you act as the data controller for that information, and we act as a data processor on your behalf. You are responsible for having a lawful basis to store and process your clients' data through the Service.

If you invite a team member or grant delegated (including read-only) access to your business — for example, to an accountant — the relevant business, client, and invoicing data in your account becomes visible to that invited person, to the extent of the role or access level you assign them. You control who is invited and can revoke access at any time.

4. Third-Party Service Providers

We share data with the following processors solely to operate the Service: Clerk (authentication), ToyyibPay and Chip (payment processing), Cloudflare R2 (file storage), Neon (database hosting), Resend (transactional email), Vercel (application hosting), and Telegram (relaying in-app support chat messages and attachments to our support team). Each provider only receives the data necessary to perform its function. Note that once a support message or attachment is relayed to Telegram, it is also subject to Telegram's own storage and retention as an independent service — deleting a support ticket in BeresBill removes the corresponding files from our own storage, but does not retroactively delete the copy already relayed to Telegram.

5. Data Retention

We retain your account and invoicing data for as long as your account is active, and for a reasonable period afterward to comply with tax record-keeping obligations and resolve disputes. You may request deletion of your account by contacting us, subject to any records we are legally required to keep.

6. Your Rights

Under the PDPA, you may request access to, correction of, or in some cases deletion of your personal data. To make a request, contact us at the email below.

7. Security

We use reasonable technical and organizational measures to protect your data, including encrypted connections and access-controlled storage. No system is completely secure, and we cannot guarantee absolute security.

8. Cookies and Analytics

We use a small number of essential cookies to keep you signed in and to attribute a referral if you arrived via an affiliate link. We also use Cloudflare Web Analytics, a cookieless, aggregate analytics service, to understand overall site traffic — it does not track you individually across sites and does not use tracking cookies. We do not use advertising or cross-site tracking cookies.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new "Last updated" date.

10. Contact

For privacy questions or data requests, contact us at allwayon.my@gmail.com.