How Angka handles your data
Personal data notice under the Personal Data Protection Act 2010. Last changed 14 October 2026. Pilot edition.
Angka is a bookkeeping assistant for small businesses, run by REKA Inisiatif Sdn Bhd (“REKA”, “we”). You give it bank statements, invoices, receipts and notes; it works out what they mean and keeps the evidence together. This page says what we hold, why, who else sees it, and what you can do about it. A version in Bahasa Malaysia is available on request.
What we hold
- Your account: name, email address, a hashed password, and when you signed in.
- Your workspace: the business name, registration details you type in, the people you invite and their roles.
- Chats you connect: if you link Telegram or WhatsApp to send in receipts, the chat id or phone number, the name shown there, and the files and captions you send.
- Your records: every file you add or email in (statements, invoices, receipts, contracts, photos, recordings), the emails themselves, the bank lines read from statements, the activities, people, notes and figures Angka builds from them, and the trail of who confirmed what.
- Other people’s details inside your records: the names, account numbers and amounts of the clients, suppliers, employees and agencies that appear on your documents. You are responsible for having the right to keep those records; we process them only for you.
- How the service ran: which AI model read which document, what it cost, whether it was right, and errors the app hit. Never the contents of your books beyond what a specific error needs.
Why
- To do what you asked: read your documents, keep your books, show your figures, hand them to your accountant.
- To keep the service working: sign you in, route your emails, fix faults, stop abuse.
- To improve accuracy: a small set of made-up documents is used to test each change; your real documents are not added to it without your written yes.
We do not sell personal data, and we do not use your records to advertise anything to anyone.
Who else sees it
| Who | What they get | Where |
|---|---|---|
| Supabase | The database and the file store. Everything above lives here, encrypted at rest, in one private store where each workspace has its own folder. | Singapore |
| Vercel | Runs the app. Sees requests as they pass; keeps logs for a short time. | Singapore (functions), global edge |
| Cloudflare | Receives email sent to your workspace address and hands it to the app, and keeps the nightly backups, encrypted with our key, for thirty days. | Global |
| Google, Anthropic and OpenAI | AI models do the reading. One of them reads each document you add or email in (with the email’s subject, sender and text), each bank statement, and batches of bank lines (the description, date and amount) to pull out the figures, the dates and the names. When you ask Angka a question, the model gets the figures Angka has already worked out for your business that bear on it, and puts the answer in words. Voice notes are turned into text by Google. To check the first reading, a model from another of these three sometimes reads the same document again. Each gets your business name with what it reads, nothing else about you, under API terms that do not train models on what is sent. | United States |
| Resend | Sends the emails Angka and Lapis send: sign-in and password links, invitations, your monthly summary, documents you send to your customers, and service notices. It gets the recipient’s address and the message, and tells us whether it was delivered, bounced or opened. | United States |
| Telegram and WhatsApp (Meta) | Only if you connect a chat: what you send there passes through them to Angka, and Angka replies in the same chat. | Global |
| People you share with | A read-only link you make shows one activity, one month or the document list to whoever holds it, until you revoke it. | Wherever they are |
Some of this data therefore leaves Malaysia. Each provider is bound by its own contract to keep it confidential and to use it only to provide the service. We will tell you on this page before adding another.
How long
For as long as your workspace exists. Delete a document and it is gone from the store at once; delete the workspace and everything in it, files included, is removed, with a backup copy expiring within thirty days. Records of what the service did (which model read what, at what cost) are kept without the documents themselves.
Your rights
- See it: everything Angka holds about your workspace can be exported in one go from Settings, as a bundle you can open without Angka.
- Correct it: every figure Angka read can be changed in the app; your own details are under Settings.
- Take it back: an owner can delete the workspace from Settings, or you can ask us to. You can leave a business, or delete your own account, from Your account.
- Say no: ask and we switch AI off for your workspace; Angka then keeps only what you type.
For any of these, or a question this page does not answer, write to haziqfaris@reka.re. We answer within twenty-one days, usually far sooner.
Keeping it safe
Every row in the database is tied to one workspace and the database itself refuses to show it to anyone else; we check that rule with a test against the live database. Files are reachable only through links that expire. Passwords are hashed, never stored. Operators at REKA see counts, names and costs in order to run the service. To help you with a problem, a named operator can open a read-only view of your workspace for at most thirty minutes; they cannot change anything, and every such view is recorded with who opened it and why.
See also the terms of use.