Data Collection

Atshi does not collect or store payment card numbers or banking credentials. All payment processing occurs directly between the Guest and the Merchant's chosen payment gateway (currently Stripe), entirely outside Atshi's systems.

Data from Merchants (Clients)

• Business name, address, and contact details.
• Account credentials.
• Building, Floor layout, unit configuration, menu, and pricing data.

Data from Guests (Merchant Customers)

• Name and phone number (at time of booking).
• Reservation details (date, time, party size, unit).
• Email address (for receipts/notifications).

How We Use Your Data

We use the data described above to :

• Operate core platform functions: reservations, real-time availability, QR check-in, and order routing to kitchen/bar or any kind of related staff.
• Provide Merchant with operational dashboards and analytics.
• Send booking confirmations, reminders, and receipts to Guests through the email automation system.
• Maintain platform security and prevent misuse.
• Improve and develop the Service.

How Data Is Shared

• Guest data submitted through a booking is shared with the relevant Merchant, as this is necessary for the Merchant to fulfill the reservation. This is a core function of the Service, not a third-party disclosure.
• Atshi uses two third-party payment processors, each with a distinct role. Stripe processes venue-level transactions and handles Client KYC, Stripe's own Privacy Policy governs data processed through their systems. Dodo Payments processes platform subscription payments as merchant of record, Paddle's own Privacy Policy governs data processed through their systems.
• Atshi does not sell personal data to any third party. Data may be disclosed to infrastructure service providers strictly to the extent necessary to operate the Service, and only under confidentiality obligations.

Data Storage & Security

We apply reasonable technical and organizational measures to protect data against unauthorized access, alteration, or loss. Sensitive credentials, including payment gateway integration keys provided by Venues, are encrypted using AES-256 encryption. All data is stored on cloud infrastructure with data centers located in Jakarta, Indonesia.

Data Retention

Venue account data is retained for as long as the subscription remains active. In the event of non-payment, data is retained for 60 days following the due date, after which it may be permanently deleted in accordance with our Terms and Conditions, Section 6. Guest reservation data is retained for as long as reasonably necessary to support the Venue's operations and applicable record-keeping needs, and is deleted or anonymized when no longer needed for that purpose.

Your Rights

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data, subject to legal or contractual retention requirements.
• Withdraw consent where processing is based on consent.
• Request a copy of your data in a portable format.