KiraDigit Privacy Policy

1.1.This Privacy Policy explains how MONZTECH SYSTEM (the "Provider", "we", "us" or "our"), operating the KiraDigit platform, collects, uses, stores, discloses, transfers, and protects personal data in connection with the Platform Services.

1.2.This Policy applies to Subscribers, Invited Users, and individuals whose personal data may be uploaded to or processed through the Platform Services by a Subscriber.

1.3.By using the Platform Services, the Subscriber agrees to this Policy and confirms that it is responsible for providing all required privacy notices and obtaining any consent or other lawful basis required for personal data that the Subscriber uploads, imports, or discloses to the Platform.

1.4.Capitalised terms not defined in this Policy have the meanings given to them in the KiraDigit Terms and Conditions.

1.5.For this Policy, "AI" means artificial intelligence technologies, systems, models, tools, and services, including large language models (LLMs), generative AI models, machine-learning models, and other automated or assisted technologies that can analyse, classify, extract, generate, summarise, predict, suggest, or assist with content or data. "AI Services" or "AI Features" means Platform features that use AI, OCR, document extraction, chatbot, AI assistant, automation, or similar technologies.

2.1.For account registration data, billing records, support records, security logs, usage analytics, service communications, and our own administrative records, the Provider determines the purposes and means of processing and acts as the data controller.

2.2.For Your Data uploaded, imported, generated, exported, saved, or managed by the Subscriber through the Platform Services, including accounting ledgers, invoices, customer and supplier records, employee salary details, tax records, transaction data, Uploaded Files, and Generated Files / Exports, the Provider acts as a data processor and processes such data on behalf of the Subscriber.

2.3.The Subscriber remains responsible as the data controller for Your Data, including deciding what data is uploaded, how long it is retained, whether it is accurate, and whether it may lawfully be processed through the Platform.

2.4.We may process aggregated or de-identified information to maintain, secure, analyse, and improve the Platform Services, provided that such information does not identify an individual or a Subscriber.

3.1.Depending on how the Platform is used, we may process the following categories of personal data:

4.1.The Subscriber may upload personal data relating to employees, customers, suppliers, contractors, or other third parties. The Subscriber is responsible for ensuring that it has provided all required notices and has a valid lawful basis, including consent where required by law, to disclose such personal data to the Provider and to process it through the Platform Services.

4.2.The Subscriber must not upload personal data that is unnecessary, excessive, unlawfully obtained, or unrelated to the Subscriber's legitimate use of the Platform Services.

4.3.The Subscriber is responsible for the accuracy, quality, legality, retention, and deletion instructions relating to Your Data, except where the Provider has separate legal obligations.

4.4.The Subscriber agrees to indemnify the Provider against claims, losses, penalties, and reasonable legal costs arising from the Subscriber's failure to provide required notices, obtain required consent or other lawful basis, or comply with applicable data protection laws in relation to Your Data.

5.1.We process personal data only where reasonably necessary for the following purposes:

6.1.We do not sell, rent, or trade personal data. We may disclose personal data only where reasonably necessary for the purposes described in this Policy, including to:

6.2.Where we use third-party service providers to process personal data on our behalf, we will take reasonable steps to require them to protect the data, process it only for authorised purposes, and maintain appropriate confidentiality and security controls.

7.1.Personal data may be transferred to, stored in, or processed in Malaysia, Singapore, or other jurisdictions where our service providers or infrastructure are located. The primary storage location for Platform data is described in Section 8 below.

7.2.Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure the transfer is made in accordance with applicable Malaysian personal data protection requirements. This may include using service providers in jurisdictions with substantially similar or adequate protection, contractual safeguards, consent where required, or other lawful transfer mechanisms available under applicable law.

7.3.AI, OCR, and automation service providers may process data in their own infrastructure or service regions, which may be outside Malaysia or Singapore. These providers may include, without limitation, AI model or service providers such as OpenAI/GPT, Google Gemini, Anthropic Claude, Qwen, DeepSeek, or other suitable AI, OCR, document-extraction, model, automation, or chatbot providers selected by the Provider based on the relevant feature, availability, performance, security, cost, and business needs.

8.1.The primary storage location for Platform database records and Uploaded Files is Supabase managed cloud services hosted on AWS Asia Pacific (Singapore) (ap-southeast-1) region. This includes active customer account data, organisation records, accounting records, file metadata, uploaded documents, images, text files, supported import files, saved generated exports, and related business records stored in the Platform.

8.2.We perform periodic backups of the Platform application database for disaster recovery, continuity, security, and operational resilience. Database backups may include database records, settings, audit records, and file metadata or references, but they do not necessarily include the contents of Uploaded Files or other stored file objects.

8.3.Uploaded Files and saved file attachments are stored in the primary Supabase/AWS Singapore storage environment while they are available in the Platform, but they are not backed up by the Provider as a separate recoverable file backup unless we expressly state otherwise or enable a specific file-backup feature. Subscribers should retain their own original copies of files uploaded to the Platform and remain responsible for backing up, protecting, retaining, and restoring those source files outside the Platform.

8.4.When a user generates a PDF, report, invoice, export, or similar file, relevant data may be temporarily processed by our secure rendering service only for the purpose of generating and returning the requested file. Unless the user chooses to save or store the generated file within the Platform, the generated file is streamed back to the user and is not intentionally retained as a separate permanent copy.

8.5.The rendering process does not intentionally store invoice content, source HTML, or generated PDF content in logs, databases, or persistent file storage. Limited technical metadata, such as request status, file size, processing time, and error information, may be retained for security, troubleshooting, and service monitoring purposes.

8.6.Technical components used only for transient file generation, conversion, previewing, or delivery are not treated as primary data storage locations unless they store Your Data or personal data on our behalf. If a future change materially affects the primary storage provider or primary storage region for Subscriber business data, Uploaded Files, or saved Generated Files / Exports, we will update this Policy or provide reasonable notice through email, the Platform dashboard, or another reasonable method.

9.1.Subscription payments and card payments are processed by Stripe as our main payment gateway or another authorised third-party payment service provider. Payment pages, payment forms, hosted checkout, card vaulting, tokenisation, fraud screening, and recurring payment processing may be provided directly by Stripe or the relevant payment gateway and may be subject to that provider's own terms and privacy notice.

9.2.The Provider does not intentionally store full payment card numbers, CVV/CVC codes, magnetic stripe data, chip data, PINs, or online banking passwords. Such sensitive payment details should be submitted directly to Stripe or the relevant payment gateway and processed within that payment gateway's secure environment.

9.3.For billing, subscription management, receipts, refunds, chargebacks, reconciliation, and customer support, the Provider may receive and store limited payment metadata from Stripe or the relevant payment gateway, such as payment status, transaction reference, gateway customer ID, payment token, card brand, last four digits of the card, expiry month/year, billing name, billing email, billing address, invoice number, and receipt number.

9.4.For recurring subscriptions, saved payment methods should be stored or tokenised by Stripe or the relevant payment gateway rather than by the Provider. The Provider may use the payment token or gateway customer ID to request future subscription charges without receiving the full card number.

9.5.We will take reasonable steps to use Stripe and any other authorised payment gateways that maintain appropriate payment security controls, including applicable Payment Card Industry Data Security Standard (PCI DSS) obligations where cardholder data is stored, processed, or transmitted. Subscribers are responsible for keeping billing users, passwords, devices, and email accounts secure to prevent unauthorised billing changes.

10.1.The Platform Services may include, or may in the future introduce, AI-enabled features such as optical character recognition (OCR), document extraction, invoice or receipt data capture, image-to-text processing, data categorisation, matching suggestions, summaries, search assistance, chatbot support, AI assistants, workflow suggestions, drafting assistance, anomaly detection, and similar automation features.

10.2.When a Subscriber or Invited User uploads a file, submits a prompt, sends a chat message, requests OCR extraction, asks an AI assistant to analyse data, or otherwise uses an AI-enabled feature, relevant content may be processed by the Provider and by authorised AI, OCR, model, or automation service providers for the purpose of providing that feature.

10.3.Data processed for AI-enabled features may include Uploaded Files, image or PDF contents, extracted text, invoice or receipt details, accounting entries, customer or supplier information, employee or payroll information, prompts, chat messages, instructions, outputs, feedback, correction history, technical metadata, and usage logs, depending on the feature used.

10.4.The primary storage location for Platform database records and Uploaded Files remains as stated in Section 8. However, AI, OCR, and automation processing may involve transmitting relevant content to authorised third-party AI service providers for processing in their own systems or service regions. Such processing is not treated as primary Platform storage unless the provider stores the data on our behalf as part of the Platform Services.

10.5.AI service providers may process, log, review, or retain inputs, outputs, prompts, Uploaded File contents, extracted text, technical metadata, and related information according to their own terms, privacy notices, data processing terms, service settings, abuse-monitoring requirements, security controls, and retention practices. AI-enabled features may use reputable or suitable AI model and service providers, which may include, without limitation, OpenAI/GPT, Google Gemini, Anthropic Claude, Qwen, DeepSeek, or other AI, OCR, document-extraction, model, automation, or chatbot providers selected by the Provider for the relevant feature.

10.6.Third-party AI service providers may have terms or service settings that permit inputs, outputs, prompts, Uploaded File contents, extracted text, technical metadata, or related information to be used to develop, improve, optimise, or train their models or services. The availability, scope, and effectiveness of opt-out, zero-training, zero-retention, regional-processing, or similar controls depend on the relevant provider, service tier, region, feature, and configuration. Third-party providers may change their terms, privacy notices, data-processing terms, service settings, retention practices, or model-training practices from time to time, including without prior notice to us. Where such controls are expressly made available and reasonably practicable, we may apply them, but we do not guarantee their availability, scope, continued operation, or effectiveness. Third-party provider terms, policy changes, and data-handling practices may be outside our direct control, and we cannot guarantee their continued consistency with earlier terms or practices. Third-party processing remains subject to the relevant provider's then-current terms, privacy notices, service settings, security controls, retention practices, and data-handling practices. Subscribers should not assume that any provider offers zero-training or similar treatment unless expressly stated for the relevant feature, provider, service tier, region, and configuration.

10.7.We do not intentionally use Subscriber business data, Uploaded Files, prompts, or AI outputs to train our own general-purpose AI models unless the Subscriber has given permission, the data has been aggregated or de-identified so that it no longer identifies the Subscriber or individuals, or the use is otherwise permitted by applicable law.

10.8.AI and OCR outputs may be incomplete, inaccurate, duplicated, outdated, biased, misread, or unsuitable for a particular purpose. Subscribers and Invited Users must review, verify, correct, and approve all AI-generated or OCR-extracted outputs before relying on them, recording them in accounts, sending them to third parties, filing them with authorities, or using them for business, accounting, tax, payroll, legal, or financial decisions.

10.9.Subscribers and Invited Users should not submit unnecessary, excessive, confidential, sensitive, regulated, or third-party personal data to AI-enabled features unless it is required for the intended business purpose and the Subscriber has provided required notices and has a valid lawful basis, including consent where required by law.

10.10.Subscribers and Invited Users should not submit passwords, API keys, access tokens, refresh tokens, private keys, webhook secrets, or other sensitive credentials or secrets into AI-enabled features, OCR, chatbot messages, support messages, prompts, Uploaded Files, or free-text fields unless required for the intended feature or integration. If such information is included in content submitted to AI-enabled features, it may be processed by the Provider and authorised AI, OCR, model, or automation service providers in accordance with this Policy and the relevant provider terms, service settings, security controls, and retention practices.

10.11.We do not use AI-enabled features to make decisions that produce legal effects or similarly significant effects on individuals without appropriate human review, unless such use is expressly enabled by the Subscriber and permitted by applicable law.

10.12.If we introduce materially new AI-enabled features or materially change how AI processing is carried out, we may provide additional in-product notices, feature notices, updated terms, or an updated Privacy Policy. Continued use of those features after notice may be treated as acceptance of the updated processing terms, except where additional consent is required by law.

11.1.We maintain reasonable technical and organisational safeguards appropriate to the nature of the personal data processed and the risks involved. These safeguards are designed to reduce the risk of accidental loss, unauthorised access, unauthorised disclosure, alteration, or misuse.

11.2.Safeguards may include:

11.3.User authentication for the Platform is handled through Supabase Auth or another authorised authentication service selected by the Provider. The Provider does not intentionally store user passwords in plaintext in the Platform application database. Authentication-related information, such as user identifiers, login records, session information, password reset records, and security logs, may be processed for account access, security, fraud prevention, troubleshooting, audit, and compliance purposes.

11.4.Where the Platform needs to store sensitive integration credentials, such as API keys, access tokens, refresh tokens, webhook signing secrets, private integration keys, or similar secrets, the Provider may store them using Supabase Vault or another secure secrets-management mechanism. Access to such secrets is restricted to authorised system functions, authorised personnel, or service processes where required to provide the Platform Services, operate integrations, troubleshoot issues, maintain security, or comply with applicable law.

11.5.Where technically and operationally reasonable, the Provider may mask, redact, restrict, avoid logging, or otherwise limit exposure of passwords, API keys, access tokens, private keys, and similar secrets in ordinary application logs, support workflows, and AI/OCR processing flows. However, the Subscriber remains responsible for avoiding unnecessary disclosure of secrets and for revoking or rotating credentials that may have been exposed.

11.6.No platform, network, storage system, payment system, backup process, or transmission method can be guaranteed to be completely secure, error-free, always available, or immune from accidental loss, corruption, unauthorised access, or unexpected events. Backup controls, monitoring, redundancy, and security safeguards are risk-reduction and disaster recovery measures only. Subscribers are responsible for using strong passwords, limiting Invited User access, reviewing Organisation Account permissions, keeping devices secure, maintaining independent exports of important business, tax, accounting, payroll, and statutory records, and retaining original copies of files they upload to the Platform.

11.7.The Platform Services are designed to accept only supported upload categories made available in the Platform from time to time, including supported document files, spreadsheet files, CSV or text-based files, image files, and business import files. Examples may include PDF, DOC, DOCX, XLS, XLSX, CSV, TXT, JPG, JPEG, PNG, HEIC, TIFF, XML, or similar business file types, depending on the feature used.

11.8.The Platform is not intended to accept executable files, software installers, system files, command files, scripts, active code, or other high-risk files unless we expressly enable a controlled feature for that purpose. We may change supported upload formats, file-size limits, and upload rules from time to time for security, compatibility, or operational reasons.

11.9.To protect the Platform Services and other users, we may inspect file metadata, validate file extensions and file types, scan or check Uploaded Files for suspected malware or suspicious content where available, generate previews, block unsafe downloads, quarantine files, reject uploads, delete unsafe files, or disable access to files that appear unsupported, corrupted, encrypted, password-protected, misleadingly named, disguised as another file type, or risky.

11.10.Uploaded-file controls reduce risk but cannot guarantee that every harmful, corrupted, misleading, or inappropriate file will be detected. Subscribers and Invited Users remain responsible for uploading files only from trusted sources, keeping their devices secure, limiting user permissions, and ensuring Uploaded Files are lawful, necessary, and appropriate for use in the Platform Services.

12.1.Authorised support or engineering personnel may access a Subscriber account or Your Data only where reasonably necessary to provide requested support, troubleshoot issues, maintain system stability, investigate suspected security incidents, comply with legal obligations, or prevent operational harm.

12.2.Where practical, support access will be based on Subscriber authorisation or a support request. Support access will be limited to authorised personnel and recorded in audit logs where technically available.

13.1.We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted for legal, tax, accounting, security, backup, dispute-resolution, or legitimate business purposes.

13.2.After subscription cancellation or termination, the Subscriber will generally have a thirty (30) day read-only export window, during which the Subscriber may export Your Data in supported formats such as CSV or JSON.

13.3.After the export window, active account data will be deleted or made inaccessible from production systems, unless retention is required by law or necessary for legitimate business, security, dispute-resolution, tax, or accounting purposes.

13.4.Encrypted database backup copies may remain for up to ninety (90) days after production deletion and will be overwritten according to our normal backup cycle. Database backups may include application data, settings, logs, file metadata, or file references, but they are not intended as a guaranteed recoverable backup of Uploaded File contents. Backup data is not normally restored except for disaster recovery, security, or legal purposes.

13.5.Payment metadata, invoices, receipts, tax records, and accounting records may be retained for as long as required or permitted for billing, tax, accounting, audit, chargeback, fraud-prevention, anti-money laundering, dispute-resolution, or legal purposes.

13.6.Deletion requests may be refused, delayed, or limited where continued retention is required or permitted by law, including tax, accounting, audit, security, fraud-prevention, backup, or dispute-resolution requirements.

13.7.When a Subscriber or Invited User requests a PDF, Excel, CSV, JSON, XML, e-invoice file, report, statement, or other download, we may temporarily process, assemble, convert, render, transmit, or stream the generated file solely to make it available for download or delivery.

13.8.Unless the Subscriber or an Invited User chooses to save, attach, archive, upload, or store the generated file within the Platform Services, we do not intentionally retain a separate permanent copy of that generated file after it has been generated and delivered for download. The underlying Your Data, saved records, limited metadata, audit logs, security logs, and operational logs may continue to be retained in accordance with this Policy.

13.9.For PDF rendering and similar file-generation processes, the generated file content and source content are intended to be handled ephemerally for the duration of the request and are not intentionally written to our databases, persistent volumes, permanent file storage, or content logs. Limited technical metadata, such as request status, response size, processing time, and error information, may be retained for security, troubleshooting, and service monitoring purposes.

13.10.If a Subscriber or Invited User uploads, imports, attaches, or saves any file in the Platform Services, including a supported document file, spreadsheet file, image file, text file, business import file, or a previously downloaded generated file, that file becomes Your Data and may be stored, processed, exported, scanned, monitored, restricted, and deleted in accordance with this Policy and the Terms and Conditions. Uploaded Files are not backed up by the Provider as a separate recoverable file backup unless we expressly state otherwise or enable a specific file-backup feature.

13.11.Once a generated file or uploaded file is downloaded, emailed, printed, shared, saved to a user device, retained as an original source file, or transferred to a third-party service outside the Platform Services, the Subscriber is responsible for its storage, confidentiality, security, backup, sharing, retention, deletion, and lawful use outside the Platform Services.

13.12.AI, OCR, chatbot, or assistance feature records, including prompts, extracted text, AI outputs, correction history, and related metadata, may be retained with the relevant account records where needed to provide the feature, maintain auditability, investigate errors, improve reliability, respond to support requests, or meet legal/security requirements. Third-party AI service providers may have their own retention periods and deletion processes for data processed by them.

14.1.We maintain reasonable internal procedures to identify, assess, contain, investigate, and document suspected personal data breaches.

14.2.Where a personal data breach is notifiable under applicable law, we will notify the Personal Data Protection Commissioner as soon as practicable and within the prescribed legal timeline after becoming aware of the breach.

14.3.Where required by law, and where the breach causes or is likely to cause significant harm to affected individuals, we will notify affected Subscribers and/or individuals without unnecessary delay and provide relevant information about the breach and mitigation steps.

14.4.Subscribers must notify us promptly if they suspect unauthorised access to their account, credentials, Invited User accounts, billing account, payment method, or Your Data.

15.1.Subject to applicable law and verification of identity, individuals may have rights to request access to personal data, correction of inaccurate personal data, withdrawal of consent where processing is based on consent, restriction or prevention of processing that may cause damage or distress, and prevention of processing for direct marketing purposes.

15.2.Individuals may also request deletion of personal data where continued retention is no longer necessary, subject to legal, tax, accounting, backup, security, payment dispute, fraud-prevention, dispute-resolution, and legitimate business retention requirements.

15.3.Where data portability or other rights apply under applicable law, we will respond in accordance with the law and within the technical limits of the Platform Services.

15.4.For Your Data controlled by a Subscriber, we may direct the individual to the relevant Subscriber or assist the Subscriber in responding to the request where reasonably required and technically feasible.

15.5.Requests must be submitted to the Privacy Email stated in Section 18 (Contact Information). We may require reasonable information to verify the requester's identity and authority before acting on a request.

16.1.The Platform may use cookies, local storage, logs, and similar technologies to keep users signed in, secure accounts, remember preferences, analyse usage, troubleshoot issues, and improve the Platform Services.

16.2.Stripe, fraud-prevention providers, analytics providers, or other third-party services may use their own cookies, scripts, device identifiers, or fraud-detection technologies when users interact with payment pages or related features.

16.3.Users may configure browser settings to block or delete cookies, but some Platform, billing, or payment features may not function properly without necessary cookies.

17.1.We may update this Policy from time to time. Material changes will be notified through email, the Platform dashboard, or another reasonable method. The updated Policy will apply from the effective date stated in the updated version.

17.2.Continued use of the Platform Services after the effective date of an updated Policy constitutes acceptance of the updated Policy, except where additional consent is legally required.

18.1.For privacy, support, billing, hosting-location, payment-data, uploaded-file, generated-file/export, AI/OCR processing, or account questions, contact the Provider using the details below. KiraDigit is the product/platform website; official privacy, support, billing, and notice communications may be sent from the monztechsys.com domain.

Provider

MONZTECH SYSTEM

Company Registration No.

202103253078 (TR0248202-U)

Brand / Platform

KiraDigit

Product Website

https://kiradigit.my

Platform Website

https://app.kiradigit.my

Company Website

https://monztechsys.com

Privacy Email

privacy@monztechsys.com

Support Email

support@monztechsys.com