1. Who is responsible
Prigo X Technologies Sdn. Bhd. (202601013522) operates Invoa and is the data user for personal data about our subscribers, their team members, partners and website visitors.
When a subscriber uses Invoa to manage their own customers (for example the names, emails, addresses and tax numbers on their invoices), the subscriber decides why that data is processed and is responsible for it; we process it on the subscriber's instructions to provide the service. Questions about such data should go to the business that issued the document.
2. Personal data we collect
- Account data: name, email, password (stored only as a hash), phone, role and company membership. If you sign in with Google, the name and email of your Google account.
- Company data: legal name, registration number, TIN, SST number, address, bank account details for receiving payments, logo.
- Customer and document data that subscribers enter: contact names, emails, phone numbers, addresses, identification and tax numbers, document lines and amounts.
- Payment data: payment amounts, status and references from CHIP, and proof-of-payment files uploaded for bank transfers. Card details are entered on CHIP's pages and never reach Invoa.
- e-Invoice data: the documents we submit to LHDN MyInvois and LHDN's responses.
- Expense and bank data: supplier bills and receipts you upload, and bank statements and statement lines you import.
- Usage and technical data: sign-in times, IP address, browser type, audit logs of actions in the app, and records of AI-assistant and API requests.
- Communications: emails, contact-form messages and support requests you send us.
3. Why we use it
- to create and secure accounts and provide Invoa's features;
- to submit, retrieve and cancel e-invoices with LHDN when you instruct us to;
- to process subscription payments and send invoices, receipts and service emails;
- to give support, prevent fraud and abuse, and keep audit trails;
- to run the partner and referral programme, including tracking referral codes;
- to meet legal, tax and accounting obligations.
We do not sell personal data and do not use subscribers' customer data for advertising.
4. Who we share it with
We share personal data only as needed to run Invoa:
- Google Cloud, which hosts our servers, database and files;
- CHIP (chip-in.asia), which processes online payments;
- Google (Gemini API), which reads the expense bills and PDF bank statements you upload to extract the supplier, date, amounts and transactions;
- Lembaga Hasil Dalam Negeri Malaysia (LHDN), for e-invoice submissions you request and TIN validation;
- our email delivery provider, to send documents, reminders and account emails;
- Cloudflare, which provides our DNS and, where enabled, bot protection on sign-up and payment forms;
- AI assistants or other applications that you choose to connect, within the access you grant;
- professional advisers and authorities where required by law.
AI assistant connectors (for example Claude or ChatGPT). When you connect an assistant to a company in Invoa, it can read that company's contacts (names, tax and business registration numbers, addresses, email addresses and phone numbers; never identity card or passport numbers, which stay in Invoa), items, documents, payments and receivables, and act on them within the permissions shown on the consent screen. Invoa sends this data only in answer to the assistant's requests during your conversations; Invoa does not receive or keep your chat history. Each request and its result is recorded in the company's activity log (Settings → AI connectors) and kept with the audit log. Issuing, submitting to LHDN and voiding wait for your approval in Invoa. You can disconnect an assistant at any time from Settings → AI connectors. Data the assistant's provider has already received is handled under that provider's own privacy policy.
5. Where data is stored
Invoa's servers and backups are hosted by Google Cloud in Singapore. Bills and statements read by AI are processed by Google's Gemini API, which may process them outside Singapore. By using Invoa you consent to these transfers outside Malaysia. Singapore has data protection law comparable to the PDPA, and our providers are bound by contracts to protect the data.
6. How long we keep it
Account and company data are kept while the account is active. After an account is closed we delete or anonymise it within 90 days, except issued documents, payment records, e-invoice submissions and audit logs, which are kept for 7 years for tax and record-keeping purposes. Backups roll over within 14 days.
7. Security
Data is encrypted in transit (HTTPS). Passwords are hashed, payment-gateway keys are encrypted at rest, file links expire after a short time, access is limited by role, and actions are recorded in an audit log. No system is completely secure; we will notify affected subscribers and authorities of a personal data breach as required by law.
8. Cookies
Invoa uses essential cookies to keep you signed in and secure your session, a first-visit cookie that remembers which site or search engine sent you (so we know how people find Invoa), and a referral cookie when you arrive through a partner link. We do not use advertising cookies. Our pages load fonts from external font services, which receive your IP address when your browser requests them.
9. Your choices and rights
Under the PDPA you may ask to access and correct your personal data, limit its processing, or withdraw consent. Company owners and admins can export their data from Settings → Data export. Send requests to hello@invoa.io; we respond within 21 days. If we cannot process some data without your consent, withdrawing it may mean we cannot provide parts of the service.
Providing personal data is voluntary, but without account and company details we cannot provide Invoa, and e-invoices need the tax details LHDN requires.
10. Changes and contact
We will post updates on this page and notify subscribers of material changes. In case of any inconsistency between language versions of this policy, the English version prevails.
Prigo X Technologies Sdn. Bhd. (202601013522), D1-01-07 Atelier Centre, Jalan Atelier 1, Edusphere, 63000 Cyberjaya, Selangor, Malaysia. Email hello@invoa.io.