Privacy Policy

Version 2.0 · Effective: 20 September 2026 · Last updated: 2026-07-17

This Privacy Policy explains how AC Premier Solutions PLT [LLP Registration No. 202404001780 (LLP0039272-LGN)], trading as IntBooks (“IntBooks”, “we”, “us”) collects, uses, discloses, and safeguards personal data when you visit intbooks.my or use the IntBooks application at app.intbooks.my (the “Service”). We operate from Kuala Lumpur, Malaysia. Our processing is governed by the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 (“PDPA”). Where you access the Service from the EU/UK, we additionally honour the GDPR rights described below.

1. Our two roles: controller and processor

• IntBooks as data controller. For Account Data (your name, email, organisation, role, authentication and billing records), marketing-site submissions, and usage telemetry, we decide the purposes and means of processing — we are the data controller and this Policy governs.
• IntBooks as data processor. For personal data inside your books — your customers, suppliers, employees, payroll — your organisation is the data controller and we process it only on your instructions to provide the Service. That processing is governed by our [Data Processing Addendum (DPA)], which applies automatically to every organisation. If you are an individual whose data appears in a customer’s books (for example, an employee of an IntBooks customer), please direct requests to that organisation first; we will assist them in responding.

2. Data we collect (as controller)

• Account data — name, email, organisation name, role, and authentication identifiers (provided directly or via Clerk SSO).
• Payment data — handled by Stripe and BillPlz; we retain only payment status, plan, and invoice IDs, never card numbers.
• Legal acceptance records — when you accept our Terms of Service, this Policy, or other required documents, we record the document version and content fingerprint, your user ID, the date and time, your IP address, and browser user-agent. We keep these records to evidence the agreement between us (Electronic Commerce Act 2006) and they are retained for the life of the account plus limitation periods.
• In-app usage telemetry — pages viewed, feature events, error logs, IP and user-agent, used to operate and improve the Service. We do not sell this or share it with advertisers.
• Edge request logs — Cloudflare records request metadata (IP, URL, user-agent, response code) for security and operations; retained up to 30 days at the edge.
• Marketing-site forms — waitlist and contact submissions (email, role, industry, revenue band, name, phone, company, message) plus IP and user-agent for fraud prevention and rate-limiting; delivered via Resend (US).
• Marketing-site chatbot — messages are processed transiently by Cloudflare Workers AI (Meta Llama) to generate a reply and are not persisted server-side. Do not paste personal or financial data into the chatbot.
• Cookies — the marketing site sets only strictly-necessary cookies (Cloudflare bot mitigation); the app sets a Clerk session cookie on sign-in. Full inventory: [Cookie Policy].

3. How we use personal data

• To provide the Service and your contracted features, and to administer accounts and billing.
• To meet Malaysian regulatory obligations (LHDN MyInvois e-invoicing, SST, EPF/SOCSO/EIS/PCB submissions) on your organisation’s instruction.
• To evidence contract formation and acceptance of legal documents.
• To communicate operationally (service notices, security alerts, changes to legal terms).
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To improve the product through aggregated, de-identified analytics.

We process personal data on the bases the PDPA recognises: performance of our contract with you, compliance with legal obligations, your consent (where we ask for it), and our legitimate operational needs consistent with the PDPA’s principles.

4. AI and your data

IntBooks uses AI in clearly separated ways:

1. AI features in the app (document/receipt extraction, transaction-category suggestions, the in-app assistant) are powered by third-party LLM providers, currently including Anthropic (Claude) and Google. Our provider agreements prohibit training on your inputs. AI output is advisory — review it before posting to the ledger or filing returns. You can disable AI features per organisation in Settings → AI Features.
2. Marketing-site chatbot — transient processing on Cloudflare Workers AI, not retained by us.
3. AI-improvement consent (opt-in only). We do not use your organisation’s data to improve or train our own AI models unless your organisation gives a separate, specific, informed consent that names this exact purpose — improving IntBooks’ document-extraction, transaction-coding, and matching models — given by an authorised administrator via an explicit opt-in control. This consent is: never bundled into the Terms of Service or this Policy; recorded (who, when, which wording); withdrawable at any time in Settings → AI Features with effect for future use; and honoured with anonymisation — personal data is anonymised or removed before any content is used for improvement, and opted-out organisations’ data is used only for that organisation’s own features.
4. No solely-automated decisions with legal effect. We do not make decisions producing legal effects on you by wholly automated means.

5. Disclosure and sub-processors

We disclose personal data only: to the sub-processors listed at intbooks.my/sub-processors (vendor, scope, region — admins are emailed at least 30 days before we add a sub-processor that processes customer data); to statutory bodies on your organisation’s instruction (e.g. LHDN); where required by law or lawful demand (with notice to you where lawful); and in a merger or acquisition, under confidentiality and with notice. We do not sell personal data.

6. International transfers (PDPA s.129)

Our primary infrastructure is hosted with Hetzner in Germany, with edge services (Cloudflare) and certain sub-processors operating globally (including the US for email delivery and AI providers). Where personal data is transferred outside Malaysia, we rely on the bases in amended s.129 PDPA and the Personal Data Protection Commissioner’s Cross-Border Personal Data Transfer Guidelines: transfer to jurisdictions whose laws are substantially similar to the PDPA or which ensure an adequate level of protection (Germany, as an EU/GDPR jurisdiction, meets this standard), and otherwise contractual safeguards obliging the recipient to protect the data to PDPA standards, or your consent where sought. EU/UK-origin data is covered by Standard Contractual Clauses where required.

7. Retention

On account closure we de-identify usage telemetry within 90 days; statutory business records are retained for their legal period, then securely deleted. You may export your data at any time and for 30 days after termination (Terms §6.3).

8. Your rights

Under the PDPA (as amended) you may: access a copy of your personal data; correct inaccurate or incomplete data; withdraw consent to processing based on consent (including the AI-improvement consent); port your data — we provide CSV/JSON export of every module, and will transmit directly to another controller where technically feasible (PDPA data-portability right); and complain to the Personal Data Protection Commissioner / JPDP, or your EU/UK supervisory authority. Send requests to dpo@intbooks.my — we respond within the periods the PDPA prescribes (generally 21 days for access requests). We may need to verify your identity, and where you appear in a customer’s books we will route the request via that controller.

9. Security and breach notification

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Production access is restricted to named engineers under MFA with audit logging; tenant data is isolated by row-level security. In the event of a personal-data breach we will: notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours of becoming aware of a notifiable breach; notify affected users and organisation admins within 7 days of the Commissioner notification where the breach is likely to cause significant harm, by email and in-app notice; and keep records of all breaches and remediation. Report suspected vulnerabilities to security@intbooks.my.

10. Children

IntBooks is a B2B service, not directed at children under 18. We do not knowingly collect children’s data; if you believe a child has submitted data, email dpo@intbooks.my and we will delete it. (Employee data of working-age minors inside a customer’s payroll is processed under the customer’s controllership per §1.)

11. Changes to this Policy

Material changes are notified to account admins by email and in-app at least 30 days before taking effect, and — like the Terms — require your affirmative re-acceptance in-app where they materially affect your rights. Each version carries a version number and effective date; the version you accepted is recorded.

12. Data Protection Officer and contact

We are in the process of appointing a Data Protection Officer as required by the PDPA (as amended). Data-protection enquiries and requests are handled through the contact points below.

• DPO / data-protection requests: dpo@intbooks.my
• General: hello@intbooks.my · Security: security@intbooks.my
• Postal: AC Premier Solutions PLT (trading as IntBooks) [LLP Registration No. 202404001780 (LLP0039272-LGN)], No. 13, Jalan Eco Forest 3/2D, Eco Forest, 43500 Semenyih, Selangor, Malaysia