Skip to content
Legal

Privacy Policy

Last updated

01Introduction

CukaiMax ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our tax deduction tracking service, in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA).

02Information We Collect

2.1Personal Information

  • Name and email address (for account creation)
  • Payment information (processed securely via third-party providers)
  • Tax-related data (deduction categories, receipt amounts)
  • Receipt images and documents (stored encrypted)
  • Forwarded emails containing receipts (parsed for attachments and receipt data only)

2.2Camera Access

The CukaiMax mobile app may access your device camera for receipt scanning purposes. Camera data is only used for capturing receipt images and is not used for any other purpose.

2.3Email Forwarding

You may forward emails containing receipts to CukaiMax for automatic processing. Forwarded emails are parsed for attachments and receipt data only. We do not read or store any other content from forwarded emails.

2.4Automatically Collected Information

  • Device information (IP address, browser type)
  • Usage data (pages visited, features used)
  • Cookies and tracking technologies

2.5Public AI Agent and MCP Service

The public CukaiMax Tax Authority MCP is anonymous, read-only, and stateless. Tool arguments are processed in memory to produce a response. We do not persist raw prompts, taxpayer payloads, names, identification numbers, credentials, receipt images, account data, or financial amounts from public MCP calls. Privacy-safe audit events contain operation, release, rule, source, input-shape, and output-status metadata without the underlying taxpayer values. Standard infrastructure may temporarily process IP address, user agent, timestamps, and rate-limit counters for security, abuse prevention, and reliability. Do not send direct identifiers, credentials, receipts, or account data to the public endpoint.

03How We Use Your Information

We use collected information to:

  • Provide and maintain the CukaiMax service
  • Process your tax deduction tracking requests
  • Send service-related communications
  • Improve our service and develop new features
  • Comply with legal obligations (LHDN retention requirements)

3.1AI Processing of Receipts

Receipt images and forwarded email attachments may be processed by third-party AI services (OpenAI and Anthropic) for text extraction and automatic tax categorization. This AI processing is used solely for providing the receipt scanning and tax categorization features of our service. Receipt data sent to AI providers is processed in real-time and is not used for training their models.

04Data Security

We implement industry-standard security measures:

  • AES-256 encryption for data at rest
  • SSL/TLS encryption for data in transit
  • Regular security audits and monitoring
  • Access controls and authentication

05Data Retention

In compliance with LHDN requirements, we retain your receipts and tax data for 7 years from the date of upload. You may request earlier deletion, subject to legal obligations.

06Your Rights (PDPA)

Under Malaysia's PDPA, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Withdraw consent (subject to legal obligations)
  • Request data deletion
  • Lodge a complaint with the Personal Data Protection Commissioner

To exercise these rights, contact us at privacy@cukaimax.com

07Third-Party Services

We use trusted third-party services:

  • Supabase (data storage and authentication)
  • PostHog (analytics and usage tracking)
  • OpenAI/Anthropic (AI-powered receipt text extraction and categorization)

These providers have their own privacy policies and are GDPR/PDPA compliant.

08Cookies

We use essential cookies for authentication and analytics cookies to understand usage patterns. You can control cookie preferences in your browser.

09Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last Updated" date. Continued use of the service constitutes acceptance of changes.

10Contact Us

For privacy-related inquiries: