Privacy Policy

lejar.ai ("Lejar") is operated by Iterate Ventures Sdn. Bhd. (Registration No. 202601021291 (1683388-P)), No. 192-3rd Floor, Jalan Changkat Thambi Dollah, 55100 Kuala Lumpur, Malaysia. For the purposes of Malaysia's Personal Data Protection Act 2010 (PDPA), we are the data user for the personal data described in this policy. You can reach us at support@lejar.ai.

Account data: your email address, and the acceptance record of the terms version you agreed to. Business data: the organisations, contacts, documents, and accounting records you and your team enter or upload. Technical data: server logs of requests (such as IP address and timestamps) used for security, rate limiting, and debugging.

Business records you keep may themselves contain personal data about your customers, suppliers, or staff. For that data you are the data user and we process it on your behalf, only to provide the service.

Support data: if you message our team from inside the app, we store that conversation (your messages and our replies) to respond to you and to improve the product. A conversation is visible only to you and to authorised Lejar staff who handle support requests, never to other members of your organisation. Support conversations are covered by the same access, export, and deletion rights described in Your rights below.

We use your data to provide the service: keeping your books, sending sign-in links, showing your records to your invited team members, and producing the documents and reports you request. We also use technical logs to keep the service secure and reliable. We do not sell your data, and we do not use it for third-party advertising.

When you use an AI feature (for example, scanning a receipt or asking the Ask lejar assistant), the content you submit for that request is processed by our AI infrastructure provider (Anthropic) solely to produce the response. We do not permit our providers to use your data to train their models.

Separately, Lejar itself learns from the corrections you approve: a correction can become an explicit rule (for example, matching a supplier to an account) that is stored in your organisation's account and used only to prepare your organisation's future drafts. These rules are not shared across customers and are never used to train AI models. Your organisation can view, export, and delete them at any time in Settings.

We use a small number of infrastructure providers to run the service: Supabase (database and file storage), Vercel (application hosting), Cloudflare (AI gateway routing and Workers AI embeddings; Cloudflare does not train on customer content, per its published Workers AI data usage terms), Anthropic (AI processing, as described above), Google (Google Analytics, for the visitor analytics described in the Cookies section below, and Google Sign-In, if you choose to use it, which shares your name and email address from your Google account to create your login), and Resend (delivery of transactional email, including invoice and statement emails, which carry the PDF and your customer's name and address), and Airwallex (our payment provider for paid plans; when you subscribe, Airwallex receives your billing email, your organisation's legal name, and your card details, which you enter directly with Airwallex and which never touch our servers). Each processes data only to provide their service to us. Exchange rates are fetched from Bank Negara Malaysia's public API; no personal data is sent to it. Where you instruct a transmission to a third party (for example a webhook you configure), we send the data you chose to that destination.

We may disclose data where Malaysian law requires it. Beyond the above, we do not share your data.

Your data is stored and processed on infrastructure located in Singapore (our database, file storage, and application servers run in Singapore regions). AI requests are processed by Anthropic, whose infrastructure is located outside Malaysia. By using the service you consent to these transfers, which the PDPA permits with your consent.

We keep your data while your account and organisations are active. When an organisation is deleted, its records and uploaded files are removed from our live systems, and fade out of infrastructure backups as those expire on a rolling schedule. Remember that deleting your organisation does not relieve your business of its own statutory record-keeping obligations, so export a copy first if you need one.

Under the PDPA you may request access to your personal data, ask us to correct it, withdraw consent to its processing, or ask us to delete it. Email support@lejar.ai and we will respond within the timelines the PDPA sets. Where the app provides self-serve tools (such as data export or organisation deletion), you can also use those directly.

Data is encrypted in transit and at rest, and your most sensitive fields, such as bank account numbers, carry an additional layer of field-level encryption. Every organisation's records are isolated by database-level access rules, so members of one organisation cannot read another's data. Sign-in uses one-time email links rather than stored passwords, and two-factor authentication is available for any member who turns it on. No system is perfectly secure, but if we become aware of a breach affecting your personal data we will notify you as the law requires.

We use session cookies to keep you signed in; these are essential to the service. We also use Google Analytics, which sets measurement cookies (for example, cookies named _ga and _ga_*) so we can see how visitors use the site. We do not use these cookies for advertising or cross-site tracking, and we do not share this analytics data with advertisers.

If you would rather not be measured, install Google's Analytics opt-out browser add-on.

We may update this policy as the product evolves; the version date at the top changes when we do, and material changes will be announced in the app or by email. Questions or requests: support@lejar.ai, or write to Iterate Ventures Sdn. Bhd., No. 192-3rd Floor, Jalan Changkat Thambi Dollah, 55100 Kuala Lumpur, Malaysia.