Privacy policy

1. Who we are

AGENTICA TECHNOLOGY is a business registered in Malaysia, based in Kuala Lumpur, Malaysia. For any question about your personal data, contact our data protection officer at hello@agenticatech.my.

2. Personal data we collect

We collect only what we need to run the Service:

• When you contact us: your name, your email address or phone number, and what you write.
• Your account: the name and email address from your Google sign-in, your business details (such as address, phone, SSM, SST and TIN numbers), your plan and billing status, and, if you connect it, your MyInvois client ID and secret (the secret encrypted).
• Your business records: invoices and customers, receipts, bills and receipt photos, suppliers, products and stock, and staff records and payslips, including staff IC, bank account and income tax numbers.
• Your counter: sales and orders from your cashiers, kiosk and table QR, the notes customers add to their orders, and the email address a customer gives for a receipt.
• Staff tax and leave details you enter: marital status, children, disability, zakat, a previous employer's pay this year, leave taken, claims and advances.
• Clock-in: when each staff member clocks in and out, from the QR on your clock-in screen or as you enter it. The clock-in page asks for no sign-in and no location. A staff member's phone remembers only which name was tapped on it last.
• Telegram: your chat with your own bot, and the bot's token.
• Website use: a random number your browser keeps, the pages and sections seen, the buttons pressed, and where the visit came from. We do not record your IP address or browser details for this.

3. Why we use it

• To provide the Service: make quotations, invoices, receipts, credit and debit notes, payslips and EA forms, record clock-in hours, work out PCB and leave, keep stock, prepare your accounts, remind you of payments and deadlines, and show your figures.
• To set up your account and connect your Telegram bot.
• To bill you for your plan.
• To reply to you when you contact us.
• To keep the Service secure, fix problems, and improve it.
• To meet our legal duties, for example tax records.

We do not sell personal data. We do not use it for advertising, and we do not add you to a mailing list without asking.

4. Data you enter about other people

When you enter your customers' or staff's details (for example on an invoice or a payslip), you are the data user for that data under the PDPA, and we process it only on your instructions to provide the Service.

You are responsible for having a lawful reason to give us that data and for telling those people how you use it.

Some staff details are sensitive personal data under the PDPA: disability (for tax relief), sick and hospitalisation leave, and zakat. Enter them only with the staff member's explicit consent. We use them only to work out PCB and leave, and to print payslips and EA forms.

5. Who we share it with

We share personal data only with service providers who help us run the Service, and only as much as each one needs:

• Hosting and database: Vercel and Supabase. Our database and servers are in Singapore.
• Sign-in: Google.
• Payments: CHIP (chip-in.asia). We do not see or keep your full card number.
• Email: Resend, to send the receipts your customers ask for, with the receipt attached as a PDF.
• Telegram, to deliver your agent's messages and documents to your phone.
• LHDN (Inland Revenue Board of Malaysia), if you connect MyInvois: the e-invoices you submit, with your business's and your customer's details on them.
• AI model providers, through OpenRouter (today, OpenAI's models), to understand your messages to agenticaAI and read receipt photos and bills. Only what a question or a photo needs is sent.

6. Data sent outside Malaysia

Our database and servers are in Japan, and some of our service providers store or process data elsewhere outside Malaysia, including in Singapore and the United States. We use providers that protect personal data to a standard at least as strict as the PDPA requires.

7. How we protect it

• All traffic to the Service is encrypted (HTTPS).
• Staff IC numbers, bank account numbers and Telegram bot tokens are stored encrypted. Screens and payslips show only the last four digits; the EA form, which LHDN requires to carry the full IC number, is the exception.
• Documents are kept in private storage. You open them from your dashboard through links that stop working after five minutes.
• The database itself keeps each business's records apart, so one business cannot reach another's.
• Only the people who run agentica can reach the database.

8. How long we keep it

We keep your account data while your account is open. Invoices, receipts, payroll, leave and clock-in records are kept for seven years, as LHDN requires for business records, unless you delete them first.

If you close your account and ask us to delete your data, we do so within 30 days, except what the law requires us to keep.

9. Cookies and tracking

The website sets no advertising cookies and loads no third-party analytics or advertising scripts. The dashboard uses a sign-in cookie so you stay signed in. The random number described in section 2 stays in your browser and can be cleared at any time.

10. Your rights

Under the PDPA you can:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is wrong or incomplete.
• Withdraw your consent, or ask us to stop or limit using your data. If you do, we may not be able to provide the Service.
• Ask us to delete your data.

11. How to ask

Email hello@agenticatech.my. We reply within 21 days, as the PDPA requires, and usually much sooner. We may ask you to confirm who you are first.

12. Children

The Service is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data.

13. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change is significant, we will tell customers by email or in the dashboard before it takes effect.

14. Language

A Bahasa Malaysia version of this policy is available on request. If the two versions differ, the English version applies.