Privacy Policy

Last Updated: September 2026

1. Introduction

Smart Town ("we," "our," or "us") operates smart-town.pro, a multi-domain SaaS and IT-services platform. This policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have. We bill in Malaysian Ringgit (MYR) and operate primarily for customers in Malaysia, so this policy is written to meet the notice requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) as well as general good practice for our customers elsewhere. If a specific local law gives you stronger rights than described here, that law controls.

2. Information We Collect

We collect the following categories of personal data:

  • Account data — name, username, email address, and a hashed password when you sign up. If you enable two-factor authentication, we store the associated secret and recovery codes.
  • Customer/billing data — when you become a customer or a contact is added on your behalf, we hold company name, contact name, email, phone, billing address, city, country, and tax ID.
  • Invoice and payment records — invoice numbers, line items, amounts, currency, due dates, and payment status. We do not store your card number or CVV — see Section 4, Payment Processing.
  • Support and communications — contact form submissions, support tickets, and notes our team adds while assisting you.
  • Usage and technical data — pages visited and general traffic patterns, collected via Google Analytics (see Section 5, Cookies and Analytics).

3. How We Use Your Information

We use the data above to provide and maintain the platform, generate and collect payment on invoices, respond to support requests and enquiries, secure accounts (e.g., detecting suspicious logins), and understand overall site usage so we can improve the service. We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data to third parties.

4. Payment Processing

Card payments are processed by Stripe, a PCI-DSS-certified payment processor. When you pay an invoice, your card details are sent directly to Stripe and never reach or pass through our servers. What we store on our side is limited to a Stripe customer reference, a Stripe payment/subscription reference, the invoice amounts, and a single-use payment-link token used to show you your own invoice online. Stripe's own handling of your payment data is governed by Stripe's Privacy Policy.

5. Cookies and Analytics

We use a small number of cookies:

  • Session cookie — keeps you signed in; it is required for the site to function and expires after a period of inactivity.
  • CSRF token — a security cookie that protects forms from cross-site request forgery; also required.
  • Google Analytics — we use Google Analytics to understand traffic and usage patterns on the marketing site. This sets analytics cookies and shares usage data (such as pages viewed and approximate location derived from IP address) with Google. You can opt out using the Google Analytics opt-out browser add-on, or block cookies generally through your browser's privacy settings.

We do not use advertising or cross-site tracking cookies.

6. Data Retention

We keep different categories of data for different periods:

  • Account and customer/billing records — retained for as long as you have an active account or customer relationship with us, and for a reasonable period afterward to meet our own accounting, tax, and dispute-resolution obligations. Paid invoices and payment records in particular are not automatically deleted, since we are required to keep financial records.
  • Activity/audit logs — automatically deleted after 180 days.
  • Notifications — automatically deleted after 90 days.
  • Failed background job records — automatically deleted after 30 days.
  • Session records — your session cookie expires after a period of inactivity; the underlying session record is purged from our database shortly after it expires.

If you ask us to delete your account (see Section 8, Your Rights), we will erase or anonymize the personal data we are not otherwise required to keep.

7. Data Security

The site is served over HTTPS and sits behind Cloudflare, which filters malicious traffic before it reaches our servers. Passwords are stored hashed, never in plain text, and we support optional two-factor authentication on accounts. Access to customer and billing records in our admin tools is restricted to authorized staff. No method of transmission or storage is 100% secure, but we take reasonable technical and organizational measures appropriate to the data we hold.

8. Your Rights

You can ask us to access, correct, or delete the personal data we hold about you, or ask us to explain how we use it. To exercise any of these rights, contact us at Loading email... . We will respond within a reasonable time. Some data — for example, records tied to an unpaid or already-issued invoice — may need to be retained even after a deletion request, where we have a legal or accounting obligation to keep it; we'll tell you if that applies.

9. Data Sharing

We share personal data only with the service providers who help us run the platform, each acting as a data processor on our behalf:

  • Stripe — payment processing (see Section 4).
  • Google Analytics — website traffic analytics (see Section 5).
  • Cloudflare — content delivery and security filtering for the site.
  • Our infrastructure/hosting provider (see Section 10, International Data Transfer).

We may also disclose data where required by law, or to protect the rights, safety, or property of Smart Town or others. We do not sell personal data to third parties.

10. International Data Transfer

Our application servers are hosted on infrastructure located in France, behind Cloudflare's global network. This means that even though we operate primarily for customers billed in Malaysia, your personal data is processed and stored on servers outside Malaysia. We rely on our hosting provider's and Cloudflare's security controls, and on the contractual and technical safeguards described in this policy, to protect your data wherever it is processed.

11. Children's Privacy

Smart Town is a business/B2B platform and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this policy as our practices or the data we process change. We will update the "Last Updated" date above when we do; material changes will also be noted via the site or by email where appropriate.

13. Contact Us

For privacy questions, access/correction/deletion requests, or complaints about how we handle your personal data, contact us at Loading email... or via our contact page.