Privacy Policy

1. Overview

Aster Stream Tech Pte. Ltd. ("AsterStream", "we", "us", or "our") operates the AsterStream AIoT Energy Management System, accessible at asterstreambuild.com and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

By accessing or using the AsterStream platform, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our services.

2. Data We Collect

2.1 Account & Identity Data

When you register for an AsterStream account or subscribe to our platform, we collect information you provide directly:

• Company name, company registration number (Tenant ID), and business address
• Contact person name, business email address, and phone number
• Username, encrypted password (BCrypt hashed — we never store plaintext passwords)
• Country, currency preference, and timezone settings
• Subscription plan and billing information (processed by Stripe — we do not store raw card numbers)

2.2 IoT & Energy Operational Data

As part of providing the energy management service, we process data from your connected IoT devices:

• Real-time and historical energy consumption readings (kWh, kW, voltage, current, power factor)
• Device status, alarm events, and fault logs
• Site configuration, building floor plans, and equipment schedules
• CO₂ emission calculations and ESG report data
• AI model inputs (anonymised energy patterns for optimisation recommendations)

2.3 Usage & Technical Data

• Browser type, IP address, operating system, and device identifiers
• Pages visited, features accessed, and session duration
• API request logs (for debugging and security monitoring)
• Error logs and performance metrics

3. How We Use Your Data

4. Data Sharing & Disclosure

We share data only with the following categories of recipients, on a strictly need-to-know basis:

• Stripe Inc. — Payment processing. Stripe is PCI DSS Level 1 certified. We share billing contact details only.
• Cloud Infrastructure Providers — AWS, Microsoft Azure, or Google Cloud Platform for hosting. All data is encrypted at rest. Providers are bound by data processing agreements.
• Legal & Regulatory Authorities — When required by law, court order, or regulatory body (e.g. Singapore PDPC, MAS). We will notify you where legally permitted.
• Business Transfers — In the event of a merger, acquisition, or asset sale, your data may transfer to the acquiring entity, subject to equivalent privacy protections.

5. Data Retention

6. Security Measures

We implement industry-standard technical and organisational security measures:

• Encryption in Transit: All data transmitted between your browser/devices and our servers uses TLS 1.2 or higher
• Encryption at Rest: All stored data is encrypted using AES-256
• Multi-tenant Isolation: Strict database-level isolation ensures your data is never accessible to other tenants
• Password Security: Passwords are hashed using BCrypt with salt — we never store plaintext passwords
• Access Controls: Role-based access control (RBAC) with principle of least privilege
• Infrastructure: Hosted on ISO 27001 certified cloud data centres in Asia Pacific regions

7. Your Rights

Under the Singapore Personal Data Protection Act 2012 (PDPA) and applicable data protection laws in jurisdictions where we operate, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right of Correction: Request correction of inaccurate or incomplete personal data
• Right of Erasure: Request deletion of your personal data (subject to legal retention obligations)
• Data Portability: Request your data in a structured, machine-readable format (CSV/JSON)
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw at any time
• Right to Restrict Processing: Request restriction of processing in certain circumstances

To exercise any of these rights, contact our Data Protection Officer at info@asterstreambuild.com. We will respond within 30 days.

8. International Data Transfers

AsterStream operates across Singapore, India, Malaysia, Indonesia, Thailand, Vietnam, and other countries. Your data may be transferred to and processed in countries outside your home jurisdiction.

When transferring data internationally, we ensure adequate protection through:

• Data processing agreements with standard contractual clauses
• Transfers only to countries with adequate data protection frameworks
• Compliance with Singapore PDPA cross-border transfer obligations

9. Cookies

AsterStream uses cookies and similar tracking technologies to operate the platform. For full details, please review our Cookie Policy.

We use authentication cookies (strictly necessary, cannot be disabled) and optional analytics cookies. You can manage your cookie preferences at any time.

10. Children's Privacy

The AsterStream platform is an enterprise B2B service intended exclusively for use by businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal data to us, please contact us immediately at info@asterstreambuild.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to the primary contact on your account
• Display an in-platform notification for 30 days after the change

12. Contact Us

If you are unsatisfied with our response to your privacy concerns, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.