Krani.ai Privacy Policy
Last updated: 19 October 2026
This Privacy Policy explains how CSV Ventures Sdn. Bhd. (Registration No. 202501005320 (1606734-H)) ("CSV Ventures", "we", "us", "our") collects, uses, discloses and protects personal data in connection with Krani.ai, our AI-powered accounting automation platform (the "Service"). It is issued under the Personal Data Protection Act 2010 of Malaysia ("PDPA"), as amended. By registering for or using the Service, you confirm that you have read and understood this Policy.
1. Who this Policy covers and our role
This Policy applies to:
- Customers – the accounting firms, businesses and other organisations that subscribe to the Service, and the individuals who register, administer or use an account on their behalf ("Users").
- End-Clients – individuals whose personal data appears in the invoices, receipts, bank statements and other documents that Customers upload to the Service ("Customer Content").
- Visitors – individuals who visit krani.ai or contact us.
We act in two different capacities under the PDPA:
| Data | Our role | What this means |
|---|---|---|
| Account, billing, usage and contact data of Customers, Users and Visitors | Data user | We decide how and why this data is processed and are directly responsible for it under this Policy. |
| Personal data inside Customer Content (End-Client data) | Data processor | We process this data only on behalf of, and on the instructions of, the Customer who uploaded it. The Customer is the data user and is responsible for having a lawful basis (including any required consent and notice) to upload it. End-Clients who have questions about their data should contact the Customer (their accountant or service provider) in the first instance. |
Where we act as a data processor, the data-processing terms in our Terms of Service also apply.
2. Personal data we collect
| Category | Examples | Source | Required? |
|---|---|---|---|
| Account data | Name, business email address, phone number, job title, firm or company name, business address, login credentials, user role | You, when you register or are added to an account | Required to create and operate your account |
| Billing data | Billing name and address, subscription plan, transaction history, last four digits and card type. Full card numbers are collected and stored by our payment processor, Stripe, not by us. | You, Stripe | Required to pay for a subscription |
| Customer Content | Invoices, receipts, bank statements, ledgers and other financial documents you upload, and the data extracted from them. These may contain personal data about End-Clients or third parties: names, addresses, identification numbers, bank account numbers, transaction descriptions and amounts. | You (the Customer) | Required for the Service to perform its function |
| Integration data | Chart of accounts, contacts and transaction records exchanged with third-party accounting software you choose to connect | You, your connected software | Only if you enable an integration |
| Support and communication data | Messages, attachments and screenshots you send to our support team, call notes | You | Required to resolve your request |
| Usage and technical data | IP address, device and browser type, operating system, pages viewed, features used, timestamps, error logs | Automatically, when you use the Service | Collected automatically |
| Marketing data | Your marketing preferences, email open and click activity | You, our email tools | Optional |
We do not knowingly collect sensitive personal data (such as health, religious or biometric data) as a data user. If sensitive personal data appears inside Customer Content, it is processed solely on the Customer's behalf and the Customer is responsible for having the explicit consent required by the PDPA.
If you do not provide data marked as required, we may be unable to provide the Service or the relevant feature to you.
3. How and why we use personal data
We process personal data only for the purposes below, and only to the extent necessary for each purpose.
| Purpose | Data used | PDPA basis |
|---|---|---|
| Creating and administering your account, authenticating Users and managing seats | Account data | Performance of our contract with you |
| Providing the Service: receiving, storing, extracting, classifying and syncing Customer Content | Customer Content, Integration data | Performance of our contract with you; processing on the Customer's instructions as data processor |
| Billing, collecting payment, issuing invoices and receipts, preventing payment fraud | Account data, Billing data | Performance of our contract; compliance with legal obligations |
| Responding to support requests and resolving technical issues | Account data, Support data, and, only where needed to resolve the case, the specific Customer Content concerned | Performance of our contract; your consent when you raise the request |
| Monitoring security, detecting and investigating abuse, fraud, unauthorised access or breaches of our Terms | All categories, as necessary | Our legitimate interest in protecting the Service and our legal obligations |
| Sending service communications: security alerts, maintenance notices, billing reminders, changes to terms | Account data | Performance of our contract; legal obligations |
| Sending product updates, release notes, newsletters, promotions and event invitations | Account data, Marketing data | Your consent, which you may withdraw at any time (see Section 10) |
| Understanding how the Service is used so we can maintain and improve it | Usage and technical data (aggregated or pseudonymised wherever practicable) | Our legitimate interest |
| Complying with Malaysian law, court orders and lawful requests from regulators or law enforcement | All categories, as required | Legal obligation |
| Establishing, exercising or defending legal claims | All categories, as required | Legitimate interest |
We do not access, read or review your Customer Content in the ordinary course of operating the Service. Our staff access Customer Content only in the following circumstances: (a) you ask us to, for example in a support case; (b) we reasonably need to in order to investigate a security incident, suspected fraud or abuse, or a breach of our Terms; (c) we are required to by law; or (d) to the limited extent needed to maintain or debug the Service. Such access is restricted to authorised personnel, logged, and limited to what is necessary.
We do not sell personal data, and we do not use Customer Content for advertising.
4. AI processing of your data
The Service uses artificial intelligence, including optical character recognition (OCR), machine-learning and large language models ("AI Models"), to read the documents you upload, extract fields such as dates, amounts, tax and line items, match transactions to documents, propose ledger accounts and prepare entries for posting. By uploading Customer Content you acknowledge that it will be processed by AI Models in order to provide the Service.
You should know the following about how this works:
- Where processing happens. AI Models are hosted within Amazon Web Services (AWS) infrastructure located in the AWS Asia Pacific (Malaysia) Region. Your Customer Content is processed and stored in Malaysia and is not transferred outside Malaysia for AI processing.
- No training on your data. We do not use your Customer Content, your extracted data or your AI outputs to train, retrain or fine-tune any AI Model, whether our own or a third party's. Our AI infrastructure providers are contractually prohibited from doing so.
- Automated processing, human decision. AI Models generate suggested outputs. They do not make legally binding or significant decisions about any individual. Final decisions about how transactions are recorded, reported or filed are made by the Customer and its qualified staff.
- Accuracy. AI Models can misread documents or produce incorrect, incomplete or inconsistent outputs. The Customer is solely responsible for reviewing and verifying all outputs before relying on them, as further set out in our Terms of Service.
- Your choices. If you do not wish personal data about a particular individual to be processed by AI Models, do not upload documents containing that data.
5. Disclosure of personal data
We disclose personal data only to the classes of recipients below.
| Recipient | What is shared | Why |
|---|---|---|
| Amazon Web Services (AWS) – cloud hosting and AI infrastructure, Asia Pacific (Malaysia) Region | All data stored in or processed by the Service, including Customer Content | To host and operate the Service and run AI Models |
| Stripe – payment processing | Billing name, email address, billing address, payment card details (entered directly into Stripe), transaction amounts | To process subscription payments and prevent payment fraud |
| Third-party accounting software you connect (for example your firm's existing accounting system) | The transactions, contacts and records you choose to sync | Only at your instruction, to post entries to your software |
| Other Users on your account | Your name, email address and activity within the account | So your firm can collaborate and administer its account |
| Professional advisers – lawyers, auditors, accountants, insurers | Data relevant to the advice | To obtain professional advice and meet our legal obligations |
| Regulators, courts and law enforcement | Data required by law or court order | To comply with Malaysian law |
| A buyer or successor in a merger, acquisition, financing or sale of assets | Data relevant to the transaction, under confidentiality | To continue the Service after a change of ownership; you will be notified of any change in data user |
Our service providers are bound by written contracts that require them to process personal data only on our instructions, keep it confidential and protect it with appropriate security measures. We will update this list when we add or replace a service provider that processes Customer Content and, where we act as your data processor, give you the notice described in our Terms of Service.
6. Transfers outside Malaysia
Customer Content and the AI processing described in Section 4 remain within Malaysia.
Limited account and billing data is transferred outside Malaysia in one case: payments are processed by Stripe, whose group companies and infrastructure are located in the United States, Singapore and other jurisdictions. Stripe is certified under the PCI DSS standard and is bound by contractual terms that require it to protect personal data to a standard substantially similar to the PDPA. By subscribing to a paid plan, you consent to this transfer for the purpose of processing your payment. If you do not consent, we are unable to accept payment and provide a paid subscription.
We do not otherwise transfer personal data outside Malaysia except where (a) you have consented, (b) the transfer is necessary to perform our contract with you or at your request, (c) the transfer is required or permitted by Malaysian law, or (d) the recipient is in a jurisdiction or subject to safeguards that provide protection substantially similar to the PDPA.
7. Security
We take practical steps to protect personal data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, in line with the PDPA Security Principle and the Personal Data Protection Standard 2015. These include:
- Infrastructure. The Service is hosted entirely on AWS in the Asia Pacific (Malaysia) Region and is operated in accordance with AWS security best practices and the AWS Shared Responsibility Model. AWS maintains ISO 27001, SOC 1/2/3 and PCI DSS certifications for its infrastructure.
- Encryption. Data is encrypted in transit using TLS and at rest using industry-standard encryption.
- Access control. Access to production systems and Customer Content is restricted to authorised personnel on a need-to-know basis, protected by multi-factor authentication, and logged.
- Data segregation. Each Customer's data is logically separated from that of other Customers.
- Monitoring and testing. We monitor our systems for suspicious activity and review our security controls periodically.
- Personnel. Our staff are bound by confidentiality obligations and receive data-protection training.
No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential, enabling multi-factor authentication where offered, managing the Users on your account, and notifying us promptly at it@krani.ai if you suspect unauthorised access.
8. Retention
We keep personal data only for as long as necessary for the purposes described in this Policy, after which it is deleted or anonymised.
| Data | Retention period |
|---|---|
| Customer Content and extracted data | For the life of your subscription and for up to 7 years after your subscription ends, so that you and your End-Clients can retrieve accounting records for the statutory record-keeping periods under the Income Tax Act 1967 and Companies Act 2016, and so we can respond to disputes or legal claims. You may request earlier deletion at any time (see below). |
| Account data | For the life of your account and up to 7 years after closure, for contract, tax and audit purposes |
| Billing records | 7 years from the transaction, as required by Malaysian tax and accounting law |
| Support communications | 3 years from closure of the case |
| Usage and technical logs | Up to 12 months, unless needed longer for a security investigation |
| Marketing data | Until you withdraw consent or unsubscribe |
Requesting earlier deletion. A Customer may delete individual documents within the Service at any time, and may ask us at it@krani.ai to delete all Customer Content associated with its account. We will carry out the deletion within 30 days of a verified request and purge it from backups within a further 90 days, unless we are required by law to retain specific records, in which case we will retain only those records and only for as long as the law requires. Customers are responsible for exporting any data they need before requesting deletion.
End-Clients wishing to have their data deleted should contact the Customer that uploaded it, who can delete it or instruct us to do so.
9. Your rights under the PDPA
As a data subject you have the following rights in respect of personal data for which we are the data user:
- Access. To request a copy of the personal data we hold about you.
- Correction. To ask us to correct personal data that is inaccurate, incomplete, misleading or out of date. You can update most account data yourself in your account settings.
- Withdraw consent. To withdraw, by notice in writing, any consent you have given to the processing of your personal data. Withdrawal does not affect processing that took place before withdrawal, and may mean we can no longer provide some or all of the Service to you.
- Limit processing. To require us to stop or not begin processing your personal data for direct marketing, or where the processing is causing or is likely to cause substantial, unwarranted damage or distress.
- Data portability. To request that personal data you have provided to us be transmitted to another data user in a structured, commonly used, machine-readable format, where technically feasible.
- Complain. To lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi, www.pdp.gov.my) if you believe we have breached the PDPA. We would appreciate the chance to resolve your concern first.
How to exercise your rights. Email it@krani.ai with the subject line "PDPA Request", stating which right you wish to exercise. We will verify your identity before acting on a request and may ask for further information to do so. We respond within 21 days of receiving a complete request, as required by the PDPA. We may charge the prescribed fee for data access requests where permitted by law, and we may refuse a request in the circumstances permitted by the PDPA, in which case we will tell you why.
Requests relating to Customer Content. If you are an End-Client, we process your data on behalf of the Customer that uploaded it and are generally unable to act on your request directly. Please contact that Customer. If you contact us, we will refer your request to the relevant Customer where we are able to identify them, and will assist the Customer in responding.
10. Marketing communications
With your consent, we may use your name, email address and phone number to send you product updates, release notes, newsletters, promotional offers, surveys and event invitations about Krani.ai, by email, phone, WhatsApp or similar channels. We will not share your contact details with third parties for their own marketing.
You may opt out at any time by clicking the "unsubscribe" link in any marketing email, replying "STOP" to a message, adjusting your notification preferences in your account, or emailing it@krani.ai. We will action your request within 7 working days. Opting out of marketing does not stop service communications (such as security alerts, billing notices and changes to our terms), which we need to send in order to operate your account.
11. Cookies and similar technologies
Our website and the Service use cookies and similar technologies for the following purposes:
| Type | Purpose | Can you disable it? |
|---|---|---|
| Strictly necessary | Logging you in, keeping your session secure, remembering your settings, load balancing | No – the Service will not function without them |
| Analytics | Understanding how visitors and Users use our website and the Service so we can improve them | Yes – through your browser settings or our cookie banner where shown |
| Marketing | Measuring the effectiveness of our campaigns and showing relevant content | Yes – through your browser settings or our cookie banner where shown |
Most browsers let you refuse or delete cookies. If you disable strictly necessary cookies, parts of the Service may not work. We do not respond to "Do Not Track" browser signals at this time.
12. Personal data breach notification
If we become aware of a personal data breach that affects personal data for which we are the data user and that causes or is likely to cause significant harm to you, we will notify the Personal Data Protection Commissioner as soon as practicable and in any event within 72 hours of becoming aware of it, and we will notify you without undue delay and in any event within 7 days thereafter, in each case as required by the PDPA and the Commissioner's guidelines.
Where a breach affects Customer Content that we process on a Customer's behalf, we will notify the affected Customer without undue delay after becoming aware of it, so that the Customer can meet its own notification obligations, and we will provide the information and assistance the Customer reasonably needs.
13. Children, changes and language
Children. The Service is intended for business and professional use by persons aged 18 and above. We do not knowingly collect personal data from anyone under 18 as a data user. If you believe a minor has provided us with personal data, contact us and we will delete it.
Third-party links. The Service may link to third-party websites or software, including accounting software you connect. Their privacy practices are governed by their own policies, which we encourage you to read.
Changes to this Policy. We may update this Policy from time to time. The "last updated" date at the top of this Policy shows when it was last revised. If we make material changes, we will notify you by email or by a prominent notice within the Service at least 14 days before the change takes effect. Your continued use of the Service after that date constitutes acceptance of the updated Policy. If you do not agree, you may stop using the Service and close your account.
Language. This Policy is issued in English and in Bahasa Malaysia as required by section 7(3) of the PDPA. In the event of any inconsistency between the two versions, the English version prevails.
14. Contact us
Questions, requests or complaints about this Policy or our handling of personal data should be directed to our Data Protection Officer:
Data Protection Officer
CSV Ventures Sdn. Bhd. (202501005320 (1606734-H))
1-1, Jalan 26/70A, Desa Sri Hartamas, 50480 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia
Email: it@krani.ai
Website: krani.ai
If you are not satisfied with our response, you may contact the Personal Data Protection Commissioner of Malaysia at www.pdp.gov.my.