Data We Collect from Users: Identity data (full name, NRIC/passport number, date of birth); biometric data (facial recognition templates derived from facial scans); contact data (mobile number, email address); payment data (tokenised payment credentials, DuitNow IDs, transaction history); device data (device identifiers, operating system, IP address); behavioural data (purchase history, loyalty points, preferences, AI-generated insights).

Data We Collect from Merchants: Business registration information; authorised representative identity data; contact and billing information; POS device data; transaction records and performance metrics.

How We Use Your Data: To provide, operate, and improve AyeFace services; to verify your identity and authenticate transactions; to process payments and manage loyalty programmes; to personalise your experience through AI-driven recommendations; to comply with legal and regulatory obligations; to detect and prevent fraud and unauthorised access; to communicate service updates, promotions, and compliance notices; and to conduct research and analytics to improve our platform.

Data collected directly from you (registration, onboarding); automatically (device and usage data via the AyeFace application and POS terminals); from merchants (transaction and interaction data when you use AyeFace at their premises); and from third parties (payment processors, identity verification partners, and fraud prevention services).

Our websites and applications may use cookies, pixel tags, local storage, and similar tracking technologies to recognise your device, remember preferences, measure the effectiveness of communications, and analyse usage patterns.

Essential cookies are necessary for the platform to function and cannot be disabled. Analytics cookies help us understand how users interact with our services so we can improve them. Preference cookies allow us to remember your settings and choices.

You may control cookie preferences through your browser settings or our cookie preference centre. Note that disabling certain cookies may affect the functionality of AyeFace services. For mobile applications, similar device-level tracking may apply and can be managed through your device operating system settings.

Within the Aye Group: Personal data may be shared among Aye Global Holdings Pte. Ltd. and its subsidiaries for operational, administrative, and service delivery purposes, subject to this Policy.

With Merchants: We share only your store activity (transaction amounts, points earned, rewards redeemed) with the merchant where the transaction occurred. We do not disclose your identity, biometric data, or payment credentials to merchants.

With Service Providers: We engage trusted third-party providers for cloud hosting, payment processing, identity verification, fraud prevention, analytics, and customer support. These providers are bound by data processing agreements and are permitted to use your data only as directed by Aye.

For Legal Compliance: We may disclose personal data where required by applicable law, court order, regulatory authority, or to protect the rights, property, or safety of Aye, its users, or the public.

Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction, subject to continued protection under equivalent terms.

We do not sell personal data to third parties for their own marketing purposes.

Aye operates across Southeast Asia and may transfer personal data to jurisdictions outside your home country, including Singapore, Malaysia, and other locations where our service providers operate.

Where personal data is transferred across borders, we ensure that appropriate safeguards are in place, such as standard contractual clauses, adequacy decisions, or binding corporate rules, in accordance with applicable data protection laws including the Malaysian Personal Data Protection Act 2010 (PDPA), Singapore PDPA, and GDPR where applicable.

By using AyeFace services, you consent to the transfer of your personal data to our processing locations as described in this Policy. We will always ensure that cross-border transfers are subject to protections at least equivalent to those in your home jurisdiction.

We process personal data on the following legal bases:

Consent: For biometric data collection, marketing communications, and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Contractual Necessity: To provide AyeFace services, process payments, and fulfil our obligations to users and merchants under applicable Terms and Conditions.

Legal Obligation: To comply with applicable laws and regulations, including anti-money laundering (AML), know-your-customer (KYC), and financial reporting requirements.

Legitimate Interests: For fraud prevention, security, service improvement, analytics, and network integrity, where these interests are not overridden by your data protection rights.

For special categories of data (biometric data), we rely on explicit consent and applicable exemptions under data protection law.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction.

Technical measures include: AES-256 encryption for data at rest; TLS 1.2+ encryption for data in transit; biometric template tokenisation — raw facial images are not stored; multi-factor authentication for platform access; Presentation Attack Detection (PAD) compliant with ISO/IEC 30107; regular penetration testing and vulnerability assessments; and SOC 2-aligned infrastructure controls.

Organisational measures include: role-based access controls (least privilege); mandatory data privacy training for all staff; data processing agreements with all third-party providers; incident response and breach notification procedures; and regular privacy impact assessments for new features.

In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant authorities in accordance with applicable law.

Subject to applicable law, you have the following rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you.

Right to Correction: Request correction of inaccurate or incomplete personal data.

Right to Erasure: Request deletion of your personal data where there is no legitimate ground for continued processing.

Right to Restrict Processing: Request that we limit how we process your data in certain circumstances.

Right to Data Portability: Receive your personal data in a structured, machine-readable format where processing is based on consent or contract.

Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent: Withdraw consent for biometric data processing or marketing at any time without penalty.

To exercise your rights, contact us at dpo@aye-ai.org or through the AyeFace User Portal. We will respond within 30 days. Requests may be subject to identity verification. You also have the right to lodge a complaint with your local data protection authority.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

User account data is retained for the duration of your account and for 7 years after account closure for legal and audit compliance. Biometric templates are deleted within 30 days of account closure or consent withdrawal. Transaction records are retained for 7 years to satisfy financial regulatory requirements. Marketing data is retained until you withdraw consent or opt out.

Where data is no longer required, we securely delete or anonymise it in accordance with our data retention schedule. Anonymised, aggregated data may be retained indefinitely for research and analytics purposes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

Data Protection Officer
Aye Global Holdings Pte. Ltd.
Email: dpo@aye-ai.org
For complaints or concerns: complaints@aye-ai.org

We are committed to resolving data privacy concerns promptly. If you are not satisfied with our response, you may escalate to the relevant data protection authority in your jurisdiction.

This Privacy Policy is effective as of 1 October 2025. We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Material changes will be communicated to you via in-app notification, email, or prominent notice on our website at least 14 days before taking effect. Your continued use of AyeFace services after the effective date of any update constitutes acceptance of the revised Policy.

We encourage you to review this Policy periodically. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised.

These Terms set out the conditions for Your use of AyeFace services, including the AI features and Facial Recognition Payment service. AyeFace allows You to initiate payments to participating Merchants using facial recognition, through payment methods linked to Your AyeFace Account — including bank or e-money accounts via DuitNow ID, credit or debit cards, regional e-wallets, and other alternatives as may be introduced.

While AyeFace facilitates payments and personalisation, all payment processing is conducted by the respective merchant acquirers connecting to authorised financial institutions, card issuers, or e-wallet providers. AyeFace does not itself hold, receive, or transfer funds. We are not a bank, e-money issuer, or payment institution.

You may register at user.ayeface.com/register. To register, You must complete a facial capture process and set a PIN for verification. By completing registration, You confirm that You are at least 18 years old and capable of entering into a binding contract.

You may link a payment method including: a credit or debit card; a bank or e-money account via DuitNow ID; or a supported e-wallet account. By linking a payment method, You consent to Us securely storing Your payment details in encrypted form, solely to facilitate future payments. Full card or bank credentials are not stored directly — we rely on tokenisation provided by licensed payment processors.

Once a payment is confirmed via AyeFace, it is considered final and irrevocable, except in cases of fraud, unauthorised use, or error. Such cases are subject to investigation by the relevant financial institution.

Through the User Portal, You may manage payment methods (add, update, remove), suspend or revoke consent, set payment limits, enable/disable PIN verification, manage notification preferences, view and track eligible rewards, and obtain referral codes.

We will notify You 7 days before Your payment method consent expires. If expired, a new consent must be submitted. You can view transaction history including ID, timestamp, and merchant info. For disputes, contact complaints@aye-ai.org with the transaction ID.

You must take reasonable precautions to keep login credentials confidential. You are responsible for all account activity until You notify Us of any unauthorised use.

By making Your first payment at a merchant using AyeFace, You consent to automatic enrollment into that merchant's membership program (if enabled), in accordance with the merchant's terms. AyeFace does not guarantee membership benefits.

No personal information other than Your store activity (purchases, points earned, rewards redeemed) is shared with merchants. You may receive promotional messages facilitated by AyeFace without merchants accessing Your personal data directly. You may opt out at any time by emailing complaints@aye-ai.org.

AyeFace may also create its own rewards programmes, which may be changed, edited, or removed at AyeFace's discretion.

When You register, Your facial features are captured and converted into a unique, tokenised template using secure encryption. This biometric data is processed solely for recognition, authentication, and personalisation within AyeFace.

AI features may include personalised prompts, menu recommendations, targeted marketing, and contextual suggestions based on Your preferences and purchase behaviour. AI is not used to initiate, authorise, or complete payments — all payment transactions require explicit action by You.

We employ Presentation Attack Detection (PAD) and anti-spoofing measures consistent with ISO/IEC 30107 standards. AyeFace does not perform automated decision-making producing legal or significant effects without human oversight.

You acknowledge that AI and biometric technologies are probabilistic and may not always be accurate. Performance may be affected by environmental factors such as lighting or device quality.

You may initiate a refund request by contacting the relevant merchant directly with the transaction ID. Refunds will only be processed once approved by the merchant and returned to Your original payment method.

For erroneous or unauthorised payments, initiate a dispute directly with Your financial institution or payment provider. AyeFace Support (complaints@aye-ai.org) may assist in investigation but is not a payment processor and cannot directly refund amounts.

Where a wrongful transaction is confirmed as caused solely by a proven AyeFace system malfunction, We will facilitate a refund through the relevant payment processor. Your full cooperation with investigation is required.

To the fullest extent permitted by law, We shall not be liable for losses arising from: Your use of AyeFace services; errors or delays in payment processing by financial institutions; accuracy of biometric verification or AI outputs; unauthorised account access due to Your failure to safeguard credentials; or service interruption, except where caused by Our proven gross negligence or wilful misconduct.

You agree to indemnify Us against claims arising from Your breach of these Terms, unauthorised use of AyeFace, or violation of third-party rights. Nothing in these Terms limits liability for death or personal injury caused by Our gross negligence or fraud.

Contact Us: complaints@aye-ai.org
We will acknowledge complaints within seven (7) working days and provide a substantive response within one (1) calendar month. This does not affect Your rights to escalate to relevant supervisory authorities.

Amendments: We may amend these Terms with at least thirty (30) days' prior notice via email, the AyeFace portal, or Our official website. Continued use after the effective date constitutes acceptance.

Governing Law: These Terms are governed by the laws of Malaysia. You submit to the exclusive jurisdiction of the courts of Malaysia, without prejudice to mandatory consumer protection laws of Your country of residence.

International Data Transfers: EU Standard Contractual Clauses (SCCs) apply automatically for cross-border transfers subject to EU/UK data protection regulations. See: commission.europa.eu/standard-contractual-clauses

Severability, No Waiver, Entire Agreement: Standard provisions apply. In the event of conflict between these Terms and the Privacy Policy regarding personal data, the Privacy Policy shall prevail.

These Terms govern Your use of AyeFace services including facial recognition payment functionality, AI features, CRM tools, Virtual Terminal features, and payment processing features available under your selected Subscription Tier (Free, Basic, or Pro).

Your use is subject to the limitations and inclusions of the plan selected. Access to certain features, such as the Merchant Portal and advanced CRM analytics, is available only to Basic and Pro tier subscribers. Free plan users have access to core biometric payment functionality only.

If subscribed to a Basic or Pro plan, You will be issued login credentials to access the Merchant Portal. The Merchant Portal is not available to Free plan merchants.

Through the Merchant Portal, You may create and manage one or more AyeFace Virtual Terminal Accounts. You are solely responsible for the accuracy of all information entered and for keeping it updated.

You must protect the confidentiality of all login credentials, use strong passwords, and employ multi-factor authentication where provided. Any use of Your account(s) will be deemed to have been made by You. Notify Us immediately of any suspected security breach.

AyeFace offers three subscription tiers: Free, Basic, and Pro. The Free plan allows limited access to the Virtual Terminal only. Basic and Pro plans include full Merchant Portal access, CRM tools, AI agents, and analytics.

Trial users: We will notify You at least fourteen (14) days prior to trial expiry. Unless cancelled before expiry, Your account automatically converts to the monthly subscription plan, and applicable charges will be applied to the payment method provided.

Post-trial, if You do not continue with a paid subscription, You may request an export of Customer Personal Data and Confidential Business Data within thirty (30) days of trial expiry. After this period, such data will be securely deleted or anonymised.

AyeFace is a software-based service. We do not manufacture, sell, lease, or supply any hardware. Devices procured through Our authorised hardware partners are governed solely by Your agreement with that hardware provider. We disclaim any warranties relating to the Device.

You are responsible for ensuring the Device meets minimum technical and connectivity requirements. We are not liable for service disruptions from Device-related issues including hardware faults, software conflicts, or power/internet interruptions.

The AyeFace service includes AI functionality designed to enhance Customer engagement and provide data-driven insights. You acknowledge that AI outputs are probabilistic and intended to support, not replace, human judgment. You are solely responsible for evaluating AI-generated recommendations before acting upon them.

AI features process data in accordance with Our Privacy Policy. We reserve the right to improve, modify, or update AI features at Our discretion, including changes to models or training data, without prior notice.

Subscription fees are billed automatically based on Your selected billing cycle (monthly or annual). All prices are exclusive of applicable taxes. In the event of non-payment: We may suspend or terminate access; interest accrues at 10% per annum from the due date; and We reserve the right to recover collection costs including legal fees.

We will provide at least thirty (30) days' advance notice of any price adjustments. Your subscription renews automatically unless cancelled. All payments are non-refundable except where required by applicable law.

All merchants will be provided with a settlement account through the mutually appointed merchant acquirer. All transaction settlements, timing, reconciliation, disbursement, chargebacks, and related fees are subject solely to the terms of the appointed merchant acquirer. We are not a party to settlement arrangements and are not responsible for any settlement-related issues.

You may cancel Your subscription at any time. Monthly plan cancellations retain access until end of current paid month (no refunds). Annual plan cancellations retain access until end of paid annual period (no refunds for unused months).

We may suspend, restrict, or terminate access if: You materially breach these Terms; You fail to pay outstanding fees after notice; required by law or regulatory request; or Your use poses a security risk. Termination does not release either party from obligations incurred prior to the effective date.

For cancellation or plan changes, contact: merchants@aye-ai.org with at least fourteen (14) working days' advance notice.

To the maximum extent permitted by law, We shall not be liable for: losses from Your use of AyeFace services; AI-generated outputs or recommendations; inaccuracies in analytics; Device issues; or actions of hardware vendors or third-party partners.

You agree to indemnify Us against claims arising from Your breach of these Terms, misuse of AyeFace, Customer or third-party claims relating to Your business operations, negligent or unlawful acts by You or Your employees, or breach of data protection laws.

Nothing in these Terms excludes liability for death or personal injury caused by negligence, fraud, or fraudulent misrepresentation.

We process all data in accordance with the Malaysian PDPA, Singapore PDPA, GDPR, and Our Privacy Policy.

For Customer Personal Data collected through the AyeFace User Portal, We act as data controller. For data generated through Your store interactions, You act as data controller. Each party shall comply with its respective obligations under applicable data protection laws.

Any AI model training or performance insights are based solely on anonymised and aggregated AyeFace User data. Merchant Data is not used for these purposes.

If a personal data breach occurs affecting Customer Personal Data, We will notify You without undue delay and provide reasonable assistance for Your legal compliance obligations.

Amendments: at least thirty (30) days' prior notice, except where immediate changes are required by law or security. Notice via email, Merchant Portal, or Our website. Continued use constitutes acceptance.

Governing Law: Laws of Malaysia. Exclusive jurisdiction of Malaysian courts.

International Data Transfers: EU Standard Contractual Clauses apply automatically for cross-border transfers subject to EU/UK regulations. See: commission.europa.eu/standard-contractual-clauses

Data Retention: Data retained only as long as necessary for service delivery, compliance, and legal obligations. Securely deleted or anonymised upon termination after a reasonable retention period.

Merchant contact: merchants@aye-ai.org