Dokira Privacy Notice

1. Who we are

Dokira is software that reads supplier invoices, receipts and bank statements and prepares accounting data for people to review and approve. Dokira is sold and operated by Baloot MY Digital Agency (www.baloot.my). In this notice, "we" means Baloot MY Digital Agency.

• Email: [email protected]
• Data Protection Officer: the owner of Baloot MY Digital Agency, at the same email (write "PDPA" in the subject).

This notice covers the Dokira website, the Windows app, the iPhone and iPad app, the Android app and the Dokira servers.

2. Our two roles

Act 709 distinguishes the party that decides why data is used (the data controller) from the party that processes data on someone else's behalf (the data processor).

• We are the data controller for data about you as a user or visitor: account, sign-in, devices, consents, billing, support, security, website forms and visitor statistics.
• We are a data processor for personal data inside the documents your organisation uploads, for example names and tax numbers of sole-proprietor suppliers, names on receipts or transactions in bank statements. For that data your organisation (the accounting firm or company) is the data controller. We process it only to provide Dokira to that organisation, on its instructions and settings, under the data processing terms in the Terms of Service.
• When an accounting firm uploads its clients' documents, the firm processes the data on behalf of its clients and we are a sub-processor. The firm and its clients are responsible for informing the people named in those documents, for example suppliers. We do not contact them.

We never share data between organisations. Every request to the server is limited to the user's own organisation.

3. Data we collect

3.1 From you

3.2 Automatically while you use Dokira

• Sessions and devices: platform, device name, random install id, app version, last seen time, and the IP address and user agent of each sign-in session. On Windows: a keyed hash (HMAC) of the hardware id for the PC licence, never the raw id. On phones: the Apple or Google push token and the public key of the device approval key.
• Organisation audit trail: who did what and when (sign-ins, approvals, changes to settings and documents), including the IP address of the request.
• Technical logs: random ids, error codes and times. Logs are filtered so that they contain no document content, TINs, bank account numbers, email addresses or tokens.
• Usage: documents and pages counted for quota and billing, and the AI cost of each document.

We do not collect location (GPS data in photos is removed on the phone before upload), contacts, microphone, advertising ids or biometric data. Face ID, Touch ID and fingerprint run inside the phone's system; we only receive a signature from a device key that is locked with biometrics on that phone.

3.3 Documents your organisation uploads

Invoices, receipts, credit notes and bank statements (PDF or images) and the data extracted from them: supplier name, registration no., TIN, SST no., address, supplier bank account numbers, the last 4 digits of cards, line items, amounts and bank transactions. These documents can contain other people's data, for example sole-proprietor suppliers, staff or clients' customers, including identity card numbers on receipts. We do not ask for sensitive personal data such as health information, but some receipts may show it. All document content is protected with the same measures.

3.4 From others

• Stripe tells us the subscription and payment status and a payment method label (for example the card brand and last 4 digits). We never receive full card numbers.
• Your organisation's admin may invite you with your email and set your role and the clients you can see.

3.5 Website visitors and forms

• Visit statistics without cookies: for each page viewed we store the date, the page address (without parameters), the campaign source or referring site, the country (two letters, from Cloudflare), the language, the device class (from the screen width) and a daily visit code. The code is computed from the IP address and user agent with a random daily key that is deleted after 2 days, so it cannot be recomputed and does not follow you from one day to the next. The IP address and user agent themselves are not stored.
• Do Not Track and Global Privacy Control: if your browser sends either signal, no visit or click is recorded. Known bots are not counted either.
• Clicks on app store links: the date, the store chosen and the same daily visit code.
• Interest form: email, nickname (optional), organisation kind, accounting system, documents per month, whether you want a demo, the plan you looked at, language, the notice version you accepted and the time of consent.
• Contact form: name, email, message, language, notice version and time of consent.
• Both forms use Cloudflare Turnstile to stop bots (section 13).

4. What we use data for

We do not sell personal data, do not use it for advertising and do not use third-party analytics tools.

5. AI processing

• Only our servers contact AI providers. AI keys are never in any app.
• Our AI provider is Anthropic (Claude models, United States). Anthropic receives page images of scans and photos, and the text of digital PDF documents, to read and classify documents and suggest account codes.
• Before text is sent, bank account numbers, MyKad numbers and payment card numbers in the text are replaced with placeholders such as [ACC_1], [NRIC_1] or [CARD_1] that carry no digit at all. Our server puts the real numbers back after the answer arrives; card numbers are kept as the last 4 digits only.
• Limits you should know: (a) page images (scans and photos) are sent to Anthropic unchanged, so whatever is printed on the page, including account and MyKad numbers, reaches Anthropic in the image; (b) names, addresses, phone numbers, emails, TINs and registration numbers are not hidden because they must be read; (c) numbers are detected by their label and shape, so a number printed without a recognisable label or shape may be sent as printed.
• No other AI provider receives your data. Dokira can use DeepSeek (China) for the text of digital PDFs, but this feature is switched off for the whole service. Before we switch it on, we will update this notice, tell admins at least 30 days in advance, and use it only for organisations whose admin chooses to turn it on. While the feature is off for the whole service, the DeepSeek switch in an organisation's settings sends nothing to DeepSeek, even if the switch shows as on.
• Anthropic's commercial terms do not allow Anthropic to train its models on the data we send through its API. Anthropic keeps API inputs and outputs for the limited period stated in its terms.
• We do not use your documents to train AI models, and we do not use them to test or improve our AI unless your organisation agrees in writing.
• AI output is a suggestion. People in your organisation review and approve each document before data is exported.

6. Who receives data

We use providers (sub-processors) that process data on our behalf, only for the purposes in the table below and under their data protection terms.

Sub-processor list

• LHDN (MyInvois): when your organisation turns on e-Invoice checks with its client's MyInvois credentials, the e-Invoice identifiers from the document are sent to LHDN for checking, on your organisation's instruction.
• The law: we disclose data when the law, a court order or a lawful authority requires it, and only as far as required.
• App stores: Apple, Google and Microsoft process your store account under their own privacy policies; we do not send Dokira account data to them.
• Staff access: we have no team that can open your organisation through the apps. The owner of Baloot MY Digital Agency, who runs the servers, has technical access to the database, file storage and logs. That access is used only to run, repair and protect the service, to answer a request from you or your organisation, or when the law requires it. We do not open the content of your documents for any other purpose. Owner reports (for example subscription and usage totals) read aggregate numbers only, and every read is recorded.

7. Transfers outside Malaysia

The database and application server are in Kuala Lumpur, Malaysia. The following data is transferred outside Malaysia: document files (Cloudflare R2 with an Asia-Pacific location hint, which does not guarantee the data stays in Malaysia), AI processing (Anthropic, United States), email (Hostinger's mail servers, which may be outside Malaysia), billing (Stripe), the website, website statistics and forms (Cloudflare), push notifications (Apple and Google) and, if enabled, error reports (Sentry, European Union).

We transfer data only where section 129 of Act 709 allows it: the transfer is necessary to perform the contract with you or your organisation, and we have taken reasonable precautions and exercised due diligence. This means we choose providers bound by data protection and security terms, send only the data that is needed, and hide account, MyKad and card numbers in text before it goes to AI. We keep a record of these transfers: the sub-processor list and dated copies of the providers' terms.

8. How long we keep data

Dokira is not a records archive. Your organisation is responsible for keeping its own original documents and accounting records for as long as the law requires, for example 7 years for tax records. Export your approved data before the subscription ends. After deletion we keep no copy, except in backups for the periods above.

9. Your rights

• Access: ask for a copy of your personal data.
• Correction: correct inaccurate data. You can change your name and phone yourself; anything else by email.
• Withdraw consent: for example marketing consent. If you withdraw consent for data the service needs, we can no longer provide Dokira to you.
• Stop direct marketing: at any time, through the link in the email or by emailing us.
• Stop processing likely to cause damage or distress: by explaining the reason to us.
• Data portability: ask for your account data in a machine-readable format (JSON), or for it to be sent to another data controller where technically feasible. Your organisation can also export its accounting data to Excel and CSV.
• Delete your account: yourself, in the app or on the website.

How to delete your account: in the app (Account, then Delete account on iPhone, iPad and Android; Settings, General, My account on Windows) or on the website after signing in. If you cannot sign in, email us from your account address. The account's personal data is removed at once, all sessions end and memberships are removed; documents you uploaded stay with the organisation. If you are the last admin of an organisation that still has other members, appoint another admin first. If you are the only user, the organisation is scheduled for deletion after 90 days.

How to delete your account and data

How to delete an organisation: an admin can request "Delete organisation" in the Windows app (Settings, Data privacy) or by email. The organisation becomes read-only and is deleted after 7 days; any admin can cancel within those 7 days. A paid subscription is not renewed; the data is deleted after the paid period ends.

Other requests: email [email protected] from your account address. We check your identity before acting, charge no fee and reply within 21 days. If we need more time, we tell you why and reply within a further 14 days. If we refuse a request, for example because your identity cannot be confirmed, we give the reason in writing.

Data inside organisations' documents: if you are not a Dokira user but your data is in our customer's documents (for example you are a supplier), contact that organisation. If you contact us, we pass your request to the organisation within 5 working days and help it answer.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Commissioner of Malaysia (Department of Personal Data Protection, www.pdp.gov.my).

If you do not provide data: without an email and password we cannot open an account. Without accepting the terms and this notice you cannot use Dokira. Website forms and marketing consent are optional.

10. Security

• Connections are encrypted (TLS). The server opens no public ports; traffic comes in through Cloudflare Tunnel.
• Each organisation's data is kept separate, and automated tests check this separation.
• Bank account numbers, MyInvois credentials, individuals' TINs and identity numbers are encrypted at column level. Backups are encrypted.
• Every file is scanned for viruses before processing. Logs are filtered so that they contain no document content.
• Sign-in tokens are kept in the Keychain (iPhone and iPad), Android's key-protected storage and DPAPI (Windows).

No system is completely secure. We do not claim any security certification.

Security details

11. Data breaches

• Data we control: if a breach causes or is likely to cause significant harm, we notify the Commissioner as soon as practicable and no later than 72 hours, and notify you without unnecessary delay, no later than 7 days after notifying the Commissioner.
• Data inside organisations' documents: we notify your organisation's admins without undue delay, with a target of 24 hours after the breach is confirmed, with the information the organisation needs to notify the Commissioner.
• We record every breach in a register kept for at least 2 years.

12. Children

Dokira is a business tool for adults. You must be 18 or over to open an account. We do not knowingly collect children's data for accounts. Customer documents may name individuals of any age; that is the customer organisation's data.

13. Website, cookies and browser storage

• The Dokira website itself sets no cookies and uses no advertising or third-party analytics tools.
• Visits are counted without cookies as described in section 3.5, and nothing is recorded under Do Not Track or Global Privacy Control.
• Your browser keeps your theme and language choice in local storage (localStorage).
• On account pages, your sign-in session is kept in the tab's session storage (sessionStorage) and disappears when the tab is closed. After sign-up your email is kept there briefly for the next page.
• On the sign-up page and the forms, Cloudflare Turnstile is loaded to tell people from bots. Turnstile checks signals from your browser and your IP address; Cloudflare describes how it handles them in its own privacy policy.
• The Dokira web server in Kuala Lumpur keeps request logs, including IP addresses, for a short period.

14. Data Protection Officer

Our Data Protection Officer is the owner of Baloot MY Digital Agency. Contact them at [email protected] with "PDPA" in the subject. The appointment is registered with the Commissioner when Act 709 requires it.

15. Changes to this notice

This notice has a version number (its date). The version you accept is recorded. For important changes we tell you by email or in the app at least 30 days before they take effect. If a change needs fresh consent, for example a new purpose, we ask for your consent first. Earlier versions are available by email.

16. Language

This notice is published in Bahasa Melayu and English. If the two differ, the Bahasa Melayu version applies.

17. Contact us

Baloot MY Digital Agency, email [email protected].