KiraMate Privacy Policy

Last updated: 20 October 2026

KiraMate is a business-finance app for Malaysian freelancers and small businesses. This policy explains what the app stores and how that data is handled. It describes the current implementation; it will be updated if the app's data handling changes.

Who controls your data

The business that registers the account is the controller of the data it enters. KiraMate stores that data on the server that operates this API on the business's behalf.

What we store

• Account: your email address and a securely hashed password (we never store your password in readable form).
• Business profile: business name, registration number, address, email, phone, logo, bank details and default payment terms.
• Customers: names, company names, emails, phone numbers, billing addresses and optional registration numbers that you enter.
• Documents: quotations, invoices and the payments you record against them.
• Expenses and receipts: expense records and any receipt images you capture or upload.

Receipt images and OCR

Receipt images are stored privately on the server and are only returned to authenticated users who own them. Text recognition (OCR) to suggest merchant, date and amount runs on your device; no paid cloud OCR is used unless it is explicitly enabled by the operator. Suggested values are always shown to you for review and correction before anything is saved.

How your data is protected

• Passwords are hashed with Argon2id.
• Access requires an authentication token; each business can only access its own workspace.
• Uploaded files are validated and stored outside any public folder.

Data sharing

KiraMate does not sell your data. Data is not shared with third parties except where you export it yourself (for example, a PDF or CSV you choose to share) or where required by law.

Retention and deletion

KiraMate does not automatically delete your records after any period. Issued financial records (invoices and recorded payments) are preserved for your bookkeeping and are corrected by cancellation or adjustment rather than silent deletion.

You can delete your entire account at any time. Before deletion you are offered a full export of your data. Deletion requires you to retype your account email to confirm, and then permanently erases your whole workspace — business profile, customers, quotations, invoices, payments, expenses and receipt images. This cannot be undone. Note that Malaysian businesses are generally expected to keep financial records for about seven years; keeping your own copy before deletion is your responsibility.

Scope

KiraMate produces ordinary commercial documents. It does not claim LHDN MyInvois compliance and does not submit documents to MyInvois. Reports are plain cash summaries of the records you enter and are not audited accounts or formal profit statements.

Contact

For privacy questions, contact the operator of your KiraMate account. A contact address will be published here before public release.