Privacy Policy for Kira

Effective Date: 1 May 2026

This legal framework elucidates how Kira Labs Sdn Bhd (1679437-P) collects, processes, and safeguards data within the Kira platform and related ecosystem (the "Service"). It is strictly designed to comply with Malaysia's Personal Data Protection Act 2010 (as amended 2024) ("PDPA").

1. Data Collection Architecture

We collect Business Intelligence, Transactional Ledgers, Statutory Tax Data, and Cryptographic Access Credentials required for system operations. We unequivocally DO NOT collect, process, or store any biometric data. Biometric verification occurs entirely locally on the user's hardware.

2. PDPA Role Bifurcation & AI Rights (Critical Classification)

• 2.1 Merchant as Data User: For all end-consumer data inputted into the Service, the Merchant acts as the sole 'Data User', assuming absolute statutory responsibility for obtaining consumer consent under the PDPA.
• 2.2 Kira as Data Processor: Kira acts strictly as a 'Data Processor'. We fully disclaim any liability for regulatory fines or civil claims arising from the Merchant's failure to secure lawful consumer consent.
• 2.3 Derived Data & AI Training Exemption: Notwithstanding Kira's primary role as a Data Processor, the Merchant irrevocably grants Kira a perpetual, global, and royalty-free right to mathematically aggregate, de-identify, and anonymize operational telemetry and transactional ledgers into "Derived Data." Once cryptographically stripped of all Personally Identifiable Information (PII), this Derived Data falls entirely outside the statutory purview of the PDPA 2024. Kira retains absolute and exclusive commercial ownership of this Derived Data and any underlying algorithms, Artificial Intelligence (AI) predictive models, or Machine Learning (ML) analytics trained upon it.

3. Information Disclosure & Sub-Processors

Your data is shared exclusively with Tax Authorities (as legally mandated) and enterprise-grade Sub-Processors. These entities are bound by rigorous data protection agreements. We will never sell your data to data brokers.

4. Data Security & Isolation

We implement industry-standard cryptographic encryption in transit and at rest. Each tenant's dynamic business data is stored within logically isolated data architectures.

5. Breach Notification Protocol

Should a credible data breach occur, Kira will notify the Personal Data Protection Commissioner expeditiously, aligning with PDPA 2024 amendments. Kira explicitly disclaims liability for breaches originating from third-party sub-processors, provided reasonable due diligence was exercised.

6. Data Retention and Statutory Archiving Waiver

A sixty (60) day grace period initiates upon subscription expiry or payment default.

• 6.1 Authorized Purge: Upon expiry of this 60-day window, the Merchant expressly authorizes Kira to irrevocably destroy all ledger data.
• 6.2 Archiving Waiver: The Merchant bears the absolute, non-delegable statutory burden to export and retain 7-year tax records under the Income Tax Act 1967 prior to this scheduled purge. Kira is fully indemnified against resulting tax audits or spoliation of evidence claims.

7. Your Statutory Rights & Telemetry

Data subjects maintain rights to access, rectify, and request structured data exports. We deploy secure, pseudonymous diagnostic telemetry to ensure application reliability.

• 7.1 Statutory Erasure Subordination: The Merchant’s right to request immediate data erasure under the PDPA is expressly subordinated to the Merchant’s mandatory 7-year statutory archiving burden under Section 82 of the Income Tax Act 1967. Any premature request for account deletion constitutes an irrevocable legal warrant by the Merchant that localized tax backups are secured. Kira reserves the absolute right to reject, suspend, or delay early erasure requests that conflict with Kira's mandatory 60-day financial ledger lock, and Kira is fully indemnified against any subsequent spoliation of evidence claims.

8. International Data Transfer

Data is processed primarily within the Southeast Asia region (Singapore/Malaysia), affording a standard of protection legally comparable to the Malaysian PDPA.

Contact Our Privacy Team: privacy@getkira.io