Privacy Policy

Last updated: July 2026

Kira ("we", "us") is a bookkeeping assistant that works through WhatsApp and a web dashboard. This policy explains what personal data we collect, how we use and protect it, and the rights you have. It is written to align with the EU/UK General Data Protection Regulation (GDPR)and Malaysia's Personal Data Protection Act 2010 (PDPA).

1. Who is responsible for your data

The data controller is UVW Group Sdn Bhd (Company No. 202301029011 / 1522934-X), a company incorporated in Malaysia and the operator of Kira (kirae.app). Registered office: 1-30, Jalan Pandan Prima 2, Dataran Pandan Prima, 55100 Kuala Lumpur, Malaysia. For any privacy request you can reach us through Kira on WhatsApp or by email at privacy@kirae.app.

2. Data we collect

• Your WhatsApp number and profile name
• Messages, photos of receipts and slips, documents (PDF/Excel/CSV), and voice notes you send
• Extracted transaction data (amount, date, parties, category, references)
• Business profile you provide (business name, accountant email, staff you invite)
• Billing details processed by our payment provider (we do not store card numbers)

3. Why we process it, and our legal basis

• To provide the service (record your books, produce reports and exports): performance of a contract.
• To process payments and manage subscriptions: performance of a contract.
• To improve reliability and prevent abuse: our legitimate interests.
• Optional communications: your consent, which you can withdraw at any time.

We do not sell your data, and we do not use it to train third-party AI models.

4. Service providers (processors)

To function, your data is processed by trusted providers acting only on our instructions: Google (Gemini AI to read documents and text, and Cloud Text-to-Speech for voice replies), our WhatsApp Business provider and Meta (message delivery), Supabase (database and file storage), Vercel (hosting), Stripe (payments), and Resend (email).

5. International data transfers

Our providers may process data on servers outside your country, including in Singapore, the EU and the United States. Where data leaves your region, transfers are protected by appropriate safeguards such as the providers' Standard Contractual Clauses and equivalent measures.

6. Storage and security

Data is encrypted in transit (TLS) and stored with restricted access. Receipt and document evidence is kept in private storage accessible only through temporary signed links.

7. Your rights

• Access and portability: request a copy of your data. Your export files already give you your transactions in a portable format.
• Rectification: correct any transaction on the dashboard or by replying in WhatsApp.
• Erasure: type "delete my data" in WhatsApp and all of your data (transactions, messages, records) is permanently deleted immediately.
• Restriction and objection: ask us to limit or stop certain processing.
• Withdraw consent: stop using the service at any time.
• Complain: lodge a complaint with your local data protection authority.

8. Data retention

We keep your data while your account is active. Accounts inactive for more than 24 months may be deleted. You can delete your data at any time as described above.

9. Changes

We may update this policy and will revise the date above when we do.

This document is a general guide and not legal advice. Please seek a lawyer's review for full compliance in your jurisdiction.