Legal

Privacy Policy

Last updated: 2026-10-16

Data we collect

•Account: email, name, saved language preference for app and transactional emails, hashed password (or OAuth provider identifier).

•Shop: TIN, BRN, MSIC code, address, contact details, LHDN client credentials (AES-GCM encrypted at rest).

•Sign-up prefill from Zoho: when you agree on the envoice connect step in Zoho Books or Zoho CRM, your organisation's name, address, email and phone are sent to envoice.my so the sign-up and shop forms are filled in for you. They are held for 10 minutes until the form reads them, and kept only if you save the form.

•Invoices: full e-invoice data submitted to LHDN, including buyer TIN, IC (masked in logs), totals, items.

•Self-billed e-invoices (for example from Zoho Books expenses or bills, or Zoho CRM purchase orders): the supplier's name, ID (BRN, NRIC or passport number), TIN, address, email and phone, read from your connected system or entered in envoice. They are sent to LHDN only to file the e-invoice on your behalf, and kept with it.

•Zoho uninstall copy: if you uninstall the envoice extension from Zoho Books or Zoho CRM while envoice is connected, an encrypted copy of the LHDN details in its fields (buyer TIN, ID numbers such as NRIC or passport, SST registration numbers, product LHDN codes and monthly consolidation ticks). It is kept only so that reinstalling puts them back.

•When a Zoho CRM administrator changes envoice settings inside Zoho CRM, envoice checks with Zoho that they are an administrator and records their Zoho user ID, name and email with the change in the shop's activity log. When a Zoho CRM user cancels an e-invoice inside Zoho CRM, envoice checks with Zoho who they are (their Zoho user ID, name and email), allows it only if that email belongs to a member of the shop whose role may cancel e-invoices, and records those details with the cancelled e-invoice.

•Zoho CRM extension: when you connect Zoho CRM, envoice reads through the Zoho CRM API, and only when it files, checks or looks up a document, the invoice or purchase order being filed (number, dates, currency, line items, amounts, taxes and the envoice fields on it), its Account, Contact or Vendor (name, address, email, phone, TIN, ID type and number such as BRN, NRIC or passport, SST registration), the Products on its lines (name, code, LHDN classification and tax type), quotes, sales orders and deals for the readiness check, and your organisation's name and ID. envoice writes back into Zoho CRM only its own fields (MyInvois UUID, QR link, QR image, status and document type, and a TIN it looked up), a Note on the invoice or purchase order for each filing outcome, its organisation variables, the envoice fields themselves and, while Block edits is on, one record locking rule. The data is stored in envoice's database in Singapore (Vultr) with the filed e-invoice, and the Zoho tokens are encrypted at rest. When you disconnect, envoice revokes its access at Zoho and deletes the stored tokens. The full list of what is written and when is in the Zoho CRM guide at envoice.my/help/zoho-crm-connect.

•Access requests from Zoho Books: when you sign in with Zoho, Zoho shares your name and email address with envoice to create your login. If you then use the envoice extension for a Zoho organisation linked to a shop you do not belong to, envoice first checks, with that organisation's own Zoho Books connection, that your email belongs to an active user of the organisation. Only then does it record a request (your user, the shop and the Zoho organisation ID) and show your name and email to the owner of that shop, who approves or declines it. Nothing from the shop is shared with you before approval.

•Usage: session metadata, IP address, user agent (90-day retention). On the marketing pages, Cloudflare Zaraz counts events such as demo plays, plan clicks and enquiry topics, with the page language. It sets no cookies, and form entries and contact details are never included. It does not run inside the app or the customer request portal.

•Plan payments: when you pay for an envoice plan, the email you choose for receipts and e-invoices, the plan, amounts, payment status and method, receipt numbers and, if you give them, your business or personal name, TIN, ID (BRN, NRIC, passport or army number), SST number and address, used only to issue your LHDN e-invoice. The ID number and email are encrypted at rest. For businesses paying by quotation and invoice: the company details, contact name and email, and the purchase order number.

•Enquiries: name, email and what you tell us through the contact form or help chat (such as your current system, invoice volume and message).

How we use it

•Submit invoices to LHDN MyInvois on your behalf using your registered ERP credentials.

•Look up a buyer's TIN on LHDN MyInvois from the ID held in your connected system or entered in envoice (with the buyer's name when the ID alone is not enough), one record at a time or in bulk (for example from Zoho CRM), and save only the TIN back to that record. envoice keeps no copy of the ID.

•Send transactional emails (verification, password reset, pace warnings, billing notifications) in your saved language where available.

•Show your usage analytics on the dashboard.

•Measure aggregate visits to marketing demos, pricing choices and successful enquiries so we can improve the site.

•Reply to and follow up on enquiries you send through the contact form or help chat.

Data retention

Invoice data is retained for 7 years per Malaysian tax law. Logs and session metadata: 90 days. Database backups: a copy of the whole database is made every night and stored in Cloudflare R2, and the last 30 are kept, so data deleted from the service leaves the backups within 30 days. Cancelled subscriptions retain data until the account is deleted by the user. Enquiries are kept while we are in contact with you and deleted on request to privacy@envoice.my. Self-billed e-invoices, including the supplier details on them, are invoice data and are kept for the same 7 years. Bulk TIN check results from Zoho CRM are deleted 30 minutes after the check ends. If you uninstall the envoice extension from Zoho Books or Zoho CRM while envoice is connected, we keep the encrypted copy of the LHDN details from its fields for up to 30 days. We delete it once reinstalling has put the details back, or after 30 days, whichever comes first. To delete it sooner, email privacy@envoice.my. For Zoho CRM, if the extension is still uninstalled after those 30 days, envoice also deletes the envoice fields it created in your Zoho CRM by API (Zoho removes the fields that came with the extension at uninstall), then revokes its Zoho CRM access at Zoho and deletes the stored tokens, which it keeps until then only to delete those fields. envoice never deletes your records.

Your rights (PDPA 2010)

Under the Personal Data Protection Act 2010 (PDPA 2010, Malaysia) you have the right to access, correct, and delete your personal data.

•Export: Download a copy of your data from Account Settings or email privacy@envoice.my.

•Delete: Go to Account Settings and use the Delete Account option. Invoice records are retained for 7 years per Malaysian tax law; all other personal data is removed immediately.

•Correct: Update your name and contact details directly in Account Settings. For shop/TIN corrections, contact privacy@envoice.my.

•For B2B data processor obligations, see our Data Processing Agreement.

Third parties (processors)

We share data only with processors that help us run the service: LHDN MyInvois (invoice submission and TIN lookups), Stripe (card payments and subscriptions), CHIP (payments for envoice plans by FPX, card and e-wallet: CHIP receives your name, billing email and the amount, and returns the payment status to us. Card details are entered on the CHIP payment page and held by CHIP, never by envoice. For automatic renewals CHIP keeps a card token, and envoice stores only the token reference and the card brand and last four digits; turning auto-renew off or cancelling deletes the token. Plan payment records, receipts and their e-invoices are kept 7 years as tax records), Resend (transactional email), Cloudflare R2 (PDF storage and nightly database backups) and Cloudflare (content delivery and marketing-site analytics), Vultr in Singapore (application and database hosting), Sentry (error monitoring), Anthropic (answers to help-chat questions), Zoho (our business email), and Aplikasi, our Zoho partner, which receives a copy of messages sent to support@envoice.my in its Zoho Desk helpdesk to help answer support requests. To answer those requests, Aplikasi staff may view limited account and document status details, with buyer identifiers masked, and every such view is logged. We never sell your data or share it for marketing.

International transfers

Some processors above operate outside Malaysia (for example, application and database hosting in Singapore, and email, monitoring, and payment services in the US or EU). Where data is transferred abroad it is protected by the processor’s contractual data-protection commitments.

Data Protection Officer

Our Data Protection Officer oversees PDPA compliance and handles data-related requests and complaints. Contact the DPO at privacy@envoice.my.

Data breaches

If a personal-data breach likely to cause significant harm occurs, we will notify the Personal Data Protection Commissioner and any affected individuals without undue delay, in line with the PDPA.

Not affiliated

This service is not affiliated with or endorsed by LHDN. We are an independent tool to help you comply with their e-invoice mandate.