Privacy Policy

Last updated: September 2026

Kirae ("we", "us") is an AI customer service and business assistant that works through WhatsApp and a web dashboard. This policy explains what personal data we collect, how we use and protect it, and the rights you have. It is written to align with the EU/UK General Data Protection Regulation (GDPR)and Malaysia's Personal Data Protection Act 2010 (PDPA).

1. Who is responsible for your data

The data controller is UVW Group Sdn Bhd (Company No. 202301029011 / 1522934-X), a company incorporated in Malaysia and the operator of Kirae (kirae.app). Registered office: 1-30, Jalan Pandan Prima 2, Dataran Pandan Prima, 55100 Kuala Lumpur, Malaysia. For any privacy request you can reach us through Kirae on WhatsApp or by email at privacy@kirae.app.

2. Data we collect

• Your WhatsApp number and profile name
• Messages, photos of receipts and slips, documents (PDF/Excel/CSV), and voice notes you send
• Extracted transaction data (amount, date, parties, category, references)
• Business profile you provide (business name, accountant email, staff you invite)
• If you connect Google Calendar: calendar names and identifiers, availability periods, and the dates, times and status of Kirae booking events
• Billing details processed by our payment provider (we do not store card numbers)

3. Why we process it, and our legal basis

• To provide the service (record your books, produce reports and exports): performance of a contract.
• To manage bookings when you connect Google Calendar: show available slots, create booking events and present staff changes for review before updating a customer booking.
• To process payments and manage subscriptions: performance of a contract.
• To improve reliability and prevent abuse: our legitimate interests.
• Optional communications: your consent, which you can withdraw at any time.

We do not sell your data, and we do not use it to train third-party AI models.

4. Service providers (processors)

To function, your data is processed by trusted providers acting only on our instructions: Google (Gemini AI to read documents and text, Cloud Text-to-Speech for voice replies, and Google Calendar when you connect it), our WhatsApp Business provider and Meta (message delivery), Supabase (database and file storage), Vercel (hosting), Stripe (payments), and Resend (email).

5. Google Calendar connection

Connecting Google Calendar is optional. With your permission, Kirae reads the calendars you can edit and their availability to avoid offering occupied booking slots. Kirae creates, reads, updates and deletes events for Kirae bookings on the calendar you assign to a bookable resource. These events contain the service name, booking time and Kirae booking identifier; customer details remain in the Kirae dashboard. When staff move or delete a Kirae event in Google Calendar, Kirae reads that change and asks staff to approve it in the dashboard before changing the customer booking or sending a WhatsApp notice.

We store your Google refresh token encrypted, along with calendar mappings, Kirae event identifiers and proposed booking changes, in our restricted database. We use Google Calendar data only for these booking features. Available booking times derived from calendar availability may be included in prompts to Gemini so Kirae can answer customers about open slots; calendar names, unrelated event details and Google authorization tokens are not included. Pausing the connection stops calendar sync but keeps the encrypted token and mappings so that you can reconnect. To request removal of the connection and its stored data, contact privacy@kirae.app. You can also revoke Kirae's access in your Google Account settings.

6. International data transfers

Our providers may process data on servers outside your country, including in Singapore, the EU and the United States. Where data leaves your region, transfers are protected by appropriate safeguards such as the providers' Standard Contractual Clauses and equivalent measures.

7. Storage and security

Data is encrypted in transit (TLS) and stored with restricted access. Receipt and document evidence is kept in private storage accessible only through temporary signed links.

8. Your rights

• Access and portability: request a copy of your data. Your export files already give you your transactions in a portable format.
• Rectification: correct any transaction on the dashboard or by replying in WhatsApp.
• Erasure: request deletion through WhatsApp or privacy@kirae.app. We will handle the request subject to applicable retention obligations.
• Restriction and objection: ask us to limit or stop certain processing.
• Withdraw consent: stop using the service at any time.
• Complain: lodge a complaint with your local data protection authority.

9. Data retention

We keep your data while your account is active. Accounts inactive for more than 24 months may be deleted. You can delete your data at any time as described above.

10. Changes

We may update this policy and will revise the date above when we do.

This document is a general guide and not legal advice. Please seek a lawyer's review for full compliance in your jurisdiction.