1. Who We Are

This website, finvo.my, is operated by Rao Tek Sdn Bhd (SSM 202601010737), a company registered in Malaysia. We refer to ourselves as "we" or "us" below. This policy explains how we handle personal data, and it is written with the Malaysian Personal Data Protection Act 2010 (PDPA) in mind. Referring to the PDPA here does not by itself mean every obligation under it has been met in every circumstance; where a specific situation needs more detail, we will provide it separately.

2. What This Policy Covers

This policy covers this website and enquiries made through it, and it describes at a high level how personal data may be handled when Finvo is used. Finvo is currently being made available to selected participants as part of a pre-launch pilot. The types of personal data processed may depend on how Finvo is used. Where additional information or notices are required for a particular service or processing activity, we will provide them separately — this page is not a complete description of how the product processes data in production.

3. Website Visitors

When you browse this site, we and the providers below may process:

Technical data — IP address, browser and device type, and pages viewed, used to serve the site and keep it secure
Analytics and marketing identifiers — cookies or similar identifiers, described in section 5, which are only set if you consent to them

4. Early-Access and Pilot Enquiries

If you ask us about access, we collect what you choose to give us:

Your email address — required, so that we can reply
Your name and business name — optional
Business type, your role, the number of companies or clients you handle, and the accounting software you use today — all optional, and used to understand who is interested and who a pilot would suit

We use this to contact you about access and to decide who to invite into the pilot. We do not sell your data, and we do not share it for anyone else's marketing.

5. Cookies, Analytics and Consent

Only cookies needed to run the site and keep it secure are set by default. Analytics and marketing cookies are set only if you accept them, and you can change your choice at any time through the cookie settings on this site:

Google Analytics — page views and traffic sources (analytics)
PostHog — how the site is used (analytics)
Meta Pixel — measuring whether advertising reaches people (marketing)
Cloudflare — serving the site, and Turnstile, which checks a form was submitted by a person rather than a script (essential)

6. Personal Data in Business Records

Where Finvo is used during the pilot, the business records entered into or imported into it may contain personal information — for example the names and contact details of a participant's customers, suppliers, staff or clients. We process that information as necessary to provide, operate, secure, support and maintain the service, and to comply with legal obligations. We do not use it to build a profile of those individuals, and we do not sell it. Deciding what to enter, and having a proper basis for entering it, is the responsibility of the participant using Finvo.

7. Our Role

Our role depends on the processing, and it is not the same in every case. For this website and for enquiries you send us, we decide the purposes for which your data is used. Where a participant uses Finvo to process their own business records, that participant generally decides what is entered and why, and we handle it in order to provide the service — which may mean we act on their instructions rather than our own. Because the position varies, we do not claim a single fixed role here. Where the roles and responsibilities need to be set out precisely, they will be addressed in the terms or agreement that applies to that participant.

8. Who Else Handles Data

We separate these deliberately, because they are different systems. For this website, we use:

Cloudflare — hosting, content delivery and bot protection
Supabase — the database where enquiries are stored
Google, PostHog and Meta — analytics and measurement, as described in section 5

For the Finvo service, we use Supabase for infrastructure and data storage, and LHDN's MyInvois system where a participant connects it, so that documents can be submitted as the law requires. We may also engage providers for functions such as email delivery, payment processing, error monitoring, product analytics and AI-assisted features. Participants can ask us for the current list of providers used for the service. Some providers operate outside Malaysia, so personal data may be processed or stored outside Malaysia.

9. How Long We Keep It

Enquiry details are kept while we are still in contact with you about access, and we delete them if you ask — ordinarily within 30 days. For data held in the service, we keep it for as long as necessary for the purpose it was provided for, subject to legal, contractual and operational requirements. We have not set a single fixed period for every type of record, and we would rather say so than publish a number we do not apply. Some records are deliberately kept even after a deletion request: accounting ledgers and audit records are designed not to be altered or removed, and some records must be retained to meet legal or tax obligations. If you ask us to delete data, we will tell you what is being retained and why.

10. Security

We use access controls so that data is reachable only by the account and organisation it belongs to, encrypt data in transit, restrict administrative access, and keep records of activity in the service. No system is completely secure, and we do not claim otherwise. If we become aware of an incident affecting personal data, we will act on it and notify those who need to know where it is appropriate or required to do so.

11. Your Rights

Under the PDPA you may:

Ask what personal data we hold about you
Ask us to correct it if it is wrong
Ask us to delete it, subject to the retention position in section 9
Withdraw your consent, including your cookie choices, at any time

If your data is held in Finvo by a business or accounting firm using the service, that organisation usually holds the direct relationship with you. In that case the quickest route is to contact them, and we will support them in responding.

12. Contact

For any request about your data, email support@finvo.my. We aim to respond within 21 days, which is the period the PDPA sets for access requests.

13. Changes

If we change this policy we will update the date at the top of this page. As Finvo moves from the pilot to general availability, the way it processes data will be described in the notices that apply to the service itself, rather than only here.

Privacy Policy