Privacy Policy

1) Who we are

KlerkIt is a product of Gainensoft Sdn Bhd (Company Registration No. 1301386-V) (“Company”, “we”, “us”).

Registered office: [TBD — OWNER/LEGAL REVIEW]

We provide an evidence-first business record preparation platform that helps Malaysian SMEs and accounting firms organise bank activity, receipts, invoices and other supporting documents, using AI-assisted data extraction (OCR) and e-Invoice–related workflows.

2) Scope

This Policy applies to our websites (including klerkit.com), web application, mobile applications, APIs and related services (together, the “Services”). Where a specific feature has its own privacy notice, that notice prevails for that feature in case of conflict.

Privacy_Scope_Body2

3) Data we collect

A. Information you provide

• Account & profile: name, email address, phone number (optional), password hash, company name, and role or designation.
• Billing: billing name, address, tax identification number (e.g. SST), and payment details handled by our payment processor — we do not store full card numbers.
• Content you upload: images, PDFs and documents for OCR/extraction (for example invoices, receipts, purchase bills and credit notes), plus any related metadata.
• Support communications: messages, tickets and attachments you send to our support channels.

B. Information collected automatically

• Usage data: interactions with features, timestamps, pages or screens viewed, and referrers.
• Device & log data: IP address, device identifiers, browser type, operating system, app version, crash logs and performance metrics.
• Cookies and similar technologies: session cookies, preference cookies and analytics tools — see Cookies & analytics below.

C. Third-party and integration data

• Single sign-on: if you sign in with Google, Facebook, or another supported provider, we receive the basic profile information (such as name and email) that you and the provider permit.
• Accounting / e-Invoice integrations: with your authorisation, we may access and process data from connected systems to perform imports, reconciliation or submissions on your behalf.

4) Mobile app permissions & camera

Our mobile apps may request certain device permissions. These are used strictly to deliver core functionality and are not used for unrelated purposes such as advertising or hidden tracking.

A. Camera access

• The camera is used solely to capture images of invoices, receipts and related documents for OCR processing.
• Camera access is only activated when you explicitly open the scan or capture function in the app.
• We do not record video or capture images in the background without your knowledge.

B. Photo and file access (if enabled)

• If you choose to upload files from your gallery or file storage, we only access the specific files you select.
• We do not scan or index your entire photo library or file system.

You can manage or revoke these permissions at any time in your device settings. Some features, such as scanning invoices, may not work correctly without the relevant permission.

5) How we use your data

• To provide and operate the Services: account creation, authentication, OCR extraction, classification, e-Invoice–related workflows and related features.
• To support compliance: help you meet applicable regulatory requirements (for example LHDN e-Invoice requirements) and maintain audit trails and records.
• To maintain security: detect and prevent fraud, abuse and misuse, and protect our users and systems.
• To provide customer support: respond to your questions, requests and technical issues.
• To process payments: manage subscriptions, billing and payment records through our payment processor.
• To analyse and improve: use aggregated and/or de-identified data to understand usage patterns and improve features and performance.
• To send service-related communications: important updates, security alerts and administrative messages. Marketing communications, where sent, are subject to your consent and can be opted out of at any time.

6) Legal bases (PDPA & others)

We primarily operate under Malaysia's Personal Data Protection Act 2010 (PDPA). Depending on your location, other laws may also apply. Our main legal bases include:

• Contract: processing necessary to provide the Services you sign up for.
• Legal obligation: processing necessary to support your tax and invoicing compliance, retain records, and respond to lawful requests.
• Legitimate interests: processing necessary to maintain, secure and improve the Services in a way that does not override your privacy rights.
• Consent: for certain activities, such as specific marketing or optional analytics, where required. You may withdraw consent at any time.

7) Sharing & disclosure

• Service providers (processors): we use providers for cloud hosting, storage, analytics, logging, customer support and payment processing. They process data only on our instructions and under appropriate safeguards.
• Integrated partners: accounting platforms or e-Invoice gateways that you choose to connect and authorise.
• Professional advisers and legal authorities: where required to comply with applicable law, enforce our terms, or protect our rights, users or the public.
• Business transfers: in the event of a merger, acquisition or similar transaction, your data may be transferred subject to protections consistent with this Policy.

We do not sell your personal data.

8) Data retention

• Account data: retained while your account is active, and for a reasonable period afterwards to meet legal, accounting and audit requirements.
• OCR uploads (images/PDFs): retained by default for a limited period to support re-processing, troubleshooting and validation, unless you delete them earlier. Exact default retention period: [TBD — OWNER/LEGAL REVIEW]
• Extracted records and logs: retained as necessary to support auditability and tax obligations, typically in line with statutory record-keeping requirements, or as otherwise required by applicable law.

9) AI, OCR & automated processing

KlerkIt uses machine learning models and OCR engines to extract and classify fields (for example subtotal, tax, total and payment method) from documents you upload.

• Purpose: to reduce manual data entry, improve accuracy, and support your accounting and e-Invoice–related workflows.
• Model improvement: we may use aggregated and/or de-identified data to improve model quality. We do not use your identifiable financial records for advertising.
• Human oversight: our outputs are designed to assist your workflows. You, or your appointed accountant or other professional, remain responsible for final review, approval and submission.

10) Security

• In transit and at rest: we use industry-standard measures, including encryption in transit and, where appropriate, encryption at rest.
• Access controls: role-based access, authentication and logging are used to limit and monitor access to systems and data.
• Operational safeguards: hardened infrastructure, patch management, monitoring and backup processes.

No system can be guaranteed completely secure. We continue to improve our safeguards, and encourage you to use a strong, unique password and enable multi-factor authentication where available.

11) International transfers

Your data may be processed in Malaysia and other locations where our service providers operate. Where required, we use appropriate safeguards for any cross-border transfer, such as contractual protections.

12) Cookies & analytics

We use cookies and similar technologies to operate and improve our Services.

• Essential: authentication/session cookies, security cookies and load-balancing cookies required for the Services to function — including the cookie that remembers your selected display language.
• Preferences: cookies that remember your settings and choices, such as language, layout or last-used company.
• Analytics: {0} to understand usage and performance in aggregate. You may adjust your browser settings to limit cookies.

Where required by law, we will present a consent option for non-essential cookies and respect your choice.

13) Your rights

Subject to applicable law, including the PDPA, you may have the right to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data, subject to legal and contractual limitations.
• Object to, or request restriction of, certain processing activities.
• Withdraw consent where processing is based on your consent.

We may ask you to verify your identity before responding to a request. Some requests may affect our ability to provide the Services.

14) Children's data

Our Services are intended for business users and are not directed at children. Please do not use the Services if you are below the legal age to enter into contracts in your jurisdiction.

15) Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. If changes are material, we may provide additional notice, for example by email or in-app notification.