Privacy Policy

1. Personal Data We Collect

• Account data: email address, name, and login credentials (including Google login if you choose it).
• Business/profile data: company name, entity type, representative name, tax ID, invoice number, address, phone, and industry.
• Content you upload: receipts, invoices, bank statements (CSV), payroll data, and client data — which may contain third-party Personal Data.
• Technical data: IP address, device/browser type, and cookie data (see Cookie Policy).
• Payment data: for subscriptions, processed via a payment provider; we do not store full card details.

2. Legal Basis for Processing

Under Article 20 of the PDP Law, we process Personal Data based on: (a) your consent; (b) performance of a contract (providing the Service); (c) compliance with legal obligations; and/or (d) the Company’s legitimate interests that do not override your rights.

3. Purposes of Use

• To provide, operate, and maintain the Service.
• To read documents automatically (AI/OCR) to produce journals and reports.
• To manage accounts, authentication, and security.
• To communicate about the Service and provide customer support.
• To comply with legal and tax obligations.

4. AI/OCR Processing

Documents you upload may be sent to AI/OCR providers for data extraction. This processing is necessary for the automated reading feature. Please avoid uploading sensitive Personal Data not relevant to bookkeeping.

If you use the in-app AI support assistant, the question you type and any screenshot you attach are sent to our AI provider to generate a response. Please avoid including sensitive Personal Data in support messages.

To improve support quality, we store support conversation records (the question, answer, category, and the page involved — image files are not stored) for up to 90 days, after which they are automatically deleted.

AI results are drafts. We do not make decisions that produce legal effects concerning you based solely on automated processing — you always review and approve results before they are used.

5. Data Sharing and Sub-Processors

We do not sell your Personal Data. We may share data with trusted service providers that help operate the Service, including cloud infrastructure and database providers, an authentication provider, and AI/OCR providers.

Sub-processors may only process data on our instructions and for the purpose of providing the Service.

We may also disclose data where required by law, court order, or a lawful request from a competent authority, to the extent necessary.

6. Cross-Border Data Transfer

Some sub-processors may process data outside Indonesia. In accordance with Article 56 of the PDP Law, such transfers are made by ensuring an equivalent level of protection, or based on your consent. By using the Service, you understand and consent to such transfers to the extent necessary to provide the Service.

7. Data Retention

Personal Data is retained while the account is active and for as long as necessary for the processing purposes or to meet legal obligations (e.g. retention of financial records).

When you request account deletion, your account is deactivated and your data is kept for a 14-day grace period during which the account can be restored. After 14 days, your uploaded content and account data are permanently deleted and cannot be recovered.

Exception: limited records we are legally required to keep — for example transaction records, invoices, and tax documents relating to your subscription — may be retained for the period prescribed by law (generally 10 years under Law No. 8 of 1997 on Company Documents and tax regulations), separately from the content you have deleted.

When no longer needed, data is deleted or anonymized in accordance with applicable rules.

8. Security

We apply reasonable technical and organizational measures, including encryption in transit, access controls, and data isolation between users, to protect Personal Data. However, no system is entirely risk-free.

9. Rights of the Data Subject

Under the PDP Law, you have the right to:

• Obtain information about and access your Personal Data.
• Correct or update inaccurate Personal Data.
• Erase Personal Data (the right to be forgotten) where applicable.
• Withdraw consent and restrict/object to processing.
• Obtain and port your Personal Data (portability).
• Lodge a complaint with us and/or the competent authority.

10. Cookies

The Service uses cookies and similar technologies. Details and settings are provided in the Cookie Policy.

11. Children’s Data

The Service is not intended for children under 18. Processing of a child’s Personal Data may only be done with parental/guardian consent under the PDP Law.

12. Data Breach Notification

In the event of a Personal Data protection failure, we will notify you and the competent authority in accordance with the PDP Law, including the prescribed notification timeframe.

13. Changes to this Policy

We may update this Privacy Policy. Material changes will be notified in the app or by email.

14. Data Protection Contact

To exercise your rights or for privacy questions, contact our data protection contact by email at support@kazena.company, or in writing to PT KAZENA GLOBAL BUSINESS, Office Tower Eightyeight@Kasablanka Unit 9A, Jalan Casablanca Kav. 88, Menteng Dalam, Tebet, Jakarta Selatan, DKI Jakarta 12870, Indonesia.