Privacy Policy (PDPA)
Effective: 3 July 2026
AiAkaun is a product of Data Brain Sdn. Bhd. (1335252-P), Tingkat 1, 2309, Jalan SJ 10/1, Taman Seremban Jaya, 70450 Seremban, Negeri Sembilan, Malaysia.
Your privacy matters to us. This notice explains how Data Brain Sdn. Bhd. collects, uses, discloses and protects your personal data when you use AiAkaun, in accordance with the Personal Data Protection Act 2010 (Amendment 2024) ("PDPA").
1. Data User Identity
AiAkaun is operated by Data Brain Sdn. Bhd. (1335252-P), Tingkat 1, 2309, Jalan SJ 10/1, Taman Seremban Jaya, 70450 Seremban, Negeri Sembilan, Malaysia. The Data Protection Officer (DPO) can be reached at admin@aiakaun.com.
2. Personal data we collect
Registration details (name, email, hashed password, phone); information about the companies you create; uploaded documents (bank statements, receipts, financial documents); transaction & accounting data; payment data (processed externally by Billplz — we do not store full card details); technical signals (IP address, browser, device fingerprint); and activity logs.
3. Purpose of collection
The primary purpose is to deliver the AI accounting service (read & classify transactions, reports, tax, payroll). Secondary purposes include account management, billing, customer support, security mechanisms (2FA, fraud detection), legal compliance, and service notifications.
4. Third-party disclosure
Data is shared only with: AI providers (Google Gemini, Anthropic Claude) for processing; Billplz for payments; hosting (Contabo) and email delivery (Resend) providers; and authorities when required by law. We do NOT sell, rent, or share your personal data for third-party marketing.
5. Cross-border data transfer
Data may be processed abroad by AI providers. Transfers comply with Section 129 of the PDPA 2010 through data processing agreements providing equivalent protection.
6. Retention period
Active account data is retained during membership; accounting & tax records are kept seven (7) years (regulatory requirement); activity logs are retained five (5) years; deleted accounts are anonymised within 30 days in line with PDPA erasure rights.
7. Your rights as a data subject
You may access and correct your data via your profile in My Account, withdraw consent by deleting your account, or lodge a complaint with the Department of Personal Data Protection (JPDP) at pdp.gov.my.
8. Security measures
We use HTTPS/TLS encryption, bcrypt password hashing, optional two-factor authentication (2FA), new-device monitoring, daily encrypted backups, and audited employee access controls.
9. Cookies & tracking
We use session cookies for authentication only. No third-party marketing cookies. You may disable them at the browser level, with some features possibly limited.
10. Data breach notification
We are committed to notifying affected users and the JPDP within 72 hours in line with Section 12A of the PDPA Amendment 2024 upon discovery of unauthorised access.
11. Changes to this notice
Updates are published on this page; material changes will be communicated by email.
Enforcement & complaints
You may escalate any concerns to the Personal Data Protection Commissioner at www.pdp.gov.my. AiAkaun DPO: admin@aiakaun.com