Privacy Policy

Effective: 28 October 2026 (updated 2 November 2026: anonymous diagnostics and in-app feedback) · Applies to the KiraTax app (Android, iOS, web) and the kiratax.my website.

KiraTax is owned and operated by AMET HAKEEN MEDIA (SSM Registration No. 202603007216 / 003810621-K), a registered business in Selangor, Malaysia (“we”). We are the data user for the purposes of the Personal Data Protection Act 2010.

KiraTax is built on a simple principle: your financial data is processed on your device, and only leaves your device if you yourself choose to sync it. This policy explains clearly what we collect, why, and your choices, in line with the Personal Data Protection Act 2010 (PDPA).

1. Summary

An email account is required. Your records are stored on your device (so the app works without internet) and synced to your account so they can be restored.
Bank statements, receipts, notifications and e-Invoice QR codes are read on your device. Text and images are not sent to any server to be read.
Except receipts by email: emails you forward to your personal receipt address (resit+code@kiratax.my) are received by our server and stored temporarily in your account until the app fetches and reads them on your device. This feature can be turned off.
Your records and the receipt photos you attach are uploaded to your private account on Supabase when the app syncs data.
Face ID / fingerprint lock is handled by the phone’s system; KiraTax does not receive or store your biometric data.
We never ask for your bank, MyTax or MyInvois password, and we do not use screen scraping.
No ads, no third-party analytics trackers (our own anonymous diagnostics can be turned off), and your data is not sold.
Every feature that requires a permission can be turned off completely in Settings.

2. Data we process

Data type	Examples	Purpose	Where it is stored
Profile	Entity type, year of assessment, business name (optional), residency status	Choosing the correct tax rules	Device; cloud if synced
Financial records	Income, expenses, categories, platforms, notes	Summaries and tax estimates	Device; cloud if synced
Tax inputs	Relief amounts, zakat, dependants, learned category rules	Tax calculation and relief tracker	Device; cloud if synced
Inbox	Transactions from statements, notifications, Apple Pay or receipts awaiting confirmation	Review before they become records	Device; cloud if synced
Trip log (optional)	Date, purpose, from/to places you type, distance and odometer readings. KiraTax does not use GPS or device location.	Evidence of the vehicle’s business-use percentage	Device; cloud if synced
Receipt photos	Photos of receipts you attach	Evidence for claims	Device; your account’s private cloud storage
e-Invoice references	Document UUID and MyInvois validation link	Reference to official evidence	Device; cloud if synced
Account	Email address and password (stored in hashed form by the authentication provider). If you sign in with Google: only the name, email address and profile picture of your Google account; KiraTax does not get access to Gmail, Drive or other Google data.	Sign-in and sync	Supabase

Original bank statements (CSV/PDF files) are read on your device and are not uploaded to the server or your account. In the phone app, a copy of the file is kept in the app’s storage on that phone only so you can open it as tax evidence; the copy is deleted when you sign out or delete the app. The web version does not keep a copy. Only transactions you confirm are saved as records. On the web version, “device” means your browser’s storage for the app.kiratax.my site; that data is lost if you delete that site’s data.

3. Data we do not collect

Passwords or login credentials for your bank, MyTax, MyInvois or e-wallet.
Identity card number (MyKad), your TIN, bank account numbers or card numbers.
SMS. KiraTax does not request permission to read SMS.
Location, contacts, microphone or browser history.
Data from Apple FinanceKit.

Scanned receipts may contain the seller’s SST number or TIN; this information is only stored if you choose to save it in a record’s notes.

Anonymous diagnostics: to improve the app, KiraTax sends the names of features used (for example a statement import succeeding or failing, and the bank format), the error type and its location in the app's code, device type and app version, with a random installation ID that isn't linked to your account. It does not include amounts, transaction names, statement contents, receipts or error messages. Turn it off in More → Privacy → Help improve KiraTax; the installation ID is removed from the device when you do.

Feedback: if you send feedback, we receive the text you type, a reply email if you add one, device type, app version and your account ID if you're signed in.

4. On-device processing

The following features run entirely on your device:

Bank statement import: files are read and parsed on the device.
Receipt scanning (OCR): runs offline on the phone. On Android, KiraTax uses Google ML Kit Text Recognition; as a Google library, ML Kit may send performance and usage metrics, without content, to Google (see the ML Kit terms). On iOS, KiraTax uses Apple Vision, which is built into iOS. On both platforms, receipt images and text are not sent to a server to be read.
Notification capture (iPhone, iOS 27): a Shortcuts automation that you install yourself sends the notification text of the bank apps you choose to KiraTax. The text is parsed on the device and discarded immediately afterwards. You can turn this off in the app or delete the automation.
Notification capture (Android): only notifications from bank/e-wallet apps in the supported list are read (you can untick any app), parsed on the device, and the raw text is not stored or sent.
e-Invoice QR scanning: only codes from the official host myinvois.hasil.gov.my are accepted; KiraTax does not log in to MyInvois.
Category suggestions: rules are learned and stored in your own data.
Home screen widget: if you add a KiraTax widget, a summary of your tax estimate is stored in the phone’s storage so the widget can display it. Nothing is sent out. Amounts can be hidden in More → Hide amounts on widget, and the widget is cleared when you sign out.

5. Device permissions

Permission	Used for	Default
Notification access (Android)	Recording transactions from notifications of supported bank and e-wallet apps	Turned on in the app by default, but only works after you read the explanation and grant Notification Access yourself in Android Settings. Can be turned off at any time
Face ID / fingerprint	Locking the app so only you can open it. Authentication is done by the phone’s system; KiraTax only receives a success or failure result	Off by default; you can turn it on in Settings
Camera & photos	Scanning receipts and e-Invoice QR codes	Requested only when you tap the scan button
Shortcuts (iOS Shortcuts)	Receiving the amount & shop name from an Apple Pay automation you set up yourself	Only works if you set up the automation
Internet	Sync (if signed in) and opening links	Not applicable

You can turn off each of these features in Settings → Automatic capture, and withdraw permissions through your phone’s system settings.

Receipts by email

If you send or forward an email to your personal receipt address, the email is received by Cloudflare Email Routing and a Cloudflare Worker that we own. The Worker only stores the sender address, subject, email text (up to 20,000 characters) and PDF or image attachments (up to 5 files, 5MB each) in your account on Supabase. Other attachments are discarded. Email content is not parsed on the server and is not logged. Your app then fetches the email, reads the shop, date and total on your device, and deletes the email text from the server. Attachments are kept as receipts in your private storage. Emails that cannot be read remain until you remove them in the app. Emails to an address without a valid code are rejected.

6. Account & cloud sync

An account is required to use KiraTax. The data in section 2 is synced to our database when the app is opened, after you sign in, and when you tap Sync, so records can be restored and used on several devices. When you sign out, the data on that device is deleted; the data in your account remains. Every row is protected with Row Level Security, so only your account can read or write your data. Receipt photos (Android only for now) are stored in a private storage bucket, not a public one. Sample (demo) data is never synced.

7. Service providers

Supabase: authentication, database and receipt storage for signed-in users. Data centre in Singapore (ap-southeast-1). This means synced data is transferred outside Malaysia; we chose a provider that uses encryption and access controls equivalent to PDPA requirements.
Cloudflare: hosts the kiratax.my website and the web version. Cloudflare processes technical data such as IP addresses to deliver the site and protect it from attacks.
Bank Negara Malaysia: when you convert foreign-currency income, the app fetches exchange rates from BNM’s public API. Only the currency code and date are sent (via app.kiratax.my for the web version); your amounts and data are not sent.
Google Play and Apple App Store: will distribute the app once it is published, subject to their respective privacy policies. For now, KiraTax is available as a web version.

We do not share your data with others for marketing. We will only disclose data if required by Malaysian law.

8. Retention & deletion

Data on your device remains until you delete it or uninstall the app.
Cloud data remains for as long as your account is active.
Anonymous diagnostics are deleted after 12 months, and feedback after 24 months. Feedback with an account ID is deleted with the account.
Phone backups: if iCloud Backup (iPhone) or Google backup (Android) is turned on on your phone, the phone’s system backs up the KiraTax records database to your Apple or Google account; KiraTax does not receive that copy. On Android, KiraTax only allows Google backup when end-to-end encryption is available (a screen lock is set), and does not include copies of bank statements, receipt photos or stored keys.
KiraTax automatic backup (optional): every week, a copy of your records is encrypted with AES-256 using a passphrase you set, and the 5 most recent copies are kept in the app folder. The passphrase is stored in that phone’s Keychain/Keystore only and is not sent to us; without the passphrase, the files cannot be opened, including by KiraTax. These files are deleted when you delete all data or sign out.
Delete all data: Settings → Delete all data deletes the data on the device and, if selected, all your records and receipt photos in the cloud.
Delete account: in the app, open More → Account & sync → Delete account and type PADAM. Your account, all records in the cloud, receipt photos, receipt emails and accountant access are deleted immediately, as is the data on that device. If you cannot open the app, email privasi@kiratax.my from your account’s email address and we will delete it within 30 days.
Malaysian tax law requires you to keep records for 7 years. Export a backup (JSON/CSV/PDF) first before deleting.

9. Your rights

Under the PDPA, you have the right to:

Access your data: all data can be viewed in the app and exported as JSON or CSV.
Correct data: edit any record directly in the app.
Data portability: a JSON export can be imported again on another device.
Withdraw consent: turn off capture features, sign out, or delete your account.
Make a complaint to us, or to the Personal Data Protection Department of Malaysia.

10. Security

Data is transmitted over HTTPS. Database access is restricted to the owner through Row Level Security, and the app does not contain any server admin keys. No system is completely secure; if a data breach affecting you occurs, we will notify you and the authorities as required by law.

11. Children

KiraTax is intended for adult taxpayers and is not directed at children under 18.

12. Policy changes

We will update the date at the top of this page when the policy changes. Major changes will be announced in the app.

13. Contact us

AMET HAKEEN MEDIA (202603007216 / 003810621-K)
Selangor, Malaysia
Privacy questions or requests: privasi@kiratax.my

KiraTax provides estimates for planning and is not tax advice. Actual calculations depend on eligibility, documents and LHDN rules. KiraTax is not affiliated with LHDN (Inland Revenue Board).