Privacy Notice

This notice explains what personal data iBDS processes, why, to whom it is disclosed, how long it is kept and your rights under Malaysia's Personal Data Protection Act 2010 (PDPA). This text is a draft and is not legal advice.

1. Who is responsible

• iBDS is online software that companies use to create and send quotations, invoices, receipts, credit notes and debit notes.
• A company's customer data: the company using iBDS is the data user for its own customers' data (for example customer names, addresses and documents). iBDS processes that data on the company's behalf. If you are a customer of such a company, contact that company first about your data.
• The operator of iBDS is [operator name — not yet set]. The operator is the data user for iBDS user account data (name, email, sign-ins) and processes it to provide the service.

2. The data we process

• Account: name, email address, password (stored as a hash, never the text itself), preferred language, and two-factor authentication settings if you turn it on (its secret is stored encrypted).
• Sign-in history: the time, IP address and browser (user agent) of your 50 latest sign-ins and 50 latest failed attempts. Signed-in sessions also store the IP address and browser.
• Company data: the company profile, bank accounts for payment instructions, members and their roles, and settings.
• Data entered by the company: customers (name, company, email, phone, address, registration number, TIN, identification number and notes), the catalogue, documents, payments, statements, recurring invoices and records of emails sent.
• Uploaded files: the company logo, and old invoice files for the historical import (PDF or images).
• Audit log: a record of changes in the company, including who made them, the IP address and browser.

Required and optional: a name, email address and password are required to create an account; without them you cannot use the service. Two-factor authentication, the company logo and the historical import are optional.

3. Why we process data

• To provide the service: creating, keeping, sending and sharing the company's documents.
• For security: sign-in, two-factor authentication, sign-in history and the audit log.
• To send the emails you or your company ask for, and account security notices.
• For AI features, only when they are switched on and you use them (see section 4).

We do not sell data and do not use it for advertising.

4. To whom data is disclosed

• The AI provider (OpenAI): only when AI features are switched on and used.
  • "AI generate" for default texts, document notes and catalogue descriptions sends the company's trading name and business activity, item names, types, units and quantities, and the default terms (with numbers masked). It does not send customers' names, addresses or contact details, and apart from the price suggestion (below), no prices. Item names, types and units are sent as typed, so do not put customer details in them.
  • "AI generate" for a price suggestion sends your company's business activity and document language, the item's name, type and unit, the line quantity, and your company's own price figures for that item (latest, lowest, highest and average price, the number of sales, and the chosen customer's last price and its date). It does not send customers' names, addresses or contact details, or document numbers.
  • Expense receipt reading sends the receipt file itself (which may show the names and details of the seller or buyer) to OpenAI to be read, only after you tick your consent for each receipt. iBDS asks the provider not to store the answer. The receipt is kept with the expense only when you click Save; a receipt that was read but not saved is deleted within a day.
  • The historical import sends the uploaded document itself, with the customer's name, address and prices on it, to OpenAI to be read. This happens only after you tick your consent for each upload. iBDS asks the provider not to store the answer. Under the provider's API terms, data is not used to train AI models, though the provider may keep it for a limited time to check for abuse.
  • The AI provider may process data outside Malaysia.
• The email provider: when sending email is switched on, for documents and reminders to customers, statements, invitations, password resets, email verification and security notices. The email provider may also process data outside Malaysia.
• Meta (WhatsApp): when you link your WhatsApp number and use the Assistant on WhatsApp, your messages to the iBDS WhatsApp number and iBDS's replies are processed by Meta (WhatsApp Business Platform), which may process them outside Malaysia. iBDS keeps those messages for 180 days. iBDS does not send WhatsApp messages to the company's customers.
• Operator staff (platform admins): may view company data for support and administration. Their actions are recorded in that company's audit log.
• Hosting and network providers: data is kept on servers operated for iBDS, and traffic passes through a network provider.
• The company's customers: when the company emails a document or shares a document link.

5. Cookies

iBDS uses only the cookies it needs to work: the sign-in session cookie, the CSRF protection cookie, and a "Remember me" cookie if you choose it when signing in. There are no analytics or advertising cookies and no third-party scripts. The shared-link pages for customers set no cookies.

6. How long data is kept

• Account, company and document data is kept while the account or company exists. The audit log is kept with the company's data.
• Backups are made daily; by default the 14 latest backups are kept (about 14 days). Data and files that are discarded or deleted, including historical import files, remain in older backups until those backups are replaced.
• Historical import files are kept until you discard the entry.
• In-app notifications are deleted after 90 days.
• Sign-in history: the 50 latest sign-ins and the 50 latest failed attempts per user.
• Shared links expire after 30 days.

7. Security

Passwords are stored as hashes. Two-step verification is available. Connections use HTTPS, with CSRF protection, a content security policy (CSP) and sign-in attempt limits. Each company's data is kept apart from other companies, uploaded files are kept in private storage, and changes are recorded in the audit log.

8. Your rights

• You can ask to access your personal data, correct it, limit its processing or withdraw consent.
• You can change your name and language in My account. Your email address cannot be changed by yourself yet; ask for a change through the contact below. A company's owner can download the company data export in Company settings.
• Deletion requests can be made through the contact below.
• For a company's customer data, contact that company, as it is the data user. For other requests, use the contact below.
• Consent for the historical import is given per upload; you can stop uploading at any time.

9. Changes to this notice

Each version is dated. When a new version is published, you will be asked to accept it in My account.