Who this covers, and our two different roles
This policy explains how BSYX LABS (Registration No. 202603086039) handles personal data in connection with InvoKita. It is written against the Malaysian Personal Data Protection Act 2010 ("PDPA").
There are two kinds of personal data in InvoKita and we treat them differently:
- Your data — we decide
- The information about you as a user: your name, email, business details, plan and how you use the Service. For this data we are the data user, and this policy describes what we do with it.
- Your clients’ data — you decide
- The information you enter about the people you invoice: their names, phone numbers, email addresses, addresses and what they owe you. You decide what goes in and who gets contacted. We process it on your instructions in order to run the Service for you. Your own privacy notice governs your relationship with your clients; this policy tells you what we do with it on your behalf.
What we collect
- Account information
- Your name, email address, password (stored hashed, never in readable form), and the business profile you enter — company name, address, phone, logo and tax settings.
- Invoice and client records
- The invoices you create and the client records you enter: names, contact details, line items, amounts, currency, due dates, payment status, and the timestamps of messages we sent about them.
- Payment gateway credentials
- If you connect a gateway, the API keys and secrets for your own gateway account. These are encrypted before storage — see the security section.
- Subscription and billing information
- Your plan, allowance usage, and records of payments to us. We do not receive or store your full card number; that is handled by the payment provider.
- Technical and usage data
- Server logs including IP address, browser type, pages requested and timestamps, plus a record of which features you use, so we can keep the Service secure and working.
Why we use it
- To provide the Service: creating invoices, sending them by email and WhatsApp, sending the reminders you have scheduled, and recording payment when your gateway confirms it.
- To operate your account: authentication, plan allowances, billing and support.
- To keep the Service safe: detecting abuse, debugging faults and protecting against fraud and unauthorised access.
- To communicate with you about your account, security, changes to the Service and changes to these documents.
- To meet legal, tax and accounting obligations that apply to us.
We do not use your data or your clients’ data to train AI models, and we do not use it for advertising.
Who else processes your data
We use the third parties below to run the Service. They receive only what they need for their function. Several are outside Malaysia, which means your data — and your clients’ data — is transferred out of Malaysia when those features are used.
| Provider | What it does | What it receives |
|---|---|---|
| Twilio | Delivers WhatsApp messages | Your client’s phone number and the message content, which includes their name, your business name, the invoice number, the amount and the due date |
| Resend | Delivers email | Your client’s email address and the message content, and your email address for account mail |
| Groq | Runs the AI drafting and insight features | See the AI section below |
| Billplz, ToyyibPay, HitPay, senangPay, Xendit | Payment gateways you choose to connect | Invoice reference, amount, currency and the details needed to create a payment page. Handled under your own agreement with that gateway |
If you have not connected a gateway, or you have automatic messaging switched off, the corresponding provider receives nothing.
We also use infrastructure providers to host the application and its database, and they necessarily store the data described above on our behalf.
We do not sell personal data, we do not rent or trade it, and we do not share it with advertisers or data brokers. We may disclose data if we are legally required to, or to establish or defend a legal claim, and we will tell you unless we are prohibited from doing so.
What we send to the AI provider
Two features use a third-party large language model, currently Groq. This section exists because a vague reference to "AI" is not a disclosure.
- Invoice drafting
- When you type a sentence to draft an invoice, that sentence is sent to the provider. If it contains a client name or an amount, so does the request.
- Dashboard insights
- When insights are generated, we send a summary of your recent invoicing activity: your default currency, revenue and outstanding totals, details of overdue invoices, and your top clients by revenue — which includes client names.
- These requests are processed outside Malaysia.
- We do not send payment gateway credentials, passwords or card data to the AI provider.
- We do not use your data to train models, and we ask our provider not to either. Their own terms govern what they do; if that matters to your business, do not use the AI features.
- If you never use the AI features, no invoice or client data is sent to an AI provider.
Security — precisely what we do
An earlier version of this policy implied that all of your data was held under bank-grade encryption. That was broader than the truth, so here is the accurate position.
- In transit
- All traffic between your browser and our servers, and between our servers and the providers listed above, is encrypted using HTTPS/TLS.
- Payment gateway credentials
- Encrypted at the application layer with AES-256-GCM before being written to the database, and decrypted only when a payment request needs them.
- Passwords
- Stored as one-way hashes. We cannot read your password and cannot tell it to you.
- Invoice and client records
- Stored in our database with access controls and per-account isolation, so one account cannot read another’s records. These records are not additionally encrypted at the application layer — they are protected by access control, authentication and the security of the hosting environment, not by per-field encryption.
- Public invoice links
- The link you send a client contains a token tied to that single invoice. It cannot be used to browse anything else in your account. Anyone holding the link can view that invoice, so treat it as you would any payment link.
How long we keep it
- While your account is open, we keep your data so the Service works and your history stays intact.
- If you close your account, we delete or anonymise your account and invoice data within a reasonable period, except where we must keep records for longer to meet a legal, tax or accounting obligation, or to resolve a dispute.
- Server logs are kept for a limited period for security and debugging, then discarded.
- Anonymised or aggregated information that cannot identify anyone may be kept indefinitely.
Export what you need before closing your account. Invoices can be downloaded as PDFs at any time.
Your rights under the PDPA
In relation to the personal data we hold about you, you may:
- Ask for access to it, and for a copy.
- Ask us to correct it if it is inaccurate or incomplete.
- Withdraw your consent to processing that relies on consent, and ask us to stop processing that is causing you damage or distress. Withdrawing consent for processing we need in order to run the Service means we may no longer be able to provide it.
- Ask us to limit how we process it.
- Ask us to delete it, subject to any records we must keep by law.
Most of this you can do yourself in your account settings. For anything else, email support@invokita.my from the address on your account and we will respond. We may need to verify who you are first.
If your data is in InvoKita because one of our users invoiced you, we are processing it on their instructions. Contact that business directly. If you cannot reach them, write to us and we will pass the request on.
If you are unhappy with how we have handled a request, you can complain to the Personal Data Protection Commissioner in Malaysia. We would rather you told us first.
Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle your personal data, we will notify you by email or in the app rather than relying on you to notice.