Privacy Notice

1. Who we are

Kirabaki is operated by Maya Trade Ventures, trading as Kirabaki. Maya Trade Ventures is the data controller for the personal data described in this notice — we decide what data is collected and why. You can reach us through the support options in the app.

2. What we collect and why

• Account data (email address, login credentials or Google account identifier, authentication timestamps) — to create and secure your account and let you sign in. Legal basis: performance of our contract with you.
• Financial information you enter (salary amount and payday, commitments, bills, due dates and amounts, reserves, safety floor, purchase checks and simulations) — to calculate your Safe to Spend and provide the service. Legal basis: performance of our contract with you. This data stays yours; Kirabaki never connects to your bank and never asks for banking passwords.
• Preferences (reminder and notification settings, theme) — to deliver the experience you chose. Legal basis: contract performance.
• Support messages — to answer your questions. Legal basis: contract performance and our legitimate interest in supporting customers.
• Technical and usage data (IP address, device and browser type, pages viewed, error logs) — to keep the service secure, prevent fraud and abuse, diagnose problems and improve the product. Legal basis: our legitimate interests in security and service improvement.
• Subscription records (plan tier, status, renewal or expiry dates, transaction references received from our payment provider) — to give you access to the plan you paid for and show your billing history. Legal basis: contract performance and legal obligation. We do not collect or store your card details — those go directly to CHIP.

3. Who we share data with

• Service providers and subprocessors — hosting, database, authentication, email delivery and error-monitoring providers who process data on our instructions.
• CHIP (Chip In Sdn Bhd), our Malaysian payment provider, to collect subscription payments and renewals and to issue receipts. CHIP acts as controller for the card data it collects from you.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where we are required to disclose by law or to protect our legal rights.

We do not sell your personal data and we do not use your financial entries for advertising.

4. International transfers

Our providers may process data outside your country, including outside Malaysia and the UK/EEA. Where data leaves the UK/EEA we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, together with technical measures like encryption in transit.

5. Retention

We keep your account and financial entries for as long as your account is active. If you delete your data from Settings, or delete your account, we remove it from our live systems promptly and from backups within 30 days. Records we must keep for legal, tax or accounting reasons (such as subscription and invoice records) are retained for up to 7 years, then deleted or anonymised. Security and error logs are kept for up to 12 months.

6. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent where processing is based on consent. If you are in the UK or EEA you also have the right to complain to your supervisory authority; in Malaysia you may raise concerns with the Personal Data Protection Commissioner. We respond to requests within one month. Many rights are also self-service: you can edit your salary, commitments and preferences, or delete all your data, from the Settings page.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls so each account can only reach its own records, least-privilege access for administrators, and server-side verification of billing state. No system is perfectly secure, so please use a strong, unique password.

8. Cookies and local storage

Kirabaki uses essential cookies and browser storage only — to keep you signed in, remember your theme choice and reminder state, and protect against abuse. We do not use advertising cookies. If we add analytics or marketing cookies in future, we will ask for your consent first and provide a preference control. You can clear cookies and storage in your browser settings, though signing in will then be required again.

9. Changes

We will update this notice when our practices change and revise the date above. Material changes will be communicated in the app or by email.