stya privacy notice
On this page
stya is an app for restaurant and café staff. It runs the till, the waiter pad, shifts and the venue's admin on iOS, Android and in Chrome. This notice says what data stya handles, why, who else receives it, how long it is kept and what you can do about it.
Who is responsible
stya is published by Kenneth Johannes Fang, an individual developer in Jakarta, Indonesia. Contact for anything in this notice: privacy@stya.app.
stya holds data in two roles.
- As controller, stya decides the purpose for the data of the people who use stya: staff sign-in, account security, diagnostics and the record of a venue's own account.
- As processor, stya keeps the data of a venue's customers and staff on the venue's behalf and only on the venue's instructions. The venue (the restaurant or café that registered with stya) is the controller of that data. It decides who works there, what its customers are asked for and how long it keeps them. The venue's terms with stya include a data processing agreement.
If you are a customer of a venue, the venue is the first place to ask about your data. stya helps the venue answer.
What stya handles
Staff
- Display name, username, role and employment type.
- Email address, used for sign-in and invitations.
- A PIN. stya stores only a bcrypt hash of it.
- A log of PIN attempts with the IP address, so that repeated wrong guesses lock the account.
- Shifts and clock-ins.
- A session token, kept in the device's secure store.
The venue's customers, as staff enter them
- Members: name, phone number, email address, loyalty points and spend, and the basis and time of their consent.
- Booking guests: name, phone number and email address.
- Mahjong board players.
- Photos of mahjong hands, used to train stya's tile reader only where the venue has switched that on.
Sales
- Orders, bills and payments. Cash is recorded as a figure. QRIS payments go through Midtrans, DOKU or a bank's SNAP service.
- stya does not receive or store card numbers.
- Photos of payment proof sit in a private storage bucket. A voided payment keeps its photo as evidence.
The device
- A random device id.
- The public key of a paired till. The private key stays on the device.
- Push notification tokens: Expo for phones, web push for Chrome.
- The make and model of a connected printer.
Diagnostics and usage
- Crash reports hold the screen route, the error stack and the selectors of the buttons last pressed. They never hold console output.
- Feature events record every failed action and the first success of each feature per day. They hold the feature name only, with no query string, request body or ids.
Only stya's operations team reads crash reports and feature events. A venue does not see them. The change history a venue sees in its own admin is a separate record of edits made by its staff.
The in-app assistant, Tya
When a staff member asks the assistant a question, stya sends the question and the context it needs to an AI provider: Anthropic, Google (Gemini) or Groq. The provider returns an answer and stya shows it.
The assistant answers questions and prepares suggestions. It does not decide anything about a person. It does not approve, refuse, rank or score staff or customers, and no one's pay, access or loyalty status changes because of it. A person confirms every action. stya makes no decision about you by automated means alone.
Why stya uses the data, and on what basis
| Purpose | Data | Basis under UU PDP Pasal 20 | Basis under UK GDPR Article 6 |
|---|---|---|---|
| Sign-in and the work the venue asked for (orders, payments, rostering, loyalty, bookings) | staff, customer, sales and device data | performance of the contract with the venue; for customer data, the venue's own basis | contract, Article 6(1)(b); for customer data the venue's basis |
| Account security and PIN lockout | PIN attempts, IP address, device id | legitimate interests | legitimate interests, Article 6(1)(f) |
| Crash reports and feature events | diagnostics | legitimate interests in keeping the app working | legitimate interests, Article 6(1)(f) |
| The in-app assistant | the question and its context | the staff member's consent, given by asking | consent, Article 6(1)(a) |
| Photos of mahjong hands for the tile reader | the photos | consent, collected by the venue | consent, Article 6(1)(a) |
| Records the law requires | sales and payment records, payment proofs | legal obligation | legal obligation, Article 6(1)(c) |
stya shows no advertising, does not track you across other apps or sites and does not sell data.
Who else receives it
| Provider | For | Where it processes |
|---|---|---|
| Supabase | database, sign-in, file storage | Singapore (project region ap-southeast-1) |
| Cloudflare | web hosting, archive storage | hosting on Cloudflare's global network; archive storage on Cloudflare's network, region set by Cloudflare |
| Expo | app updates, push notifications to phones | United States |
| Midtrans, DOKU, bank SNAP services | QRIS payments | Midtrans: Indonesia, and possibly outside Indonesia. DOKU and the banks: Indonesia or elsewhere, as that provider decides |
| Resend | United States | |
| Discord and GitHub | internal alerts about crashes | Discord: United States. GitHub: mostly the United States |
| Anthropic, Google, Groq | the in-app assistant | Anthropic: United States. Google: any country where Google or its agents have facilities. Groq: the United States and other countries where Groq or its subprocessors operate |
Several of these providers process data outside Indonesia and outside the United Kingdom. UU PDP Pasal 56 allows this where the receiving country protects personal data at an equal or higher level, or, failing that, where there are adequate and binding safeguards. stya relies on each provider's data processing terms for those safeguards: standard contractual clauses with the UK addendum (Cloudflare, Resend, Anthropic, Groq), Google's data processing terms with its standard contractual clauses, or, for Expo and Discord, their certification under the UK Extension to the EU-US Data Privacy Framework. For UK data subjects, UK adequacy regulations cover neither Indonesia nor Singapore, so the same contractual terms act as the safeguard under UK GDPR Chapter V. A copy of the terms is available on request at privacy@stya.app.
How long it is kept
A venue's account is active while it is on a paid plan or in its 30-day trial, including the 7 working days of grace and any read-only freeze. The service ends when the venue cancels, or when stya ends it after a freeze.
| Data | Kept for |
|---|---|
| Staff accounts | until the venue's owner removes them, or until you ask for deletion (see below) |
| Members | until the venue's dormancy period ends. A venue may set a period of at least six months. After that many months without a bill, point movement or booking, stya erases the record. If the venue sets none, members are kept. |
| Venue data after the service ends | read-only for 30 days so the venue can export it, then deleted, including the change-history archive. Backups made earlier are gone within 14 days after that |
| Sales, bills, payment records and payment proof photos | while the venue's account is active, then 30 days to export after the service ends, then deleted. A voided payment keeps its photo as evidence for the same period. stya keeps something longer only where the law requires stya itself to, or while a legal claim is open |
| The venue's change history (audit log) | stays live for 12 months, then moves to a separate archive in stya's file storage, kept while the venue's account exists and deleted with the rest of the venue's data when the service ends |
| Feature events | 60 days, then a daily job deletes them |
| Crash reports | up to 1 year, with at most the latest 20 occurrences of each crash kept |
| PIN attempt log (with IP address) | up to 1 year. Failed attempts are cleared when that person signs in successfully |
| Nightly backups | 14 days |
Your rights
Under UU PDP (Pasal 5 to 13) and, for people in the United Kingdom, UK GDPR, you may:
- be told what data is held about you and why;
- see and receive a copy of it;
- have errors corrected;
- have your data deleted or its processing ended;
- withdraw consent you gave, with effect from then on (where stya is the controller, it stops that processing within 3 x 24 hours of your request, as UU PDP Pasal 40 requires);
- ask that processing be restricted;
- receive your data in a common format where the law gives you that right;
- claim compensation under UU PDP Pasal 12 where a breach of the law harms you.
Write to privacy@stya.app. stya answers within 30 days. If your data belongs to a venue, stya passes the request to the venue and helps it answer.
The right to object
Under UK GDPR Article 21 you may object at any time to processing that rests on legitimate interests, which covers account security and diagnostics. You may also object to a decision made about you by automated means alone (UU PDP Pasal 10); stya makes none. To object, write to privacy@stya.app and say which processing you mean. stya then stops it unless it can show a compelling reason that outweighs your interests, or the law requires it to continue.
Complaints
Write to privacy@stya.app first. If the answer does not settle it:
- in the United Kingdom, you can complain to the Information Commissioner's Office (ico.org.uk);
- in Indonesia, the personal data protection agency that UU PDP provides for has not yet been formed. Until it exists, you can go to court (UU PDP Pasal 12) or raise the matter with the Ministry of Communication and Digital Affairs (Komdigi), which runs its own personal data complaint service.
Deleting your account and data
The steps are on the support page: stya.app/support.
Security
Data travels over encrypted connections. A PIN is stored as a hash. A paired till keeps its private key on the device. Venue data is separated by access rules in the database, so one venue's staff cannot read another's. If a breach puts personal data at risk, stya, as controller, tells the affected people and the personal data protection agency in writing within 3 x 24 hours, saying what data was exposed, when and how, and what is being done (UU PDP Pasal 46). Where stya holds the data for a venue, it tells the venue within 3 x 24 hours so the venue can do the same.
Children
stya is a work tool for venue staff and is not meant for people under 13. UU PDP Pasal 25 requires a parent's or guardian's consent to process a child's data. If you think a child's data is in stya, write to privacy@stya.app and stya deletes it.
Changes
stya announces a material change in the app and at stya.app/privacy at least 14 days before it takes effect, and the date at the top changes with it. Where the law needs your consent again, stya asks for it.
Governing law
Indonesian law governs this notice. UK GDPR rights apply as well to people in the United Kingdom.