Privacy Policy

This Privacy Policy explains how Vanquish Capital Sdn Bhd (202101024015 (1424315-V)) ("Vanquish Capital", "we", "us") handles personal data in connection with Avyra — Insurance Intelligence OS ("Avyra", the "Service"), available at avyra.my. We are committed to handling personal data in accordance with the Malaysian Personal Data Protection Act 2010 ("PDPA").

1. Two roles, two kinds of data

Avyra is used by insurance agencies ("Agencies", "you") to manage their own business. It is important to distinguish two categories of data:

• Account data — data about the Agency and its users who subscribe to and use Avyra (for example your agency name, your name, email address, phone number, and login credentials). For this data, Vanquish Capital is the data user (controller).
• Client data — the personal data of an Agency's own insurance customers that the Agency inputs into Avyra (for example customer names, NRIC/identification numbers, contact details, policy and vehicle information, and uploaded documents). For this data, the Agency is the data user (controller) and Vanquish Capital acts only as a data processor, processing that data on the Agency's behalf and on its instructions. The Agency is responsible for having a lawful basis and any necessary consents to collect and process its customers' data and to enter it into Avyra.

2. Account data we collect

When you register for or use Avyra we may collect: your agency name, your full name, email address, phone number, password (stored in hashed form), role, and records of your activity within the Service (such as logins, pages viewed, and actions taken) for security and support purposes.

3. How we use account data

We use account data to: create and administer your account; provide, maintain and improve the Service; authenticate users and secure the platform; communicate with you about your account, trials, billing, and service updates; provide customer support; and comply with our legal obligations.

4. Client data

Client data entered by an Agency is stored in the Agency's own isolated workspace and is only accessible to that Agency's authorised users. We do not use Client data for our own purposes. We access Client data only as needed to operate, secure, back up, and support the Service, or where required by law. Each Agency's data is logically separated from every other Agency's data.

5. Disclosure and service providers

We do not sell personal data. We share data only with trusted service providers who help us run Avyra, and only to the extent necessary. These currently include:

• Lovable Cloud (built on Supabase) — application hosting, database, and file storage;
• Resend — sending transactional and notification emails on your behalf;
• Stripe — processing subscription payments (Stripe receives billing details directly and we do not store full card numbers).

We may also disclose data where required by law, regulation, court order, or to protect our rights or the safety of others.

6. Storage, security and location

We apply reasonable technical and organisational measures to protect personal data, including access controls, row-level data isolation between Agencies, encryption in transit, and regular automated backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our infrastructure providers may store and process data on servers located outside Malaysia; by using the Service you acknowledge that data may be transferred to and stored in such locations, and we take steps to ensure it is handled consistently with this Policy and the PDPA.

7. Data retention

We retain account data for as long as your account is active and as needed to provide the Service. Client data is retained while the Agency's account is active. Following termination, data may be retained for a limited period to allow for export or account reactivation, after which it may be deleted, subject to any legal retention requirements.

8. Your rights

Subject to the PDPA, you may request access to, or correction of, your personal data, and may limit our processing of it in certain circumstances. Agencies are responsible for responding to access or correction requests from their own insurance customers in respect of Client data; we will assist Agencies in doing so where reasonable. To exercise any right, contact us through our contact page at avyra.my/contact.

9. Cookies

Avyra uses only the cookies and similar technologies necessary to keep you signed in and to operate the Service securely. We do not use advertising cookies.

10. Children

Avyra is a business tool intended for use by licensed insurance professionals and is not directed at anyone under 18.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified through the Service or by email, and the "Last updated" date above will change.

12. Contact

For any questions or requests about this Policy or your personal data, contact us through our contact page at avyra.my/contact.