Privacy Policy

Last updated: 25 July 2026

1. Who We Are

Incorpus is operated by S Rank Sdn. Bhd. (Company No. 202501046409 (1647817-H)) ("Incorpus", "we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, store, protect, retain, and delete personal data and business records when you use incorpus.app and related Incorpus services.

This policy is intended to support compliance with the Personal Data Protection Act 2010 [Act 709] of Malaysia, as amended from time to time. It does not replace any privacy notice, employment notice, customer notice, professional engagement letter, or statutory obligation that your business may need to issue separately.

2. Your Workspace Data

Incorpus provides software for company workspaces. You control what goes into yours: the business records, documents, accounting entries, tax support workpapers, user access decisions, and professional handoff exports you place there. You are responsible for having the right to upload, process, retain, submit, and share that information.

We process workspace data to run the service, keep the platform secure, maintain audit trails, and handle billing and support. We also process it to carry out instructions from authorised users, such as document exports or MyInvois submissions.

3. Information We Collect

3.1 Account and Identity Data

We collect your name, email address, authentication status, workspace membership, roles, permissions, invitation records, and login metadata. Authentication is handled by WorkOS. Incorpus does not store your password.

3.2 Company and Statutory Profile Data

You may provide company names, SSM registration numbers, tax identification numbers, SST details, addresses, entity type, fiscal year settings, document numbering settings, bank account details, and other information needed to run a Malaysian business workspace.

3.3 Business and Financial Records

Incorpus processes the records you create, import, upload, or generate. These include invoices, bills, quotations, receipts, payments, journal entries, bank transactions, attachments, statutory records, compliance tasks, reports, and export packs.

3.4 Integration and Submission Data

If you configure integrations, we process the data those integrations need. That can include MyInvois credentials, certificates, submission payloads, validation responses, email delivery metadata, and payment-link metadata.

3.5 Billing, Support, and Technical Data

We collect subscription status, plan, invoice and payment status, support messages, server logs, IP address, browser and device metadata, error reports, audit logs, and security events. Payment card and FPX processing are handled by Stripe. Incorpus does not store full card numbers.

3.6 Where We Obtain Personal Data

We obtain personal data from you directly; from other members of a workspace who invite you or record your details; from WorkOS when you authenticate and Stripe when you pay; and from the records that you, your colleagues, or an AI agent acting under your credentials create, import, upload, or generate in a workspace.

3.7 Whether You Must Supply It

Some personal data is obligatory. We cannot open an account, create a company workspace, or run a subscription without your name, your email address, the company identity details a Malaysian business workspace needs (company name, registration number, and address), and the billing details Stripe needs to take payment. If you do not supply them, we cannot provide the service, and a workspace cannot continue past the period already paid for.

Everything else is voluntary. The only consequence of withholding voluntary data is that the workflow needing it does not run. Without MyInvois credentials and a digital certificate, e-Invoice submission is unavailable. Without a bank account record and statement rows, bank import and reconciliation are unavailable. Without attachments, a document carries no linked evidence. You decide which business records, and which personal data about other people, you place in your workspace, and you remain responsible for having the right to place them there.

4. How We Use Information

We use information to:

  • Provide, operate, secure, monitor, and improve Incorpus
  • Authenticate users and enforce workspace roles, permissions, and tenant isolation
  • Generate documents, reports, ledgers, workpapers, reminders, and export packs
  • Submit MyInvois data to LHDN when an authorised user configures and initiates that workflow
  • Send transactional emails, document emails, invitations, billing notices, and service updates
  • Process subscriptions, invoices, renewals, cancellations, and usage limits
  • Investigate errors, security incidents, suspected abuse, and support requests
  • Comply with laws, regulations, court orders, government requests, and accounting requirements

5. Service Providers and Disclosure

We do not sell your personal data or workspace data. We disclose information only where needed to:

  • Operate the platform: infrastructure, database, storage, authentication, email, billing, observability, logging, and support providers such as Supabase, Cloudflare, WorkOS, Stripe, Resend, Sentry, and hosting infrastructure providers
  • Complete authorised workflows: LHDN MyInvois submissions, transactional emails, payment links, file downloads, exports, and workspace invitations
  • Support workspace collaboration: users, accountants, company secretaries, auditors, employees, or advisers that a workspace owner or administrator invites or permits
  • Meet legal requirements: where disclosure is required by Malaysian law, regulation, legal process, or a valid government request

6. Cross-Border Processing

Some service providers may process or store information outside Malaysia. Where that happens, we take reasonable steps to use providers and contractual arrangements that support confidentiality, security, and lawful processing of the data.

7. Security

Incorpus uses technical and organisational controls designed to protect data against unauthorised access, disclosure, alteration, and loss. These include role-based access, functional permissions, row-level security for tenant isolation, encrypted and signed session cookies, audit logs, period locks, upload controls, and encrypted document storage support where configured.

No internet service can guarantee perfect security. You remain responsible for choosing trustworthy workspace users, protecting your devices and email accounts, reviewing permissions, and exporting or backing up records that your business must retain.

8. Retention, Cancellation, and Deletion

We retain active workspace data for as long as your subscription or authorised trial remains active. After cancellation, workspace data is retained for 120 days so that you can reactivate or export records, and we email the workspace owner before that window closes.

When the 120 days end, the workspace is destroyed in a single operation: its business records, its audit logs, its account, session, and billing rows, and the files it holds in object storage are deleted from the service. We do not restore a destroyed workspace. We destroy a workspace only once a completed Full Company Data Export from that window exists, because the statutory duty to keep those records is yours, not ours. If no complete export was produced, the workspace is held and flagged for follow-up instead of destroyed. We may still retain specific records where law, billing, security, dispute, or compliance obligations require or permit it.

Malaysian businesses have statutory record-retention obligations, generally seven years for accounting, tax, and SST records. Incorpus helps you store and export records. You remain responsible for exporting and retaining whatever your business, tax agent, accountant, company secretary, or auditor needs after your Incorpus subscription ends.

9. Exports and Portability

Workspace owners can request full company data exports and professional handoff exports such as the Accounting Pack, Audit Pack, Tax Pack, and Compliance Archive. These exports are intended to help you preserve records and provide evidence to accountants, tax agents, company secretaries, auditors, or other authorised advisers.

10. Your Rights

Subject to applicable law, you can ask us to:

  • Give you access to the personal data we hold about you
  • Correct personal data that is inaccurate
  • Stop processing that relies on your consent, by withdrawing that consent
  • Delete personal data, where deletion is available
  • Explain how your personal data is processed

Some requests may be limited by contractual, security, legal, accounting, tax, audit, or fraud-prevention obligations.

You can also limit how personal data is processed, without asking us, by:

  • Removing a workspace member, or changing their role and permissions, to end their access
  • Deleting a document, attachment, or record you no longer want stored, within the accounting controls that keep posted entries auditable
  • Turning off or not configuring an optional workflow, such as MyInvois submission or document emails
  • Clearing your browser storage to remove the preferences described in section 11
  • Cancelling the subscription, exporting your records, and letting the workspace be destroyed under section 8

To make a request, or to ask us to stop or limit a specific processing activity, contact us at fikri@srank.com.my. We may need to verify your identity and workspace authority before we act on a request.

11. Cookies and Local Storage

We use essential cookies for authentication, session security, and OAuth login flows. We do not use third-party advertising cookies. If analytics or additional tracking technologies are introduced later, we will update this policy.

Incorpus also keeps a small amount of data in your browser using local storage and session storage. This covers your theme preference, your sidebar layout preferences, your dismissal of the cookie notice, and the pages you recently visited in a workspace so that navigation returns you to where you left off. This data stays in your browser, is not used for advertising or cross-site tracking, and is removed when you clear your browser storage.

12. Changes to This Policy

We may update this Privacy Policy as the product, law, infrastructure, or service providers change. We will communicate material changes through the service, by email, or by another reasonable method. The date above shows when this page was last revised.

13. Language

This Privacy Policy is provided in English and Bahasa Malaysia. If there is any inconsistency between the versions, the English version prevails.

This notice is given under section 7(1) of the Personal Data Protection Act 2010 [Act 709] and is provided in the national and English languages in line with section 7(3) of that Act.

14. Contact

For questions about this Privacy Policy or our data practices, contact fikri@srank.com.my.