Privacy Policy
Effective 10 November 2026
Scope
This policy explains how XAVAX ERP, a service of xavax.app, handles data when you use it. Each workspace belongs to a customer organization, which decides what business data is entered; we process that data on the organization's behalf.
Data we collect
Your name, email address and profile photo from your Google account. Workspace settings such as company name, address, base currency and time zone. The business records your team enters, such as projects, budgets, customers, suppliers, items, purchase and sales documents, journals and attachments. Approval records, which store the approver's name, email address, role, time, IP address and browser. An activity log of changes, and the cookies needed to keep you signed in and to remember your language and last workspace.
How we use data
To provide the service, show in-app notifications, keep records accurate and auditable, provide support and protect the service from misuse. We do not sell your data or use it for advertising.
Data from Google
We use Google sign-in only to identify your account (name, email address and profile photo). We do not request access to your Gmail, Drive or Calendar. Use of data from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Service providers
We use Supabase for the database and file storage (Tokyo, Japan), Vercel for hosting and Google for sign-in. If we add a provider, for example for email delivery or online payments, we will list it here before it receives your data. Data is shared only as needed to run the service, or where the law requires it.
Retention and deletion
Data is kept while the workspace is active. Submitted documents, ledger entries, approval records and the activity log cannot be deleted in the app, because accounting records must stay complete; mistakes are corrected with a cancellation or reversal. The workspace owner can ask us to delete the workspace; we do so within 30 days, except records we must keep by law.
Security
Data is encrypted in transit, separated per workspace in the database and protected by the role-based permissions your workspace sets. Sensitive fields such as cost prices are shown only to roles allowed to see them. No system is free of risk, so keep your Google account secure.
Your rights
Under the Indonesian Personal Data Protection Law (Law No. 27 of 2022), you may request access to, correction of, or deletion of your personal data. If your data was entered by an organization that uses XAVAX ERP, contact that organization first.
Contact
Privacy questions: [email protected].