🔒 Privacy Policy

Last updated: March 27, 2026

KasBook AI ("we", "platform") is committed to protecting user data privacy. This document explains how we collect, use, and protect your information.

1. Data We Collect

Account Data

Full name, email address, and phone number (for registration)
Encrypted password (bcrypt hash — we never store your actual password)

Financial Data

Income and expense transactions you input
Account data, savings goals, budgets, assets, and debts/receivables
Receipt/invoice photos you upload for the scan feature

Usage Data

AI chat count, receipt scans, and daily transactions (for quota enforcement)
Login logs (timestamp and IP address for security)

Data We Do NOT Collect

We do not access your contacts, photo gallery, or device data beyond what you explicitly share
We do not sell or share your data with third parties for advertising

2. Use of Data

Your data is used only for:

Providing financial tracking services and AI features
Displaying dashboards, reports, and personal financial analysis
Processing payments through our payment gateways (Dodo Payments / Tripay)
Sending account-related notifications (bill reminders, weekly digest — if enabled)
Improving service quality based on anonymized usage patterns

3. AI Processing

When you use AI chat or receipt scan features, your data is sent to Google Gemini AI for processing. Data sent includes:

Your chat messages and financial context (transaction summaries)
Receipt/invoice images (for scan feature)

If you use a personal API key (BYOK), data is processed through your own Google Cloud project. We recommend users with heightened privacy concerns use their own API key.

4. Credit System

AI Credits are non-refundable and non-transferable once consumed
Unused credits do not expire and remain in your account indefinitely
Booster credits are added to your existing balance and follow the same policy
BYOK usage consumes credits at a reduced rate (one-fifth of standard)

5. Data Security

Transport encryption: All connections use SSL/TLS (HTTPS)
Sensitive data encryption: Passwords hashed with bcrypt; user API keys encrypted with AES-256-GCM
Access control: Each user can only access their own data (Row-Level Security)
Authentication: JSON Web Token (JWT) with limited validity
RBAC: Multi-user workspaces implement role-based access control

6. Storage & Data Retention

Data is stored on servers located in Indonesia
Daily backups are performed to prevent data loss
If you delete your account, all related data will be deleted within 30 days

7. Third Parties

We use the following third-party services:

Google Gemini AI — Natural language processing and OCR
Dodo Payments — International payment processing (Credit/Debit, PayPal)
Tripay — Indonesian payment gateway (QRIS, VA, E-Wallet)

We do not share your financial data with any parties other than those listed above.

8. User Rights

You have the right to:

Access and download your financial data (Export feature)
Update your account information
Delete your account and all related data
Withdraw consent for data processing at any time

9. Cookies & Local Storage

KasBook AI uses cookies for session authentication (JWT token) and theme preferences (dark/light mode). We do not use tracking cookies or third-party analytics.

10. Policy Changes

We may update this privacy policy from time to time. Significant changes will be notified via email or in-app notification at least 14 days before taking effect.

11. Contact

Questions about data privacy? Contact us at [email protected].