Privacy Policy

Effective date: 15 October 2026. This notice is published in English and in Bahasa Malaysia (Notis Privasi). Both versions say the same thing. The previous version (22 July 2026) is kept for reference.

1. Who we are

This notice is given by Athena Lab Sdn. Bhd. (registration no. 202601005298 (1667396-D)), a company incorporated in Malaysia, trading as AthenaLab ("AthenaLab", "we", "us"). It explains how we process personal data under the Personal Data Protection Act 2010 (as amended in 2024), on our website athenalabtech.com and in our products.

Privacy questions, requests and complaints: privacy@athenalabtech.com, or the contact form.

2. Our two roles: controller and processor

• As data controller, we decide how personal data is used for our own business: website visitors, people who contact us or ask for a demo, account holders and their billing details, and the people we talk to on WhatsApp, email or chat.
• As data processor, we process data on behalf of the businesses that use our products. Examples are a workshop's customers and their vehicles in Workshop Hub, a company's customers and jobs in Athena Dispatch, and the receipts and invoices a business uploads to NOVA or Numina. For that data, the business using the product is the controller. People whose data is held by one of our customers should first contact that business. We will help the business respond.

3. Data we collect on our website and when you contact us

• Enquiry and trial forms: your name, contact details (email or phone), company, the product you are interested in and your message. We use these to reply to you, arrange demos and trials, and follow up on your enquiry. We also record an approximate city and country derived from your IP address, to understand where enquiries come from. Form entries are stored on our servers and in our own Google Sheet, and a short alert is sent to our team.
• Website chat (Athena Support): the chat window on our website records the conversation, the page you were on, and any details you choose to give (for example your name, email, phone or company if you ask for a demo). Your messages are processed by AI services (see section 6) to answer you. If you book a demo, your name and email are used to create a Google Calendar invitation.
• WhatsApp and email: if you message us, we keep the conversation and your number or email to reply and follow up. An AI assistant may draft or send the first replies. A person can take over at any time.
• Browser storage: our website stores your language choice and the chat session in your browser's local storage. We do not set advertising cookies, and we do not currently use analytics or tracking tools on the website. If we start using analytics, we will update this notice first and ask for consent where required.

Giving us your details is voluntary. If you do not give contact details, we cannot reply to your enquiry.

4. Data we process in our products

Each product processes only what it needs to work. All products also keep account details (name, email, a securely hashed password or Google sign-in, and login sessions) and security logs.

NOVA (finance assistant)

Business documents you upload, such as receipts, bills, invoices and bank statements, plus the figures extracted from them and kept in your NOVA workbook, and your questions to the assistant. Documents are read by an AI service (Anthropic) to extract the figures. Uploaded files and your workbook are stored on our servers. Your chat history is kept in your own browser. Subscriptions are billed through Stripe.

Numina (receipt capture)

You sign in with Google. Receipt photos and PDFs you capture are read by an AI service (OpenAI) to extract the date, merchant, amount and category. Numina saves the receipt and the extracted data to your own Google Drive and Google Sheet. It also keeps a copy of each receipt image, the extracted text and figures in Numina's own database, so the app can show your history, reports and limits. Numina asks Google only for permission to sign you in and to create and manage the files Numina makes in your Drive (it cannot see your other Drive files). It stores the access tokens needed for this. You can revoke access at myaccount.google.com/permissions. Subscriptions are billed through Stripe. You can delete your Numina account in the app. This removes Numina's copy of your data but not the files already in your Drive.

Athena Accounting

Your company's books: customers and suppliers (names, registration, tax and SST numbers, contact details, addresses), invoices, bills, bank details and uploaded documents. For e-Invoicing, invoice data and tax identification numbers are sent to LHDN's MyInvois system. A TIN check may involve an identity card or passport number. Emails such as account notices are sent through Google. AI document capture is not active at present. If it is switched on, documents will be read by an AI service (Anthropic), and this notice will be updated first.

Athena People (HR and payroll)

Athena People is in a paused limited beta and is not currently offered. When it is offered, it processes employee records, payroll, claims, leave and attendance (which may include location at clock-in). This can include sensitive data such as identity numbers and medical claim categories. We will publish the specific terms for this data before the product is offered again.

Athena Support (AI customer chat)

For businesses that use Athena Support on their own website: their visitors' chat transcripts, the page URL, and any contact details visitors provide, plus tickets and leads. Messages are processed by AI services (Anthropic to write replies; OpenAI to match questions to the business's knowledge base). Demo bookings may use Google Calendar.

AI Receptionist

AI Receptionist is provided as a managed service set up for each client. The communication channels, the data collected (such as caller details and conversation content) and the service providers involved are agreed with each client in writing before go-live.

Athena Dispatch (field service)

Your company's details, your team's accounts, and your customers' names, phone numbers, addresses and notes, plus quotations, jobs, invoices, job photos and customer signatures. For e-Invoicing, invoice data (including the buyer's name, tax number and phone where required) is sent to LHDN's MyInvois system. Unsent form drafts are kept in your browser until submitted.

Workshop Hub

Your workshop's customers (names, phone numbers, emails, addresses, tax or business registration numbers), their vehicles (registration, VIN, chassis and engine numbers, mileage) and service history, mechanics, suppliers, job cards, bills and payments, and supplier invoices you scan. Scanned invoices are read by an AI service (Anthropic) to fill in parts and prices. Password-reset emails are sent through Resend. Login sessions record IP address and browser type for security.

Athena AI and custom AI work

For custom automation projects, the data involved, where it is stored and the services used are set out in the written agreement for that project. We use client data only to deliver the agreed work.

5. Why we use personal data

• To provide, run, secure and support the products you use, and to keep your account working.
• To reply to enquiries, arrange demos and trials, and follow up with businesses that contacted us.
• To bill subscriptions and keep records the law requires (for example invoices and tax records).
• To detect, investigate and prevent abuse, fraud and security incidents.
• To improve our products, using aggregated or service-level information.

We do not sell personal data, and we do not use the contents of your documents or business records for advertising. We do not use your business documents to train our own AI models.

6. Who receives data (service providers)

We share personal data only with service providers that help us run our products, under their own security and data terms, and only for the purposes in this notice:

• DigitalOcean: our servers and encrypted backups, in Singapore.
• Supabase (on Amazon Web Services, Singapore): Numina's database.
• Anthropic and OpenAI: AI services that read documents and write chat replies (NOVA, Numina, Workshop Hub, Athena Support, and our own enquiry handling).
• Google: sign-in, Drive and Sheets (Numina), email delivery, Google Calendar for demo bookings, and the Google Sheet where we record enquiries.
• Stripe: card payments and subscriptions for NOVA and Numina. We do not receive or store your full card number.
• Resend: password-reset emails for Workshop Hub.
• LHDN (MyInvois): e-Invoice submission and tax number checks, when you use e-Invoicing.
• ip-api.com: converts a website visitor's IP address into an approximate location.

We may also disclose data where the law requires it, to protect our rights or users' safety, or to a buyer or successor of our business (who would be bound by this notice).

7. Transfers outside Malaysia

Our servers and databases are in Singapore. Some AI, email and payment providers process data in other countries, including the United States. When we transfer personal data outside Malaysia, we do so under the conditions of section 129 of the Personal Data Protection Act 2010. We use providers that commit to protecting the data and that process it only to provide their service to us.

8. AI processing and its limits

Our products use AI to read documents, suggest categories and figures, and draft replies. AI can make mistakes. Results are shown for you to check, and our products are designed so that you, not the AI, approve accounting, payroll, tax and other financial decisions. AI providers receive only what is needed for each task.

9. How long we keep data

• Account and product data is kept while your account is active.
• After you close your account or ask us in writing to delete it, we delete your live data within 30 days. Encrypted backup copies are overwritten in the normal backup cycle within about 6 months.
• We may keep records we must keep by law (for example invoices and tax records) for the period the law requires.
• Enquiry and conversation records are kept while we are in contact with you. We delete them when they are no longer needed, or sooner on request.
• Some short-lived data is removed automatically. For example, failed login records are removed after 2 days, and Athena Accounting's assistant chat history after 90 days.

Data saved to your own Google Drive or Sheets (Numina) stays under your control. Deleting your Numina account does not delete those files.

10. Security

We take practical steps to protect personal data, including:

• encrypted connections (HTTPS);
• securely hashed passwords;
• separation of each business's data;
• access limited to people who need it;
• encrypted off-site backups;
• security logging.

No system is completely secure. If a personal data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected as the law requires. Where we act as a processor, we notify the business we act for.

11. Your rights

Under the Personal Data Protection Act 2010, you may:

• ask to access the personal data we hold about you, and for a copy;
• ask us to correct data that is inaccurate, incomplete or out of date;
• withdraw consent or ask us to stop or limit processing, including direct marketing;
• ask us to delete your account data (section 9);
• ask us to transmit your data to another organisation, where technically feasible (data portability);
• complain to us, and to the Personal Data Protection Commissioner (pdp.gov.my).

Write to privacy@athenalabtech.com. We may need to verify your identity. Where a fee or time limit is set by law, we follow it. If we cannot do what you ask, we will tell you why. Withdrawing consent or asking us to stop processing may mean we can no longer provide a product.

12. Children

Our products are for businesses. They are not intended for children, and we do not knowingly collect children's personal data.

13. Changes to this notice

We update this notice when our products or the law change. The effective date at the top shows the current version, and previous versions are kept online. We tell account holders about material changes by email or in the product before they take effect.

14. Contact

Athena Lab Sdn. Bhd. (202601005298 (1667396-D)), Malaysia.
Privacy: privacy@athenalabtech.com · General: sales@athenalabtech.com · Contact form