Legal

Privacy Policy

Last updated: 2026-09-30

Data we collect

•Account: email, name, saved language preference for app and transactional emails, hashed password (or OAuth provider identifier).

•Shop: TIN, BRN, MSIC code, address, contact details, LHDN client credentials (AES-GCM encrypted at rest).

•Invoices: full e-invoice data submitted to LHDN, including buyer TIN, IC (masked in logs), totals, items.

•Usage: session metadata, IP address, user agent (90-day retention). On the marketing pages, Cloudflare Zaraz counts events such as demo plays, plan clicks and enquiry topics, with the page language. It sets no cookies, and form entries and contact details are never included. It does not run inside the app or the customer request portal.

•Enquiries: name, email and what you tell us through the contact form or help chat (such as your current system, invoice volume and message).

How we use it

•Submit invoices to LHDN MyInvois on your behalf using your registered ERP credentials.

•Send transactional emails (verification, password reset, pace warnings, billing notifications) in your saved language where available.

•Show your usage analytics on the dashboard.

•Measure aggregate visits to marketing demos, pricing choices and successful enquiries so we can improve the site.

•Reply to and follow up on enquiries you send through the contact form or help chat.

Data retention

Invoice data is retained for 7 years per Malaysian tax law. Logs and session metadata: 90 days. Cancelled subscriptions retain data until the account is deleted by the user. Enquiries are kept while we are in contact with you and deleted on request to privacy@envoice.my.

Your rights (PDPA 2010)

Under the Personal Data Protection Act 2010 (PDPA 2010, Malaysia) you have the right to access, correct, and delete your personal data.

•Export: Download a copy of your data from Account Settings or email privacy@envoice.my.

•Delete: Go to Account Settings and use the Delete Account option. Invoice records are retained for 7 years per Malaysian tax law; all other personal data is removed immediately.

•Correct: Update your name and contact details directly in Account Settings. For shop/TIN corrections, contact privacy@envoice.my.

•For B2B data processor obligations, see our Data Processing Agreement.

Third parties (processors)

We share data only with processors that help us run the service: LHDN MyInvois (invoice submission), Stripe (card payments and subscriptions), Resend (transactional email), Cloudflare R2 (PDF storage) and Cloudflare (content delivery and marketing-site analytics), Vultr in Singapore (application and database hosting), Sentry (error monitoring), and Anthropic (answers to help-chat questions). We never sell your data or share it for marketing.

International transfers

Some processors above operate outside Malaysia (for example, application and database hosting in Singapore, and email, monitoring, and payment services in the US or EU). Where data is transferred abroad it is protected by the processor’s contractual data-protection commitments.

Data Protection Officer

Our Data Protection Officer oversees PDPA compliance and handles data-related requests and complaints. Contact the DPO at privacy@envoice.my.

Data breaches

If a personal-data breach likely to cause significant harm occurs, we will notify the Personal Data Protection Commissioner and any affected individuals without undue delay, in line with the PDPA.

Not affiliated

This service is not affiliated with or endorsed by LHDN. We are an independent tool to help you comply with their e-invoice mandate.