klikAkaun Privacy Notice

Klik Innovations Sdn Bhd ("Klik", "we"). This notice is made under the Malaysian Personal Data Protection Act 2010 (PDPA), as amended in 2024. It is provided in Bahasa Melayu and English.

Version 1.1 (10 November 2026). The effective date is shown with this document.

Klik Innovations Sdn Bhd, SSM number 202201021984 (1467681-U). Registered address: 118G, Jalan Tiga, Batu Caves, Centrepoint, 68100 Batu Caves, Selangor.

This notice covers the klikakaun.my website, sign-up and customer accounts. For personal data inside a customer's books (donors, payees, staff, customers), Klik is the data processor and the customer is the data controller. See the Data Processing Terms.

1. What personal data we collect

From you as an applicant, signatory or user:

• Name, position, e-mail, phone or WhatsApp number.
• Company or organisation name and registration number, address.
• Verification documents: the registration certificate (SSM or ROS) and a letter authorising the signatory. We do not ask for or keep copies of identity cards (IC or MyKad). Please do not send an IC copy. If one is inside your document, cover it before uploading.
• Billing and payment information: company details on the invoice (name, registration number, address, e-mail), invoices, and payment records. BayarCash processes the payer details (name, e-mail, bank). We keep the transaction reference, status, amount and date. We do not store card numbers or your bank login details. The full BayarCash callback text is not recorded in our logs.
• Account information: user name, role, sign-ins and audit trail (who did what, when), IP address and browser type.
• Records of accepting the terms: name, e-mail, role, time, IP address, browser, document version and a hash (fingerprint) of the document text.
• Referral code, if any.
• Your messages to us (WhatsApp, e-mail, forms) and your questions to the in-app support assistant. E-mails and long numbers are removed from the question log. Names and free text are not removed automatically, so please do not type personal data that is not needed.
• Security check on the sign-up form: we use Cloudflare Turnstile to tell humans from bots. Cloudflare receives your IP address and browser signals for that purpose, under its own privacy policy.
• Cookies and site statistics: we do not use any analytics or tracking tool on klikakaun.my or in the app. Only two essential cookies are set: the sign-in session cookie (expires in 2 hours) and the XSRF token (CSRF protection). Your language choice is kept in your browser storage (not a cookie). If you open klikakaun.my from a referral link or type a referral code on the pricing page, the code is saved in your browser storage (not a cookie) for 30 days so that it can be added to the sign-up link. It is not sent to us until you sign up, and you can remove it by clearing site data in your browser. If we add an analytics tool later, we will update this notice first.

Data inside your books (transactions, names of donors, payees, staff, customers, receipts): you are the controller and you are responsible for it. We process it only to provide the service, under the Data Processing Terms.

We do not intentionally collect sensitive personal data. Under the PDPA, sensitive data includes information about health and religious belief. Donor or member data of a surau can show religious belief. If your books contain such data, you are responsible for getting the clear consent of the person.

2. Why we use your data

• To register, verify and set up your account.
• To provide the service, support and security.
• To issue invoices, process payments and send receipts.
• To send service messages (verification, payment reminders, backup alerts, WhatsApp).
• To calculate and pay the commission of the partner who referred you (if any).
• To meet legal duties and to keep records of terms acceptance.
• We do not sell your data.
• Marketing: we do not send marketing messages. We send only service messages (for example invoices, security and maintenance notices). If this changes, we will first ask for your separate consent, with an opt-out at any time.

3. Who receives your data

We share only what is needed:

• Hosting and servers: Klik's own servers, on Klik's premises in Malaysia (not rented cloud servers).
• Off-site backups (Google Drive), cross-border transfer: backups are sent to Google Drive (Google), whose servers are outside Malaysia. Backups are encrypted (age) on our server before upload, so Google cannot read them. We do not choose the country of Google's data centres. By accepting this notice you are told of this cross-border transfer under section 129 of the PDPA.
• Payment gateway (BayarCash): to process FPX payments.
• WhatsApp: messages are sent through Klik's own WhatsApp gateway running on Klik's server (the whatsapp-web.js library, using Klik's WhatsApp number), then delivered by WhatsApp (Meta) outside Malaysia. This is not yet the official WhatsApp Business API. Until an official account is set up, the sender is a temporary Klik number. Data sent: your phone number, your first name, the company or organisation name, and the message text (for example a 6-digit verification code, an approval request, a summary with RM amounts, and a link to the app). No passwords or bank account numbers are sent. Klik's gateway log does not keep the message text and masks phone numbers. Your replies to that number are received by the same gateway. After a message from klikAkaun, there is no automatic reply for 30 days. After that, the gateway may send an automatic reply written by an AI model that runs on Klik's own server (not an outside provider). Do not send personal data in a reply.
• Your chosen AI provider: only if you switch the AI feature on, the following is sent directly to the AI provider you choose, using your own AI account (for example OpenRouter, Anthropic, OpenAI).
• AIRA chat: the text you type, the period or page you are looking at, and the figures and the names of accounts, funds and parties from your books that are needed to answer. Remark fields are removed. For "donor privacy" companies, names of people and IC numbers are removed too.
• Account suggestions for bank lines: direction, date, amount and the line description (up to 300 characters). IC numbers are masked if that setting is on or the company is "donor privacy". For "donor privacy" companies, bank lines are not sent.
• Reading of PDF bank statements the normal reader cannot read, only after you agree to a special notice: the statement text with the account holder name, account number, IC, card, phone and e-mail masked. Names of people or companies written inside a transaction description are not masked.
• Receipt reading, only if you switch it on and agree to the notice: the receipt picture (JPEG, no metadata). For "donor privacy" companies, receipt pictures are not sent.

That provider uses the data under its own terms and privacy policy. Some free models may log prompts or use them for training. You are responsible for that choice. We do not send this data to an AI provider unless you switch AI on.

• In-app support assistant (Anthropic): the question you type to the support assistant is sent as typed to Anthropic (outside Malaysia), using Klik's own Anthropic account, not your AI account. Klik pays the cost. Only the question text and the language are sent, together with our user guide. No name, company, books or account data is sent. The assistant answers from the guide only and cannot see or change your books. Do not type personal data in a question. The copy of the question in our support log has e-mails and long numbers removed. This is also a cross-border transfer under section 129 of the PDPA.
• E-mail: e-mails are sent from Klik's own mail server (Postfix), which relays them through Google's SMTP service (Gmail). Google therefore receives the recipient address and the content of the e-mail (for example invitations, password resets, approval requests). This is also a cross-border transfer.
• Cloudflare (Turnstile): the human check on the sign-up form, as described in section 1.
• Partners: if you were referred, the partner sees only your company name, package, payment status and the commission amount. The partner cannot see your books or financial data.
• Your auditor or company secretary: only if you invite them.
• Authorities: where the law requires.
• Klik staff: do not open your books in normal operations. The staff console shows only administrative information (account status, set-up steps, usage, backups, billing, internal notes) and sign-up applications, not the transactions in your books. If we need to see your books to help you, your account owner gives "Support access": read-only, for 24 hours or 3 days. Every page viewed is recorded, and you can see the log and withdraw the access at any time. Certain staff actions in the console (for example opening an application document) are recorded in the audit trail. Klik server administrators have technical access to the server where the data is stored. That access is used only for maintenance, backups and recovery.

4. Security

Controls we use:

• role-based access and separation of data between companies (tested);
• two-step sign-in (TOTP code) and passkeys that users can switch on, plus re-confirmation (password and code) before sensitive changes;
• second-person approval that each company can switch on (the person who prepared an item cannot approve it);
• AI account keys stored encrypted (AES-256-GCM);
• two-step secrets, ledger connection keys and some personal data (for example donor name, phone and IC, user phone numbers) encrypted in the database;
• uploaded documents and statements encrypted when stored;
• a hash-chained audit trail;
• HTTPS connections;
• encrypted backups (age).

The database and server disks as a whole are not encrypted at rest. Protection relies on the field- and file-level encryption above and on access control to the server. No system is 100% secure.

If a personal data breach happens, we will assess it and notify the affected people and the Personal Data Protection Commissioner as the law requires.

5. How long we keep it

6. Your rights

You may:

• ask for access to your personal data;
• ask us to correct wrong data;
• ask for a copy of your personal data in a usable format (data portability);
• withdraw consent or limit certain processing (with the effects we explain, for example we cannot run an account without basic data);
• make a complaint to us, or to the Personal Data Protection Commissioner.

Send requests to our data protection officer (section 9) by WhatsApp 011-1040 7107 or e-mail klik.innovations@gmail.com. We may verify your identity. We reply within 21 days. No fee is charged.

If your data is in a customer organisation's books, please contact that organisation first. We will help them.

7. Age

This service is for organisations and adult representatives. We do not target children.

8. Changes to this notice

We update this notice with a version and date. Major changes are sent by e-mail. Old versions are kept.

9. Contact

Data protection officer: MUHAMAD KAMAL SELAMAT, Klik Innovations Sdn Bhd. E-mail klik.innovations@gmail.com. WhatsApp 011-1040 7107. SSM number: 202201021984 (1467681-U). Postal address: 118G, Jalan Tiga, Batu Caves, Centrepoint, 68100 Batu Caves, Selangor.

AI insights are information only, not licensed financial, tax or legal advice.