S.I.S. is committed to Malaysia's Personal Data Protection Act 2010 (PDPA), including the Personal Data Protection (Amendment) Act 2024. This notice explains what we collect and why. It is issued in English with a Bahasa Malaysia summary below; the Chinese version is provided for convenience.
Your data (the studio owner): name, email, phone, and payment information if you subscribe (card details are handled by Stripe — we never see or store full card numbers). We also keep basic security logs (IP address, device) to protect accounts and prevent fraud.
Your business data: the clients, invoices and documents you create or upload, stored to provide the service. Documents you drop in for AI extraction are sent to our AI provider (Anthropic) to be read; they are not used to train AI models, and we never use your data to train anything either.
Why we process your data
To perform our contract with you (running your studio account and producing your documents); to meet legal obligations (tax, accounting, fraud prevention); and with your consent for optional integrations such as Google Drive backup — which you can withdraw at any time by disconnecting the integration or contacting us.
Sub-processors & where your data lives
We use these providers to run the service: Supabase (database & file storage — hosted in Singapore), Vercel (application hosting/CDN), Stripe (subscription payments), Anthropic (AI document extraction), and Google (optional Drive backup, under your own Google account).
Where data is transferred outside Malaysia, it is protected by contractual safeguards with these providers and encrypted in transit and at rest, in line with the PDPA's cross-border principles.
No selling. No leaking.
We will never sell, rent, trade or otherwise disclose your data — or your clients' data — to any third party for their own use. No advertisers, no data brokers, no marketers, nobody. Your data is disclosed only (a) to the sub-processors listed above, strictly so the service can run, under contracts binding them to confidentiality, and (b) where Malaysian law or a court order compels us — in which case we disclose only the minimum required and, unless legally prohibited, inform you first. Outside those two cases, your data does not leave the service.
Retention
We keep your data while your account is active. If you delete your account (or ask us to), we purge personal data within 30 days, except records we must keep under Malaysian law; residual copies in encrypted backups roll off within 35 days.
Security
Data is encrypted in transit (TLS) and at rest. Each studio's data is isolated with row-level security, and internal access follows least privilege. No system is perfectly secure — if something affects your data, we will tell you promptly.
Data breach notification
In line with the 2024 Amendment, if a personal data breach occurs we will notify the Personal Data Protection Commissioner without undue delay (and within any prescribed timeframe), and notify affected users where the breach is likely to cause significant harm.
Your rights
You may request access to your personal data, correct it, withdraw consent, request data portability, or ask for deletion — via the /contact page or WhatsApp. We respond within 21 days as required by the PDPA.
Your clients' data
For personal data you store about your clients, you are the data user and we act as your processor (see Terms). We never contact your clients or use their data for ourselves. If your client sends us a request about their data, we will refer it to you and assist you in fulfilling it.
Notis Perlindungan Data Peribadi (Ringkasan — Bahasa Malaysia)
S.I.S. memproses data peribadi anda (nama, e-mel, telefon, maklumat pembayaran) dan data perniagaan anda (pelanggan, invois, dokumen) untuk menyediakan perkhidmatan invois dan simpan kira ini, selaras dengan Akta Perlindungan Data Peribadi 2010 (termasuk Pindaan 2024).
Data disimpan oleh pemproses perkhidmatan kami: Supabase (pangkalan data — Singapura), Vercel (pengehosan), Stripe (pembayaran), Anthropic (pengekstrakan dokumen AI) dan Google Drive (jika anda mengaktifkannya), dengan perlindungan kontrak dan penyulitan.
Kami tidak akan sekali-kali menjual, menyewakan atau mendedahkan data anda kepada mana-mana pihak ketiga untuk kegunaan mereka sendiri. Pendedahan hanya dibuat kepada pemproses perkhidmatan yang disenaraikan di atas (untuk mengendalikan perkhidmatan sahaja, tertakluk kepada kewajipan kerahsiaan) atau jika dikehendaki oleh undang-undang Malaysia — dan dalam kes itu, hanya setakat minimum yang diperlukan, dan kami akan memaklumkan anda terlebih dahulu melainkan dilarang oleh undang-undang.
Anda berhak mengakses, membetulkan dan memadam data anda, meminta pemindahan data, serta menarik balik persetujuan pada bila-bila masa dengan menghubungi kami. Kami akan memberi maklum balas dalam tempoh 21 hari.
Sebarang pertanyaan: hubungi kami melalui halaman /contact atau WhatsApp.
Changes to this notice
If we change this notice materially, we will announce it in-app or by email and update the version date above.
Last updated: 10 August 2026 · Version 2026-08-10