Privacy Policy
Last updated 19 Oct 2026
Also in Bahasa Malaysia · Bahasa Indonesia · ภาษาไทย.
This policy explains what personal data Servora collects, why, who we share it with, and the choices you have. Servora is operated by Skyrocket Solutions Sdn Bhd, company no. 202101041376 (1441676-K), Suite 15-23A, Level 15, Avenue Crest, Jalan Jubli Perak 22/1, Seksyen 22, 40300 Shah Alam, Selangor Darul Ehsan, Malaysia ("Servora", "we", "us").
We have written it to meet the Personal Data Protection Act 2010 of Malaysia (as amended in 2024), and to give the information required by Thailand's Personal Data Protection Act B.E. 2562 and Indonesia's Personal Data Protection Law (Law No. 27 of 2022) to visitors and customers in those countries.
1. Two roles: data we control, and data we hold for our customers
Servora is software that restaurants, cafés, central kitchens and other food and beverage businesses ("Customers") use to run their operations. That gives us two different roles.
- We are the data controller (data user) for information about visitors to our website, the people who sign up and log in, billing contacts, people who contact our support, and members of our referral programme. This policy covers that data in full.
- We are a data processor for the information our Customers put into Servora about their own employees, suppliers and other people — for example staff records, attendance, payroll and expense claims. Our Customer decides what is collected and why, and is responsible for telling their staff and obtaining any consent the law requires. We process that data only to provide Servora to the Customer, under our Terms of Use. If you work for one of our Customers and have a question about your data, please contact your employer first; we will help them answer it.
2. Data we collect as controller
When you visit our website
- Your IP address, which we look up to estimate your country so that we can show prices in your local currency. We send it to an IP-location provider (see section 5) and cache the result for up to seven days. We do not use it to identify you.
- Cookies that remember your language choice and, if you followed a referral link, the referral code (see section 9).
- Standard server logs: IP address, browser type, page requested and time, kept for security and troubleshooting.
We do not use advertising trackers, social-media pixels or third-party analytics on our website or in the app.
When you create an account or are invited to one
- Your name, email address and password (stored only as a one-way hash), and the role your organisation gives you.
- Your company's details: business name, registration number, address, billing address, contact email, tax and employer statutory numbers, country and billing currency.
- Activity information: when you last used the app, your sign-in sessions (IP address and browser), and an audit trail of changes made in the account (what changed, by whom, when, from which IP address).
- If you set up a passkey, only its public key and identifier — never your fingerprint or face.
When you pay
Payments are taken by our payment provider, CHIP. We send CHIP your company name, billing email, the items being paid for and the amount. We never see or store your card or online banking details. We keep a record of each payment, its amount, currency and status.
When you contact us
- Support requests: your name, email, the category and content of your message, any files you attach, the page you were on, your browser and IP address.
- Live chat (where offered): your name, email and messages. If you are signed in, we also pass the chat service your account and company details — company name, plan, subscription status, the outlet or kitchen you are working in and the page you are on — so that we can help without asking you to repeat them. We do not pass your business's sales, costs, payroll or staff data to the chat service.
When you join the referral programme
Affiliates give us their name, email, phone number and the bank account we pay commission into. We record the companies you refer and the commission earned.
3. Data we process for our Customers
Depending on the modules a Customer uses, Servora may hold the following about the Customer's staff and contacts. The Customer controls this data.
- Staff records: name, contact details, address, date of birth, gender, nationality, marital status, education, emergency contacts, photo, identity card or passport and visa numbers and expiry dates, employment details.
- Payroll: salary and revisions, bank account, EPF, SOCSO, EIS and income-tax numbers, tax reliefs, payslips and EA forms.
- Attendance: clock-in and clock-out times, the GPS location of each punch and its distance from the workplace, a selfie taken at the punch, and the device used. If the Customer turns them on: a face template used to confirm identity at clock-in, and a periodic last-known location while a staff member is on shift. Both are off by default.
- Expense claims and petty cash: receipt and statement images, amounts, mileage routes, and medical claim totals.
- Training: course progress, quiz results and certificates.
- Suppliers: contact names, emails, phone numbers and addresses.
- Business records: recipes, purchasing, stock, sales by item and department. Servora does not collect the personal data of the Customer's diners.
Some of this is sensitive personal data under the law: the face template is biometric data, medical claims are health data, and some HR fields (such as religion and race) are sensitive in some countries. Customers must have a lawful basis — usually explicit consent — before recording it, and must tell their staff about clock-in face matching, selfies and location. The face template is calculated on the staff member's own phone from the camera image; Servora stores the resulting numbers and an optional reference photo, and compares them on our server. We do not use face templates for any other purpose and never share them.
4. How we use data, and our legal basis
- To provide Servora — accounts, sign-in, the features you use, emails the system sends (purchase orders, rosters, reports, receipts): to perform our contract with you.
- To bill you and keep financial records: contract and legal obligation.
- To answer support requests and live chats: contract, or our legitimate interest in helping prospective customers.
- To keep Servora secure — audit trails, logs, abuse prevention: legitimate interest and legal obligation.
- To show local prices on the website: legitimate interest.
- To tell you about changes to the service, your plan or these terms: contract. We will only send marketing emails with your consent, and every one has an unsubscribe link.
- To improve Servora using aggregated information about how the service is used.
- To publish market prices for common ingredients on our website: the median price paid, taken from the purchase records of businesses using Servora. We never name the supplier or the business. Where only a few businesses buy an item, the published price may be close to what one of them pays: legitimate interest.
Artificial intelligence
Several features use AI models to read documents and write summaries: scanning supplier invoices and delivery orders, reading receipts and statements for petty cash and expense claims, importing recipes, suggesting preparation steps, matching POS items, generating training quizzes and writing weekly report insights. When you use them, the relevant document or figures are sent to our AI provider, OpenRouter, which passes them to the model provider that runs the request. We use these providers only to produce the result you asked for, and every request is limited to providers that OpenRouter lists as neither keeping the data nor training models on it. AI results are suggestions — you confirm them before they are saved.
5. Who we share data with
We do not sell personal data. We share it only with service providers who help us run Servora, under contracts that limit their use of it, and when the law requires it.
| Provider | What for | Data involved |
|---|---|---|
| DigitalOcean | Hosting the application, database and files | All data held in Servora |
| EngineMailer | Sending email | Recipient name and email, email content |
| CHIP (chip-in.asia) | Payments | Company name, billing email, amounts |
| OpenRouter and the AI model providers it routes to | AI features (section 4) | The documents, images or figures sent for that feature |
| Google (Drive) | Storing HR documents, where the Customer uses HR Documents | The documents uploaded |
| Google (Maps / Routes) or OpenStreetMap | Turning clock-in coordinates into addresses; measuring mileage-claim distances | GPS coordinates and addresses |
| ipapi.co or ipinfo.io | Estimating a website visitor's country for local pricing | IP address |
| QuickChart | Drawing charts in emailed reports | Chart figures (no personal data) |
| PrintNode | Printing labels, where the Customer connects its own PrintNode account | Label content |
| tawk.to | Live chat on our website and in the app | Chat messages and the details in section 2 |
| Bunny Fonts, jsDelivr, OpenStreetMap tiles, YouTube (privacy-enhanced mode), Vimeo | Fonts, page scripts, maps and training videos loaded by your browser | Your IP address and browser details, as with any web request |
We may also disclose data where required by law, court order or a regulator, to protect the rights and safety of our users or the public, or to a buyer if our business is sold (who would be bound by this policy).
6. Transfers outside your country
Our servers are hosted in Singapore (DigitalOcean). Some providers above, including the AI providers, process data in the United States and other countries. Where we transfer personal data outside Malaysia, Thailand or Indonesia, we do so only to providers that protect it to a standard comparable to the law of your country, under contract, or as otherwise permitted by that law.
7. How long we keep data
- Account and business data: for as long as the account is open. If a Customer closes its account, we keep the data for at least 30 days so it can be exported or restored, and delete it when the Customer asks us to.
- Billing and payment records: seven years, as Malaysian tax law requires.
- Support requests and chat transcripts: 24 months after the conversation ends.
- Audit trails and security logs: 24 months.
- Website visitor IP lookups: up to seven days.
- Affiliate records: while you are an affiliate, and seven years after the last commission payment.
Deleted data may remain in our database recovery logs for up to 30 days before it is overwritten.
8. How we protect data
All traffic to Servora is encrypted in transit (HTTPS). Passwords are stored only as one-way hashes. Uploaded files such as receipts, selfies and staff documents are kept in private storage and are shown only to people whose role allows it. Access within a Customer's account is controlled by the roles the Customer assigns, and every change is recorded in an audit trail. Our own staff access Customer data only to provide support or keep the service running. If a personal data breach is likely to cause significant harm, we will notify the affected Customers and the relevant authority as the law requires.
9. Cookies and similar technologies
We use only the cookies Servora needs to work. We do not use advertising or analytics cookies.
| Name | Purpose | Lasts |
|---|---|---|
servora-session | Keeps you signed in during a visit | Up to 30 days |
XSRF-TOKEN | Protects forms against cross-site request forgery | Session |
remember_web_… | "Remember me" sign-in | Until you sign out |
mk_lang | Your website language choice | 1 year |
referral_code | Credits the person who referred you if you sign up | 30 days |
servora_staff_remember, servora_staff_device, servora_kiosk | Keep staff signed in on the Staff Portal, and recognise a registered phone or clock-in kiosk | Up to 5 years, or until removed |
| tawk.to cookies | Remember an ongoing live chat | Set by tawk.to |
The app also stores small display preferences in your browser (such as sidebar state and theme), and the Staff Portal and training app keep an offline copy of some pages so they work on a weak connection. You can clear these in your browser settings; the app will still work, but you will have to sign in again.
10. Your rights
Subject to the law of your country, you may ask us to:
- give you access to, or a copy of, the personal data we hold about you;
- correct data that is inaccurate, incomplete or out of date;
- delete your data, or stop or limit how we use it;
- send your data to you or to another service in a commonly used format (data portability);
- withdraw consent you have given, without affecting what was done before;
- stop sending you direct marketing.
Many of these you can do yourself: update your profile in the app, export records from most screens, or delete your user account from your profile page. For anything else, email privacy@servora.com.my. We will reply within 21 days and may need to confirm your identity first. If we hold your data on behalf of your employer, we will pass your request to them.
If you are not satisfied with our answer, you may complain to the data protection authority in your country: in Malaysia, the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi); in Thailand, the Personal Data Protection Committee; in Indonesia, the authority responsible under the Personal Data Protection Law.
11. Children
Servora is a business service and is not meant for children. Some Customers employ staff under 18; where they record those staff in Servora, the Customer is responsible for any parental consent the law requires.
12. Changes to this policy
We will post any change on this page; the "Last updated" date above shows when it took effect. If a change materially affects how we use your data, we will tell account owners by email or in the app at least 14 days before it takes effect.
13. Contact us
Data Protection Officer
Email: privacy@servora.com.my
Post: Skyrocket Solutions Sdn Bhd, Suite 15-23A, Level 15, Avenue Crest, Jalan Jubli Perak 22/1, Seksyen 22, 40300 Shah Alam, Selangor Darul Ehsan, Malaysia
This policy is available in English, Bahasa Malaysia · Bahasa Indonesia · ภาษาไทย. If the versions differ, the English version applies.