Legal

Privacy Policy

Last updated: 2026-10-26

Data we collect

•Account: email, name, saved language preference for app and transactional emails, hashed password (or OAuth provider identifier).

•Shop: TIN, BRN, MSIC code, address, contact details, LHDN client credentials (AES-GCM encrypted at rest).

•Sign-up prefill from Zoho: when you agree on the envoice connect step in Zoho Books, Zoho Invoice or Zoho CRM, your organisation's name, address, email and phone are sent to envoice.my so the sign-up and shop forms are filled in for you. They are held for 10 minutes until the form reads them, and kept only if you save the form.

•Invoices: full e-invoice data submitted to LHDN, including buyer TIN, IC (masked in logs), totals, items.

•Self-billed e-invoices (for example from Zoho Books expenses or bills, Zoho Invoice expenses, or Zoho CRM purchase orders): the supplier's name, ID (BRN, NRIC or passport number), TIN, address, email and phone, read from your connected system or entered in envoice. They are sent to LHDN only to file the e-invoice on your behalf, and kept with it.

•Documents filed by your previous e-invoice app: when you copy LHDN details from that app in Zoho Books, envoice keeps a read-only record of each one (number, type, date, LHDN UUID and link, buyer or supplier name and TIN, total). No ID numbers, addresses, emails or phone numbers. Kept 7 years, like invoice data.

•Zoho uninstall copy: if you uninstall the envoice extension from Zoho Books or Zoho CRM while envoice is connected, an encrypted copy of the LHDN details in its fields (buyer TIN, ID numbers such as NRIC or passport, SST registration numbers, product LHDN codes and monthly consolidation ticks). It is kept only so that reinstalling puts them back.

•When a Zoho CRM or Zoho Books administrator changes envoice settings or finishes envoice setup inside Zoho CRM or Zoho Books, envoice checks with Zoho that they are an administrator and records their Zoho user ID, name and email (and, for Zoho Books, their Zoho role) with the change in the shop's activity log. When a Zoho CRM user cancels an e-invoice inside Zoho CRM, envoice checks with Zoho who they are (their Zoho user ID, name and email), allows it only if that email belongs to a member of the shop whose role may cancel e-invoices, and records those details with the cancelled e-invoice.

•Zoho CRM extension: when you connect Zoho CRM, envoice reads through the Zoho CRM API, and only when it files, checks or looks up a document, the invoice or purchase order being filed (number, dates, currency, line items, amounts, taxes and the envoice fields on it), its Account, Contact or Vendor (name, address, email, phone, TIN, ID type and number such as BRN, NRIC or passport, SST registration), the Products on its lines (name, code, LHDN classification and tax type), quotes, sales orders and deals for the readiness check, and your organisation's name and ID. envoice writes back into Zoho CRM only its own fields (MyInvois UUID, QR link, QR image, status and document type, and a TIN it looked up), a Note on the invoice or purchase order for each filing outcome, its organisation variables, the envoice fields themselves and, while Block edits is on, one record locking rule. The data is stored in envoice's database in Singapore (Vultr) with the filed e-invoice, and the Zoho tokens are encrypted at rest. When you disconnect, envoice revokes its access at Zoho and deletes the stored tokens. The full list of what is written and when is in the Zoho CRM guide at envoice.my/help/zoho-crm-connect.

•Zoho Invoice extension: when you connect Zoho Invoice, envoice reads through the Zoho Invoice API, and only when it files, checks or looks up a document, the invoice, credit note, retainer invoice or expense being filed (number, dates, currency, line items, amounts, taxes and the envoice fields on it), its customer or vendor (name, address, email, phone, TIN, ID type and number such as BRN, NRIC or passport, SST registration), the items on its lines (name, code and LHDN fields), and your organisation's name and ID. envoice writes back into Zoho Invoice only its own fields (MyInvois status, UUID, link and document type, the Supplier Outside Malaysia tick on expenses, and a TIN it looked up when you click Save TIN to contact) and a Comment on the record for each filing outcome. The data is stored in envoice's database in Singapore (Vultr) with the filed e-invoice, and the Zoho tokens are encrypted at rest. When you disconnect, envoice revokes its access at Zoho and deletes the stored tokens. envoice never deletes your records in Zoho Invoice.

•Loyverse POS: when you connect Loyverse, envoice reads through the Loyverse API your paid receipts and refunds (number, date, store, line items, amounts, discounts, taxes and payment type), your items, taxes, stores and payment types, and, for a receipt that names a customer, that customer's name, email, phone, address and the TIN and BRN you keep in their Customer code or Note. envoice uses them only to file LHDN e-invoices for you: walk-in sales are added to your monthly consolidated e-invoice and business buyers get their own. The data is stored in envoice's database in Singapore (Vultr) with the filed e-invoice, and the Loyverse tokens are encrypted at rest. When you disconnect, envoice removes its Loyverse webhook and deletes the stored tokens.

•Shopify store details: when you connect a Shopify store, envoice reads the store name, contact email, phone and billing address from Shopify through the envoice Shopify app, and fills only the business details you have left empty in your envoice shop. You can change them before your first e-invoice. They are used only as the seller details on your e-invoices, and you can ask for them to be deleted at privacy@envoice.my.

•Zoho Expense extension (claim checker): when you connect Zoho Expense, envoice reads through the Zoho Expense API, and only when you or your report workflow check a claim, the expense (date, amount, currency, report and custom fields) and its receipt image. The receipt is read in memory to find the MyInvois QR code and is never stored. envoice then asks LHDN MyInvois, with your company's own credentials, for that e-invoice's status, total and date. envoice keeps only the result (expense and report IDs, the e-invoice UUID, the proof type, the two totals and when it was checked), with no receipt and no employee or supplier name, and writes back into Zoho Expense only its own custom fields (e-invoice UUID, LHDN proof, checked at). The Zoho tokens are encrypted at rest.

•Zoho Expense self-billing and company e-invoice card: when you self-bill company-paid spend from a supplier outside Malaysia, envoice reads the expense (merchant name, date, amount, currency, exchange rate and whether it is reimbursable) and files a self-billed e-invoice with the merchant name and LHDN's general foreign supplier TIN; staff claims are never filed. If an owner turns on the company e-invoice card, envoice publishes the shop's own business details (name, TIN, BRN, SST number, address, and the email or phone only when the owner chooses) on a public page at envoice.my/e-invoice-details. Turning it off removes the page.

•Access requests from Zoho Books: when you sign in with Zoho, Zoho shares your name and email address with envoice to create your login. If you then use the envoice extension for a Zoho organisation linked to a shop you do not belong to, envoice first checks, with that organisation's own Zoho Books connection, that your email belongs to an active user of the organisation. Only then does it record a request (your user, the shop and the Zoho organisation ID) and show your name and email to the owner of that shop, who approves or declines it. Nothing from the shop is shared with you before approval.

•Request alert emails: if you add extra email addresses to receive buyer request alerts, envoice stores them with your shop and uses them only to send those alerts and the daily summary. Removing an address stops the emails and deletes it.

•Usage: session metadata, IP address, user agent (90-day retention). The envoice app sets only the cookies it needs to work: keeping you signed in and remembering choices such as language and theme. It sets no advertising cookies. On the marketing pages, Cloudflare Zaraz counts events such as demo plays, plan clicks and enquiry topics, with the page language. It sets no cookies, and form entries and contact details are never included. It does not run inside the app or the customer request portal.

•How you found envoice: when you sign up, envoice records how the account was created (for example email, Google sign-in, Shopify or Zoho Books) and, if you arrived from a marketing link, its campaign tags (utm_source, utm_medium, utm_campaign) and the name of the website that linked to us, never its full address. These come from a first-party envoice.my cookie (envoice_ft) kept for up to 30 days and read once at sign-up. They are used only to understand which channels bring customers, are never shared with third parties, and you can ask for them to be deleted at privacy@envoice.my.

•Plan payments: when you pay for an envoice plan, the email you choose for receipts and e-invoices, the plan, amounts, payment status and method, receipt numbers and, if you give them, your business or personal name, TIN, ID (BRN, NRIC, passport or army number), SST number and address, used only to issue your LHDN e-invoice. The ID number and email are encrypted at rest. For businesses paying by quotation and invoice: the company details, contact name and email, and the purchase order number.

•envoice LHDN helper (Chrome extension): when you click Open MyInvois in envoice, the helper reads the TIN shown on your MyInvois Taxpayer Profile to check it matches your shop, and after you click Register it reads the new Client ID and Client Secret that MyInvois shows and puts them into the envoice credentials form in your browser. It sends nothing to envoice or anyone else by itself; the values reach envoice only when you save the form, and are then stored like typed credentials (encrypted at rest). It runs only on myinvois.hasil.gov.my and envoice.my, never on the MyInvois or MyTax login pages, and keeps nothing after the browser closes.

•Enquiries: name, email and what you tell us through the contact form or help chat (such as your current system, invoice volume and message).

How we use it

•Submit invoices to LHDN MyInvois on your behalf using your registered ERP credentials.

•Look up a buyer's TIN on LHDN MyInvois from the ID held in your connected system or entered in envoice (with the buyer's name when the ID alone is not enough), one record at a time or in bulk (for example from Zoho CRM), and save only the TIN, and for a company its SSM registration number, back to that record after you click Save. envoice keeps no copy of the ID.

•Send transactional emails (verification, password reset, pace warnings, billing notifications) in your saved language where available.

•Show your usage analytics on the dashboard.

•Measure aggregate visits to marketing demos, pricing choices and successful enquiries so we can improve the site.

•Reply to and follow up on enquiries you send through the contact form or help chat.

Data retention

Invoice data is retained for 7 years per Malaysian tax law. Logs and session metadata: 90 days. Uploaded CSV file contents: 30 days. Database backups: a copy of the whole database is made every night and stored in Cloudflare R2, encrypted with a key that is not kept on the server, and the last 30 are kept, so data deleted from the service leaves the backups within 30 days. Cancelled subscriptions retain data until the account is deleted by the user. Enquiries are kept while we are in contact with you and deleted on request to privacy@envoice.my. Self-billed e-invoices, including the supplier details on them, are invoice data and are kept for the same 7 years. Bulk TIN check results from Zoho CRM are deleted 30 minutes after the check ends. If you uninstall the envoice extension from Zoho Books or Zoho CRM while envoice is connected, we keep the encrypted copy of the LHDN details from its fields for up to 30 days. We delete it once reinstalling has put the details back, or after 30 days, whichever comes first. To delete it sooner, email privacy@envoice.my. For Zoho CRM, if the extension is still uninstalled after those 30 days, envoice also deletes the envoice fields it created in your Zoho CRM by API (Zoho removes the fields that came with the extension at uninstall), then revokes its Zoho CRM access at Zoho and deletes the stored tokens, which it keeps until then only to delete those fields. envoice never deletes your records.

Your rights (PDPA 2010)

Under the Personal Data Protection Act 2010 (PDPA 2010, Malaysia) you have the right to access, correct, and delete your personal data.

•Export: Download a copy of your data from Account Settings or email privacy@envoice.my.

•Delete: Go to Account Settings and use the Delete Account option. Invoice records are retained for 7 years per Malaysian tax law; all other personal data is removed immediately.

•Correct: Update your name and contact details directly in Account Settings. For shop/TIN corrections, contact privacy@envoice.my.

•For B2B data processor obligations, see our Data Processing Agreement.

Third parties (processors)

We share data only with processors that help us run the service: LHDN MyInvois (invoice submission and TIN lookups), Truestack (SSM company register search: receives the company name a user searches for and returns its registration number, only when a user clicks Find in SSM in the app, Search on a buyer request form, or Search or Lookup TIN in the envoice Zoho CRM panels; Truestack does not keep the search results), Google (Places API address search: receives the address text a user types in an address field, or in Get address in the envoice Zoho Books and Zoho CRM panels, and returns address suggestions, only when the address search is on), Stripe (card payments and subscriptions), CHIP (payments for envoice plans by FPX, card and e-wallet: CHIP receives your name, billing email and the amount, and returns the payment status to us. Card details are entered on the CHIP payment page and held by CHIP, never by envoice. For automatic renewals CHIP keeps a card token, and envoice stores only the token reference and the card brand and last four digits; turning auto-renew off or cancelling deletes the token. Plan payment records, receipts and their e-invoices are kept 7 years as tax records), Resend (transactional email), Cloudflare R2 (PDF storage and nightly database backups) and Cloudflare (content delivery, marketing-site analytics, and Turnstile, a bot check that runs only when you use the website chat: it processes browser and device signals to tell people from bots, and envoice keeps only a 30 minute pass cookie), Vultr in Singapore (application and database hosting), Sentry (error monitoring), Anthropic (answers to help-chat questions on the website and in the app; the in-app help chat sends only your questions and envoice guide text, never your shop or invoice data, and questions it cannot answer are kept up to 90 days to improve the guides, with emails, phone numbers, IC numbers and TINs masked and no link to your account; column suggestions on CSV upload send only the header row and up to 5 sample rows, with names, addresses, emails, phone numbers, IC numbers and TINs masked first, to suggest which column fits each field; explanations of LHDN rejections, with buyer and seller identifiers removed; MSIC code suggestions, which send only the business description you type; reading a supplier bill you upload on a self-billed invoice, where the file is sent once to read its details into the form and is not stored by envoice; and drafts of envoice support replies, with emails, phone numbers, IC numbers and TINs masked first), Zoho (our business email), and Aplikasi, our Zoho partner, which receives a copy of messages sent to support@envoice.my in its Zoho Desk helpdesk to help answer support requests. To answer those requests, Aplikasi staff may view limited account and document status details, with buyer identifiers masked, and every such view is logged. We never sell your data or share it for marketing.

International transfers

Some processors above operate outside Malaysia (for example, application and database hosting in Singapore, and email, monitoring, and payment services in the US or EU). Where data is transferred abroad it is protected by the processor’s contractual data-protection commitments.

Data Protection Officer

Our Data Protection Officer oversees PDPA compliance and handles data-related requests and complaints. Contact the DPO at privacy@envoice.my.

Data breaches

If a personal-data breach likely to cause significant harm occurs, we will notify the Personal Data Protection Commissioner and any affected individuals without undue delay, in line with the PDPA.

Not affiliated

This service is not affiliated with or endorsed by LHDN. We are an independent tool to help you comply with their e-invoice mandate.