Privacy Notice

This notice explains what personal data Alienworld Technology Berhad collects through Alienworld Apps (https://apps.alienworld.asia), your Alienworld account and the licensing in our apps, why we collect it, who handles it for us and what your rights are. We give it under Malaysia's Personal Data Protection Act 2010, as amended in 2024.

Alienworld Technology Berhad (company number to be added), L2-03 & L3-03, Netizen Residensi, Lebuh Utama Tun Hussein Onn, 43200 Cheras, Selangor, Malaysia, is the data controller. In this notice, "we", "us" and "our" mean Alienworld Technology Berhad.

The short version: we collect what we need to sell you a licence, run your account and check that a licence is valid. We don't run analytics, we don't use advertising or tracking cookies, and our apps never send us anything about your files.

1. What we collect

1.1 When you visit the website

• No analytics and no tracking. We don't use analytics tools, advertising cookies or tracking cookies.
• Checkout. Paddle's checkout loads only on the pages where you open it to buy. Paddle sets what it needs to take the payment safely, under its own privacy notice.
• Bot check. Cloudflare Turnstile loads only on the sign-in, sign-up and password reset forms. It checks that a person, not a script, is using the form, and sets what it needs to do that.
• Staying signed in. When you sign in, your browser stores a session token so you stay signed in. It is removed when you sign out.
• Server logs. Like any website, the companies that host our site and services record technical details of each request, such as the IP address, the time, the page asked for and the browser type. They keep these logs for a limited time under their own policies, for security and to keep the service running.

1.2 Your Alienworld account

• Email addresses: the email you sign in with and any others you add, with whether and when each was verified.
• Sign-in methods you link: Sign in with Apple, Google, or a password. A password is stored only as a one-way hash by Supabase Auth, our authentication provider, so nobody can read it, including us.
• From Apple or Google: if you sign in with them, they send us your email address and an account identifier. Google may also send your name and profile picture link, and Apple may send your name the first time. We don't use these for anything else. If you choose Apple's Hide My Email, we receive Apple's private relay address instead of your own.
• Sign-in security records: Supabase Auth keeps a record of sign-in events, including the time, the IP address and browser details, to protect your account. Short-lived sign-in links and 6-digit codes are stored only as hashes and expire after 15 minutes.

1.3 Purchases

Paddle.com is our reseller and the Merchant of Record for every order, so Paddle collects your payment details itself, under its own privacy notice. Your card and billing details stay with Paddle and never reach us.

Paddle sends us the details we need for the order and your licence:

• the name (if you give one) and email address you entered at checkout;
• Paddle's customer and transaction identifiers;
• what you bought, the amounts, the currency and the tax charged, and the country used to work out the tax;
• refunds and chargebacks on the order.

We also keep the licence created for the order: the product, the number of Macs it covers, its updates-until date, its status and the email it was bought with. We keep only a one-way fingerprint of your activation key, never the key itself.

1.4 Licensing in the app

When you activate an app, it sends us your key and:

• a hashed machine identifier: a one-way hash of your Mac's hardware UUID, made with a value specific to the app. The UUID itself never leaves your Mac, the hash can't be turned back into it, and it can't be matched with identifiers other companies use. We never collect your Mac's serial number;
• the Mac's label: "Mac" by default. You can change it, and it is what you see in your account's list of Macs;
• the app version and the macOS version.

When it checks in, about once every 7 days while the Mac is online, it sends your licence's identifier, the same hashed machine identifier and the app version. When you deactivate a Mac, it sends the licence identifier and the hashed machine identifier.

For each of these requests we record the time and your IP address shortened to its first three parts (for example 203.0.113.x). We don't store the full address. We use addresses briefly to limit repeated attempts.

We use this to activate your licence, to count the Macs on it, to let you see and remove Macs in your account, and to prevent fraud such as shared or leaked keys. The app never sends us anything about your files, folders, servers or how you use it.

1.5 Trials

When a trial starts, the app sends the same hashed machine identifier, the start date and the app version. We also note the macOS major version from the request, and record the time and shortened IP address as in 1.4. We keep this so that a trial can't simply be restarted on the same Mac, and to understand how many trials start and become purchases, in total and by app and macOS version. A trial needs no account, email or card.

1.6 Updates

When an app checks for updates, it only downloads the public update feed, and, if you choose to install, the update itself. It sends no machine identifier, licence or account details. As with any web request, our host's logs may record the IP address the request came from (see 1.1).

1.7 Emails and support

We send emails about your orders, keys and account, and sign-in links and codes. We don't send marketing email. If you contact us, we keep your message and our reply so we can help you.

1.8 Records of activity

We keep a log of actions on licences and accounts, such as activations, deactivations, new keys, refunds and anything our staff do, with the time and an IP address shortened to its first three parts. It helps us investigate problems and fraud, and it can't be edited after it is written.

2. Why we use it

We use personal data to:

• sell you a licence and deliver your key, with Paddle;
• run your Alienworld account, sign you in and keep it secure;
• activate licences, count Macs, run trials and prevent fraud;
• answer your questions and handle refunds;
• keep the records that tax and accounting law require.

We process it because it is needed to provide what you asked for under our contract with you, because the law requires it, or with your consent, which you give when you use these services after reading this notice. We don't sell personal data and we don't use it for advertising.

What you must give us. We need an email address to sell you a licence and run your account. The app needs to send the hashed machine identifier to activate a licence or start a trial. If you don't want to give these, you can still use the free version of an app, which needs no account and sends no licensing data. If you don't give them, we can't sell you a licence or activate one.

3. Who handles it for us

We use these service providers. Each one processes personal data for us only to provide its service, under its own data protection terms:

Paddle also uses the details you give at checkout for its own purposes as the seller of record, such as payment processing, tax and fraud prevention, under its own privacy notice.

We may also disclose personal data when the law requires it, to protect our rights or our customers from fraud, or to a company that takes over our business, which would have to respect this notice.

4. Transfers outside Malaysia

Our main database is in Singapore, and some of our providers handle data in other countries, including the United States and the United Kingdom. We transfer personal data outside Malaysia where the place it goes has laws that are substantially similar to Malaysia's or ensure an equivalent level of protection, or where the transfer is necessary to perform our contract with you, for example so that Paddle can process your order. In each case we rely on the provider's data protection terms to protect it.

5. How long we keep it

6. Your rights

You have the right to:

• access the personal data we hold about you and get a copy of it;
• correct it if it is wrong, incomplete or out of date;
• withdraw your consent, in which case we stop the processing that relies on it, though we may then be unable to provide some services;
• ask us to delete or anonymise it. When we close an account, we anonymise it: Macs already activated keep working, but we can no longer send you a new key. We keep the purchase and licence records that the law requires;
• data portability: ask us to send your data to you, or to another organisation you choose, in a common machine-readable format, where that is technically feasible;
• ask us to stop processing that is likely to cause you damage or distress.

You can see your licences, Macs and emails in your Alienworld account, change your emails and sign-in methods there, and remove a Mac. For anything else, email info@alienworld.asia from an email on your account. We may ask you to confirm the request by email. We reply within the period the law sets, and there is no charge unless the law allows one for a repeated or excessive request.

If you are unhappy with how we have handled your data, please tell us first. You can also complain to Malaysia's Personal Data Protection Commissioner.

7. Security

We protect personal data with measures that fit the risk:

• our licence, purchase and machine records can't be reached through our database provider's public interface, only through our own server functions;
• connections to our site, our licence service and our providers are encrypted;
• passwords are stored only as hashes, and activation keys only as one-way fingerprints;
• machine identifiers are hashed on your Mac before they are sent, and IP addresses are shortened before we store them;
• our staff must sign in and enter an authenticator code to reach customer records, and every action they take is logged.

No system is perfectly secure. If a data breach affects personal data, we notify the Personal Data Protection Commissioner, and the people affected, as the law requires.

8. Children

Our store and accounts are not meant for children. Someone under 18 should buy only with a parent's or guardian's consent. If you believe we hold a child's data without that consent, email info@alienworld.asia and we will delete it.

9. Changes to this notice

If we change this notice, we post the new version here with a new date. If a change materially affects how we use your data, we tell you by email before it applies.

10. Contact

For privacy questions and requests:

Alienworld Technology Berhad
L2-03 & L3-03, Netizen Residensi, Lebuh Utama Tun Hussein Onn, 43200 Cheras, Selangor, Malaysia
Email: info@alienworld.asia