Dokira Terms of Service

1. Parties and service

1.1 These terms are an agreement between Baloot MY Digital Agency ("we") and the organisation that signs up for Dokira (the "Customer"), and each user who uses an account under the Customer. By signing up or accepting an invitation you agree to these terms and confirm that you have read the Privacy Notice.

1.2 Dokira is an assistant tool that reads supplier invoices, receipts and bank statements, extracts data with AI, checks it with rules and prepares it for people to review, approve and export. Dokira consists of the Windows app, the iPhone and iPad app, the Android app, the website and our servers.

1.3 Dokira is offered in Malaysia only, for business purposes. To the extent the law allows, the Consumer Protection Act 1999 does not apply because Dokira is supplied for business.

1.4 These terms apply to the features available when you use them.

2. Accounts and organisations

2.1 Sign-up is on the website. The first user becomes the organisation's admin. Admins invite members, set roles and the clients they can see, and manage settings and the subscription. The Customer is responsible for the actions of the users it invites.

2.2 You must give true information, be 18 or over, and have authority to bind your organisation.

2.3 Keep your password and devices safe. A level-2 approval on a phone is signed with a device key that is locked with biometrics on that phone; on Windows it needs the Dokira password. Report unauthorised access to [email protected] at once.

2.4 Before the email is verified, an organisation can upload its first 10 documents only.

2.5 A sign-in session lasts at most 180 days. Each Windows PC needs a PC seat under the plan; a seat belongs to the organisation that activated it.

3. Trial

3.1 A new organisation gets a 7-day trial with 30 documents, no card, with the Professional plan's features and limits. There is no overage in the trial: documents beyond the trial limit are not processed.

3.2 If you subscribe during the trial, the subscription and the first charge start that day and the remaining trial days lapse.

3.3 When a trial ends without a subscription, the organisation gets 30 days of read-only access and can export approved data, then access is locked. Data is deleted 90 days after the trial ended; subscribing within that time restores access with the data.

4. Plans, prices and payment

4.1 Plans and prices at the date of these terms (the annual price equals 10 months):

The Firm plan has a fair use of 30 active users. The Pricing page shows current prices.

4.2 Tax. Prices exclude Sales and Service Tax (SST). If Baloot MY Digital Agency is registered for service tax, SST at the rate in force is added on top of the price and shown on the invoice.

4.3 Payment is made through Stripe on the website: by card (charged automatically each period) or by FPX through a Stripe invoice paid on Stripe's page each period. An FPX subscription takes effect once its first invoice is paid. We do not store card details. The phone apps sell nothing. Invoices are issued through Stripe; if e-Invoicing becomes mandatory for us, we issue e-Invoices as required.

4.4 Renewal. Subscriptions renew automatically each month or each year until cancelled. You can cancel at any time before the renewal date in the billing portal.

4.5 Plan changes. Upgrades take effect at once with a prorated charge for the rest of the period. Monthly to annual on the same plan is also immediate, prorated. Downgrades, and annual to monthly, take effect at the end of the paid period; there is no credit for unused annual months. If a downgrade leaves more users or PCs than the plan allows, admins have 14 days to deactivate the extra ones; then the least recently active are deactivated automatically.

4.6 Refunds. No refunds except for billing errors (for example a double charge or a wrong amount), which are refunded to the original payment method, and except in the cases in 8.5, 9.5, 12.6 and 13.5. There is no refund for the rest of a period after a cancellation, a downgrade or a "Delete organisation" request. This does not affect rights that cannot be excluded by law.

4.7 Failed payments. Stripe retries the payment; during the retries full access continues with a warning to admins. If every retry fails, the organisation gets 30 days of read-only access, then is locked until the invoice is paid. Data is kept as described in section 8 of the Privacy Notice.

5. Quota, overage and limits

5.1 Each plan has a document quota per billing period. Annual plans reset the quota every month. Bank statements count per page. Documents the AI marks as blurry, and duplicates detected after extraction, are not counted.

5.2 Overage: RM0.25 for each document beyond the quota, charged through Stripe. Each organisation has an overage cap per period (default in the table in 4.1); admins can set it between RM0 and RM2,000. When the cap is reached, new uploads are refused until an admin raises the cap, upgrades, or a new period starts. A multi-page bank statement that would exceed the cap is refused as a whole.

5.3 Daily AI limit: to control cost, an organisation's AI processing may be deferred to the next day when its daily spend limit is reached. Admins are notified.

6. Acceptable use

You must not:

• upload documents or data you have no right to process;
• upload malware, or try to get around limits, access controls or security measures;
• test Dokira's security other than as described in the reporting section of the Security page, or test against another organisation's data;
• reverse engineer Dokira, except as far as the law allows;
• use Dokira for fraud, money laundering or any unlawful activity;
• resell or share access to Dokira with anyone outside your organisation without our written permission;
• deliberately overload the service, for example with excessive automated uploads.

Files infected with a virus are refused and deleted at once, and admins are notified.

7. Customer data

7.1 Documents and data you upload remain the Customer's. The Customer allows us to process them only to provide Dokira.

7.2 The Customer makes sure it has a lawful basis to upload documents, including other people's personal data in them, and gives those people any notice required.

7.3 For personal data in documents we act as the Customer's data processor under section 8.

7.4 AI provider. Documents are processed by Anthropic (United States) as described in section 5 of the Privacy Notice. DeepSeek is switched off for the whole service. Before we switch it on we give 30 days' notice, and it is used only for organisations whose admin turns it on.

7.5 Retention and deletion follow section 8 of the Privacy Notice. Export your approved data before the subscription ends.

7.6 We may use aggregated usage data that identifies no Customer or individual (for example document counts, error rates and AI cost) to run and improve Dokira. This never includes document content.

7.7 We do not use Customer documents to train AI models, and we do not use them to test or improve our AI without the Customer's written agreement.

7.8 Staff access. The owner of Baloot MY Digital Agency, who runs the servers, has technical access to the database, file storage and logs, and uses it only to run, repair and protect the service, to answer a request from the Customer, or when the law requires it.

8. Data processing terms

This section is the data processing agreement between the Customer and us. It applies whenever we process personal data in the Customer's documents.

8.1 Roles. The Customer is the data controller, or a processor for its own clients; we are the processor, or a sub-processor. Subject matter: providing Dokira. Duration: the subscription and the deletion period. Nature of processing: storage, AI extraction, checks, approval and export. Data subjects: the Customer's staff, suppliers, clients' customers and individuals named in documents. Types of data: names, contact details, tax and registration numbers, identity card numbers on documents, bank accounts and transactions, and amounts.

8.2 Instructions. We process data only on the Customer's documented instructions: these terms, the settings the Customer chooses in Dokira, and written requests. We tell the Customer if we believe an instruction breaks the law.

8.3 Confidentiality. Everyone with access to the data is bound by a duty of confidentiality.

8.4 Security. We take the measures in section 10 of the Privacy Notice and on the Security page, and comply with the Security Principle of Act 709 as a processor.

8.5 Sub-processors. The Customer authorises the sub-processors on the sub-processor list. We tell admins by email at least 30 days before adding or replacing a sub-processor. The Customer may object in writing within that period. If we cannot address the objection, the Customer may end the subscription and we refund the prepaid fees for the unused period. We bind every sub-processor to data protection terms.

8.6 Transfers outside Malaysia follow section 7 of the Privacy Notice.

8.7 Assistance. We pass data subject requests we receive to the Customer within 5 working days, and help the Customer, as far as reasonable, to answer requests, assess risks and meet its breach notification duties.

8.8 Data breaches. We notify the Customer's admins without undue delay, with a target of 24 hours after a breach is confirmed, with what is known: the nature of the breach, the data and number of people involved, the likely consequences and the measures taken. We update that information as more becomes known.

8.9 Deletion at the end. After the subscription ends, the Customer has 30 days of read-only access to export approved data. Data is deleted 90 days after the subscription ends, and disappears from backups within 30 days (daily) and 12 months (monthly). We confirm the deletion in writing on request.

8.10 Information and audit. We answer a reasonable security questionnaire once a year and provide the information needed to show compliance with this section. We do not offer on-site audits.

8.11 This section applies without a signature. If your organisation needs a signed copy, email [email protected].

9. AI output and your responsibilities

9.1 AI output may be wrong or incomplete. Dokira is designed so that a person reviews and approves each document before data is exported; some errors block approval, and a changed supplier bank account always needs approval.

9.2 You are responsible for checking data, account codes, tax codes and amounts before approving, exporting, filing or paying.

9.3 Dokira gives no tax, accounting, audit or legal advice. Account code suggestions, tax rates and warnings are aids only. Tax rates in the system are provided for convenience and may be out of date; check them against official sources or with your accountant.

9.4 Dokira is not a records archive. The Customer remains responsible for keeping original documents and accounting records for as long as the law requires.

9.5 If we change Dokira in a way that significantly reduces a main function you pay for, we tell you 30 days ahead; if you do not agree, you may end the subscription and we refund the prepaid fees for the unused period.

10. Exports and e-Invoice

10.1 Approved data can be exported from the Windows app to Excel, CSV, and AutoCount and SQL Account import files. The AutoCount and SQL Account file layouts are being confirmed against the vendors' official import templates; check a file and test an import with sample data first.

10.2 Dokira does not issue or submit e-Invoices to LHDN. It reads the MyInvois QR code on supplier invoices. Checks against LHDN's system depend on that system being available and on the credentials the Customer provides.

11. Availability and support

11.1 We aim to keep Dokira available and take encrypted daily backups, but we do not guarantee uninterrupted service and make no service level commitment (SLA).

11.2 Planned maintenance is announced to admins by email where practical.

11.3 Support by email at [email protected], answered within 1 working day, Sunday to Thursday.

11.4 The apps need an internet connection; the Windows app can be used read-only offline for a limited time.

12. Cancellation, suspension and termination

12.1 Admins can cancel the subscription in the Stripe billing portal from the website; cancellation takes effect at the end of the billing period.

12.2 After a cancellation or suspension, the organisation gets 30 days of read-only access and can export approved data, then is locked. Extracted data is deleted 90 days after the subscription ends; subscribing again before then restores everything.

12.3 Delete organisation. An admin can request deletion in the Windows app or by email. The organisation becomes read-only and is deleted 7 days later; any admin can cancel within those 7 days. A paid subscription is not renewed and not refunded; the data is deleted after the paid period ends. Deletion is final.

12.4 Delete account. Each user can delete their own account (section 9 of the Privacy Notice).

12.5 We may suspend or end access: for non-payment (4.7); for a serious or repeated breach of these terms, after notice and 14 days to fix it where it can be fixed; or at once where the law requires it or to stop serious harm such as a security attack or fraud. Data is then handled as in 12.2.

12.6 If we stop offering Dokira altogether, we give at least 90 days' notice, time to export data, and a refund of prepaid fees for the unused period.

12.7 Sections 7, 8 (until the data is deleted), 9, 13, 14, 15 and 17 survive termination.

13. Intellectual property

13.1 The Dokira software, name, logo and documentation belong to Baloot MY Digital Agency. During the subscription we grant the Customer a limited, non-exclusive, non-transferable licence to use Dokira for its own business.

13.2 The Customer owns its data. We acquire no rights in Customer data beyond the permission in 7.1.

13.3 If you give feedback or suggestions, we may use them without any obligation to you.

13.4 Dokira uses open-source components under their own licences.

13.5 If we end a subscription because of a third-party claim that Dokira infringes intellectual property rights, we refund the prepaid fees for the unused period.

14. Confidentiality

Each party keeps the other's confidential information confidential and uses it only for this agreement. This does not apply to information that is public, already lawfully known, or that must be disclosed by law (with notice to the other party where allowed).

15. Liability and indemnity

15.1 To the extent the law allows, Dokira is provided "as is". We do not promise that AI output is accurate or complete, or that Dokira fits a particular purpose beyond what these terms state.

15.2 We are not liable for indirect or consequential loss, loss of profit, revenue or goodwill, or tax penalties, interest or surcharges arising from data you approve, export or file.

15.3 Our total liability for all claims relating to Dokira in any 12-month period is limited to the fees the Customer paid for Dokira in the 12 months before the event giving rise to the claim, or RM100 if the Customer has paid nothing yet (for example during the trial).

15.4 The limits in 15.2 and 15.3 do not apply to liability that the law does not allow to be limited, including fraud, wilful misconduct, and death or personal injury caused by negligence.

15.5 The Customer indemnifies us against third-party claims arising from documents or data uploaded without right, or from unlawful use of Dokira by the Customer's users.

15.6 Neither party is liable for delay or failure caused by events beyond its reasonable control, for example outages of internet or cloud providers, natural disasters or government action. The duty to pay fees already due is not affected.

16. Changes to these terms

These terms have a version number (their date); the accepted version is recorded. Important changes are announced by email to admins and on the website at least 30 days before they take effect. New prices apply from the first billing period after that 30-day notice. If you do not agree, you may cancel before the change takes effect; using Dokira after that date means you accept the change. Minor changes, or changes the law requires, may take effect sooner.

17. Governing law and disputes

17.1 These terms are governed by the laws of Malaysia.

17.2 If a dispute arises, contact us first at [email protected]; both parties try to settle it in good faith within 30 days.

17.3 If it is not settled, the dispute goes to the courts in Kuala Lumpur, Malaysia.

17.4 These terms are published in Bahasa Melayu and English. If the two differ, the Bahasa Melayu version applies.

18. General

• These terms, the Privacy Notice and the sub-processor list are the whole agreement about Dokira. For personal data, section 8 prevails over the other sections.
• If part of these terms is invalid, the rest remains in force.
• The Customer may not transfer this agreement without our written consent. We may transfer it to whoever takes over the Dokira business, with notice to admins.
• Notices to the Customer go to the admins' email; notices to us go to [email protected].
• Not enforcing a right is not a waiver of it.
• Apps downloaded from the App Store are licensed under Apple's standard EULA; these terms govern the Dokira service.

19. Contact us

Baloot MY Digital Agency, email [email protected].