About this notice
This Privacy Notice (version 2026-11-01) explains how CukaiSifu, operated by J & A APP STUDIO PLT (202604002661 (LLP0047906-LGN)), Klang, Malaysia ("we"), processes personal data, as required by the Personal Data Protection Act 2010 (as amended in 2024). A Bahasa Malaysia version follows the English one. In short: your data stays in your own account, is not sold, is not used for advertising, and is not used to train AI models.
What we collect
(1) Your account: email address, sign-in provider, and the name, firm and tax agent number you enter. (2) What you put in for your clients: client records, reminders, notes, documents, photos, PDFs, spreadsheets, financial figures, tax computations, voice notes, meeting recordings, transcripts and notes. (3) If you connect a mailbox (Gmail, Microsoft 365 or Outlook, or IMAP): sender, subject, date and a short snippet of messages that match the statutory filter, and drafts you choose to create. An IMAP password stays on your phone only. (4) Records that protect you and us: the versions of these documents you accepted and when, the meeting-recording confirmations you give, the proposals Sifu made beside what you saved, and a log of AI requests (time and feature). (5) Subscription status from Google Play, through RevenueCat. We never receive your card or bank details. (6) Basic technical data: app version and platform.
Why we use it
To provide the service you ask for: generating deadlines, reading what you capture, transcribing and summarising meetings, estimating tax, preparing reports, answering questions and sending you reminders; to manage your subscription; to keep the service secure and within fair use; to answer questions, complaints and claims about it; and to meet legal obligations. Providing account details is required to use the app; everything else is up to you.
Who we share it with
Only the providers needed to run CukaiSifu, each processing data only to provide its part: Supabase (database, file storage and server functions), Google (the Gemini AI service that reads and summarises files, voice and meetings; Gmail, if you connect it; and Google Play billing), Microsoft (Outlook mail, if you connect it) and RevenueCat (subscription status). We do not sell personal data or share it for advertising. We may disclose data if the law requires it.
Google and Microsoft mail data
CukaiSifu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Mail read from Gmail or Microsoft is used only to show you statutory mail and propose reminders and drafts in the app; it is not used for advertising, not sold, not used to train AI models, and not read by people unless you ask us to look at a problem, it is needed for security, or the law requires it.
Transfers outside Malaysia
These providers may process data on servers outside Malaysia. We transfer data abroad because it is necessary to provide the service you asked for and with your consent, as section 129 of the Act allows, and we use providers that protect it under their terms. Google's paid Gemini API terms do not allow your content to be used to train its models.
How long we keep it
Your account data is kept while your account exists. Meeting audio is deleted 90 days after the meeting. Files uploaded only to be read are removed when no longer needed. When you delete your account, everything you entered and uploaded is deleted, together with your consent records and AI request log; we then keep only an archive of the versions you accepted and when, with your email and account id replaced by one-way codes, for 7 years (the limitation period plus a margin), so that a dispute about the account can still be answered. Server backups roll off within 30 days.
Security
Data is protected in transit and at rest, and database rules let only your own account read your records. AI keys are kept on the server, never in the app. No system is perfectly secure; if a personal data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected users as the law requires.
Your rights
You can see, correct and export your data in the app, and delete records or your whole account from Settings. You may also ask us for a copy of your personal data, to correct it, to transfer it, to limit how it is processed, or to withdraw consent (which may stop parts of the service working), by emailing [email protected]. We reply within 21 days. You may complain to the Personal Data Protection Department (www.pdp.gov.my).
Your clients' data
When you enter or record your clients' personal data, you decide why and how it is used, and you are responsible for having a lawful basis and for telling them. We process it only on your instructions, to provide the service to you.
Children
CukaiSifu is a tool for working professionals and is not intended for anyone under 18.
Changes
If this notice changes in a way that matters, we will tell you in the app and ask you to accept the new version.
Notis Privasi (Bahasa Malaysia)
Notis ini (versi 2026-11-01) menerangkan cara CukaiSifu, yang dikendalikan oleh J & A APP STUDIO PLT (202604002661 (LLP0047906-LGN)), Klang, Malaysia ("kami"), memproses data peribadi menurut Akta Perlindungan Data Peribadi 2010 (dipinda 2024). Ringkasnya: data anda kekal dalam akaun anda sendiri, tidak dijual, tidak digunakan untuk pengiklanan dan tidak digunakan untuk melatih model AI.
Data yang dikumpul
(1) Akaun anda: alamat e-mel, kaedah log masuk, serta nama, firma dan nombor ejen cukai yang anda masukkan. (2) Maklumat pelanggan anda: rekod pelanggan, peringatan, nota, dokumen, foto, PDF, hamparan, angka kewangan, pengiraan cukai, nota suara, rakaman mesyuarat, transkrip dan nota. (3) Jika anda menyambung peti mel (Gmail, Microsoft 365 atau Outlook, atau IMAP): pengirim, subjek, tarikh dan petikan ringkas e-mel yang sepadan dengan penapis berkanun, dan draf yang anda pilih untuk dibuat; kata laluan IMAP kekal dalam telefon anda sahaja. (4) Rekod perlindungan: versi dokumen yang anda terima dan bila, pengesahan persetujuan rakaman mesyuarat, cadangan Sifu di sebelah apa yang anda simpan, dan log permintaan AI (masa dan ciri). (5) Status langganan daripada Google Play melalui RevenueCat; kami tidak menerima butiran kad atau bank anda. (6) Data teknikal asas: versi aplikasi dan platform.
Tujuan penggunaan
Untuk menyediakan perkhidmatan yang anda minta (tarikh akhir, membaca apa yang anda rakam, transkripsi dan ringkasan mesyuarat, anggaran cukai, laporan, jawapan dan peringatan); mengurus langganan; menjaga keselamatan dan had penggunaan wajar; menjawab soalan, aduan dan tuntutan; dan mematuhi undang-undang. Butiran akaun wajib untuk menggunakan aplikasi; yang lain terpulang kepada anda.
Pendedahan dan pemindahan ke luar Malaysia
Data hanya dikongsi dengan pembekal yang diperlukan untuk menjalankan CukaiSifu: Supabase (pangkalan data, storan dan fungsi pelayan), Google (perkhidmatan AI Gemini, Gmail jika disambung, dan pengebilan Google Play), Microsoft (mel Outlook jika disambung) dan RevenueCat (status langganan). Pembekal ini mungkin memproses data di luar Malaysia; pemindahan dibuat kerana perlu untuk menyediakan perkhidmatan dan dengan persetujuan anda, seperti dibenarkan oleh seksyen 129 Akta. Kami tidak menjual data peribadi.
Tempoh simpanan
Data akaun disimpan selagi akaun wujud. Audio mesyuarat dipadam 90 hari selepas mesyuarat. Apabila akaun dipadam, semua yang anda masukkan dan muat naik dipadam; kami hanya menyimpan arkib versi dokumen yang anda terima dan bila, dengan e-mel dan ID akaun digantikan dengan kod sehala, selama 7 tahun, supaya sebarang pertikaian masih boleh dijawab. Salinan sandaran pelayan luput dalam 30 hari.
Hak anda
Anda boleh melihat, membetulkan, mengeksport dan memadam data dalam aplikasi. Anda juga boleh meminta salinan data peribadi anda, pembetulan, pemindahan, had pemprosesan atau menarik balik persetujuan dengan e-mel ke [email protected]. Kami membalas dalam 21 hari. Anda boleh membuat aduan kepada Jabatan Perlindungan Data Peribadi (www.pdp.gov.my). Jika terdapat perbezaan antara versi Bahasa Malaysia dan Bahasa Inggeris notis ini, tafsiran yang lebih memihak kepada anda terpakai.
Contact / Hubungi
Questions about these documents, a complaint, a claim, or a request to see, correct, export or delete your data: email [email protected]. We reply within 21 days. By post: J & A APP STUDIO PLT, No. 123, Jalan Permata 1/KS09, Pusat Bandar Perniagaan Bandar Bestari, Taman Perindustrian Air Hitam, 42000 Klang, Selangor, Malaysia. Website: jnaappstudio.com.