Privacy notice
This privacy policy explains how KiraDulu Tech Solutions (MRI/BNR/707/2026), trading as KiraDulu ("we", "us"), collects, uses, discloses and protects your personal data when you use our website, web app and mobile apps (together, the "Services"). We process personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).
This public website does not create accounts or take payments. The descriptions of account, financial, billing and connected-service data below apply when you use the KiraDulu app.
1. Data we collect
- Account data: your name, email address, password and sign-in details.
- Google sign-in: if you sign in with Google, we receive your name, email address, profile photo and Google account ID.
- Gmail connection (optional): if you choose to connect your Gmail account, we receive your Gmail address, the permission you granted and the access tokens Google issues to us. See Google user data.
- Emails you send through KiraDulu: the recipients, subject, message and attached documents of emails you send from the Services, and the message and thread IDs Gmail returns when you send from your Gmail account.
- Financial data you provide: accounts, transactions, invoices, receipts, documents and related attachments.
- Business data: company details, customers, suppliers, tax registration numbers and e-invoicing information.
- Usage data: device, browser, IP address and how you interact with the Services.
- AI features: your chats, uploaded files, private memory notes, the records you choose to use with Kira AI, and its answers and draft suggestions. Chats and memory notes are private to their author within the relevant workspace.
- Billing data: your plan, billing name, email, address and tax ID, payment history and receipts. Card payments are processed by our payment provider, CHIP; we never receive or store your full card number or security code, only the card brand, last four digits and payment references.
- Usage and limits: counts of transactions you record and the Kira AI usage of each workspace, so we can apply plan allowances.
- Communications: messages you send us by email, WhatsApp or our contact form.
We receive data directly from you, from members you authorise within your workspace and from connected services you choose to use. Our hosting provider processes technical request data such as IP addresses and browser details to deliver and secure the website. Where an online contact form is enabled, Cloudflare Turnstile processes verification data to prevent spam.
The public landing site does not set advertising or analytics cookies. The application may use essential session and security cookies for sign-in and service operation. Connected services and anti-spam verification may also process technical information under their own policies.
2. How we use your data
- To provide, maintain and improve the Services.
- To extract information from uploaded documents and provide AI answers and drafts using your chats, private notes and records you choose to use with Kira AI. AI providers process this information on our behalf. This does not include Google user data.
- To submit e-invoices to LHDN MyInvois when you ask us to.
- To send emails, such as invoices and statements, from your connected Gmail account when you ask us to.
- To administer our own subscriptions when available, send service notices and respond to support requests.
- To keep the Services secure and to meet legal and regulatory obligations.
3. Sharing your data
We do not sell your personal data. We share it only with service providers who help us run the Services (such as hosting, email, payment and AI processing providers), with Google when you use Google sign-in or connect your Gmail account, with government authorities such as LHDN when you instruct us or the law requires it, and with members of your workspace according to the roles you assign.
Service providers may process information outside Malaysia. Where data is transferred overseas, we take steps to protect it in accordance with applicable data protection requirements. The categories of recipients include hosting and storage providers, email providers, AI processors for the AI features you use and our own subscription payment providers when paid plans become available.
4. Google user data
This section explains how we handle data we receive from Google when you sign in with Google or connect your Gmail account.
What we access
When you connect Gmail, we ask Google only for permission to send email on your behalf (the "gmail.send" scope). We cannot and do not read, search, list, change or delete your emails, and we do not access your contacts or any other mailbox content.
How we use it
We use this permission only to send emails that you start in KiraDulu, such as invoices, quotations and statements, from your own Gmail address. We never send email from your account without you choosing to send it.
Shared Gmail accounts
When you connect Gmail, you choose whether the account is private to you or shared with your workspace. If you share it, you allow other members of that workspace who have permission to send documents to send emails from that Gmail account through KiraDulu. They can only send the documents they choose to email; they cannot read your mailbox. You can make the account private or disconnect it at any time. If you leave the workspace or lose permission to send documents, we disconnect the Gmail accounts you connected to it.
Sharing and transfer
- We do not sell Google user data or use it for advertising.
- We do not transfer Google user data to anyone, except as needed to provide the Gmail sending feature you use, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after giving you notice.
- We do not use Google user data to develop, improve or train AI or machine learning models, and we do not send it to AI providers.
Human access
No one at KiraDulu reads Google user data unless you give us explicit permission (for example, when you ask for support), it is needed to investigate security issues or abuse, or the law requires it.
Storage and security
Access tokens are encrypted when stored, sent only over encrypted connections, and available only to the systems that send email for you.
Retention and deletion
We delete your Gmail access tokens when you disconnect Gmail, leave the workspace, or delete your account. Workspace owners and admins can also disconnect a shared Gmail account. Records of emails you sent through the Services are kept with your business records, as described in Data retention. You can ask us to delete them by emailing contact@kiradulu.com.
Revoking access
You can disconnect Gmail at any time in KiraDulu settings, or remove KiraDulu's access from your Google account permissions page.
Limited Use
KiraDulu's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.
5. Data retention
We keep your data for as long as your account is active and as needed to meet legal, tax and accounting record-keeping requirements. You can ask us to delete your account at any time. Gmail access tokens are deleted as described in Google user data.
6. Security
We use industry-standard measures to protect your data, including encrypted connections and access controls. No system is completely secure, so please keep your password safe and let us know immediately if you suspect unauthorised access.
7. Your rights
Under the PDPA you may request access to and correction of your personal data, and you may withdraw consent or limit how we process it. To make a request, email us at contact@kiradulu.com.
Providing contact details is voluntary, but we cannot reply without a way to reach you. Account and financial details are necessary only for the features that use them; optional connections such as Gmail are your choice. You may decline optional processing or contact us to exercise your choices. We may need to verify your identity before fulfilling a request.
8. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and, for significant changes, notify you by email or in the app.
9. Contact us
Questions about this policy? Email contact@kiradulu.com or call +60 11-2596 1120. Our business address is Lot 6158, Block Number 11, Kuala Baram Land District, 98000 Miri, Sarawak, Malaysia. You can also use our contact page.