Privacy notice

Who we are

ezResit is operated by Polaris Technologies (SSM registration 202603066744 · AS0511535-P), a company registered in Malaysia. For the personal data described in this notice, Polaris Technologies is the data user under the Personal Data Protection Act 2010.

You can reach us about anything in this notice at legal@ezresit.com.

Who this notice covers

• People who contact us or request a demo
• Merchants and their staff who use the ezResit dashboard
• People who view or keep receipts from a merchant that uses ezResit, including those who sign up for the optional wallet

What we collect and why

If you contact us or request a demo

Your name, business name, phone number or email address, the POS system you tell us about, and anything you write in the message. We use it only to respond to you: to answer questions, check your setup, and arrange a demo. We do not add it to a marketing list.

If you are a merchant

• Account and staff details: the email addresses used to sign in or to invite team members, your business name, outlets, and receipt branding.
• Setup and configuration: printer profile, locations, stations, loyalty settings, and the review link you configure.
• Billing: your subscription is billed through our payment provider, HitPay. Card and payment details are handled by HitPay; we receive payment status, not your card number.
• Receipt and counter data: the receipts your POS produces, feedback your customers leave, and the customers who have consented to hear from you.

If you view a receipt

Nothing, in the personal-data sense. A receipt opens when you hold its link. No account, phone number, or identity is attached to viewing it. Our hosting providers may keep standard technical logs (such as IP address and timestamps) for security and reliability.

We set one functional cookie that marks the receipts this browser has seen. It lets merchants see how many receipts get claimed, it expires after 180 days, it contains no personal details, and it is not used for advertising.

If you use the wallet

• Phone number, verified by a one-time code sent by SMS or WhatsApp. This is the only personal detail the wallet needs.
• Receipts you link, loyalty stamps you collect, and feedback you choose to leave.
• Your marketing choices per shop, kept as a permanent record so a choice you made is never silently overwritten.
• A sign-in cookie that keeps you logged in for 30 days.

Deleting your wallet removes your phone number and unlinks your receipts. The records that remain are anonymized so system history stays intact.

Receipt content

The content of a receipt comes from the merchant's till, not from us. Whatever their POS prints is what the service delivers. For questions about what appears on a receipt, or about data a merchant holds about you, contact the merchant. They are responsible for their own data.

How we use personal data

• To run the service: capturing, storing, and delivering receipts, and operating merchant dashboards and customer wallets.
• To verify phone numbers for the wallet and to deliver staff invitations.
• To show merchants their receipts, feedback, claim counts, and the customers who consented to marketing.
• To record and relay your marketing consent choices to the shop you made them with.
• To keep the service secure, prevent abuse, and investigate problems.
• To meet legal obligations.

We do not use receipt content to profile customers.

Who we share it with

Only the providers needed to run the service, and only what each one needs:

• WhatsApp (Meta) or an SMS provider gets your phone number, to deliver a one-time sign-in code.
• HitPay gets merchant billing details, to process subscription payments.
• An email delivery provider gets staff email addresses, to send dashboard invitations.
• Cloud hosting, database, and file-storage providers run the infrastructure the service sits on, engaged under contract.
• Google is involved only if you choose to leave a public review through a merchant's review link. We send nothing to Google ourselves.

We may also disclose personal data where the law requires it, or to protect the rights and safety of merchants, customers, or the service. We never sell personal data.

Where your data is processed

The service runs on infrastructure in Malaysia and in other countries where our providers operate. Where personal data is processed outside Malaysia, it is handled under this notice and under our contractual arrangements with those providers.

How long we keep it

• Receipt links stay readable for up to 180 days, then stop working.
• Wallet sign-ins last 30 days per session.
• One-time codes expire after 5 minutes.
• Staff invitations expire after 7 days.
• Marketing consent records are kept as permanent history.
• Receipts and merchant records are kept while the merchant's account is active, or as the law requires.

When a wallet is deleted, its identifying details are removed and the remaining records are anonymized.

How we protect it

Connections are encrypted, device and account credentials are stored only as hashes, receipt links are long unguessable tokens, and access to production systems is restricted. No method is perfect, but the service is built so that losing any single piece is not enough to expose your data.

Your rights

Under the Personal Data Protection Act 2010 you may ask to access or correct your personal data, withdraw consent, or ask us to delete it. Wallet users can change marketing consents and delete their account inside the wallet itself.

For anything else, email legal@ezresit.com. If you believe we have mishandled your personal data, you may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

If something goes wrong

If a breach of your personal data occurs, we will notify the Personal Data Protection Commissioner and affected individuals where the law requires it, and we will tell you what happened and what to do next.

Changes to this notice

If this notice changes, the new version replaces this page and the date at the top changes. Material changes are flagged on this page before they take effect.