Privacy Policy

AccPilot Software · Registration No. 202603238184 (003886868-X) · Last updated 4 October 2026

The short version

AccPilot reads the receipts, invoices and bank statements a firm sends in, so the firm can check them and export them. To do that we store those documents and what was read from them.
The documents belong to the firm that uploaded them. We handle them on the firm’s instructions and for no other purpose.
We do not sell personal data. The apps carry no advertising, and we do not track you across other companies’ apps or websites from inside the apps.
You can delete your account yourself. The steps are under Delete your account.
Questions or requests: use the form on the support page.

What this policy covers

In this policy, “AccPilot”, “we” and “us” mean the company named at the top of this page, which builds and runs AccPilot.

The policy covers:

the website, accpilot.com
the AccPilot web app, app.accpilot.com
the AccPilot mobile apps for iOS and Android
the client upload link a firm sends to its own clients

Whose data it is

There are two kinds of data, and our role is different for each.

The firm’s documents. Receipts, invoices, bank statements and the details read from them belong to the accounting firm or business that put them into AccPilot. The firm decides what goes in, who can see it and what happens to it. We process it only to provide the service to that firm. If your details appear in a document a firm uploaded (for example, you are the firm’s client, or a supplier named on an invoice), please contact that firm first. We will help the firm answer your request.

Account and website data. Details about the people who use AccPilot or contact us (names, emails, sign-in records, usage, form submissions) are collected by us for our own purposes. We are responsible for that data, and the rest of this policy explains how we handle it.

What we collect

Account details

Your name and email address
Your password, stored in hashed form. We cannot read it
The firm you belong to and your role in it
Your two-step sign-in setup, if you switch it on
Sign-in records: when you signed in, and the device, browser and IP address used

Documents and what is read from them

The files sent in: photos, scans and PDFs of receipts, invoices, bank statements and similar documents
What AccPilot reads from them: vendor, date, document number, amounts, tax and the individual lines
The records the firm keeps around them: client names, chart of accounts, suppliers and customers, bank and card accounts, matches between statement lines and documents
Changes people make: corrections, approvals and the audit trail of who did what and when

These documents can contain personal data about other people, such as a name on a receipt or an account number on a statement. The firm that uploads them is responsible for having the right to do so.

Billing details

The firm’s billing name, address and contact
Plan, credits, invoices and payment status
If you pay by card, the payment is handled by Stripe. We do not see or store the full card number

How the apps are used

Which features are used, how often, and whether an action worked or failed. These records are linked to your account (your name and email) and to your firm (its name and plan). They carry counts, statuses and internal IDs. They do not carry vendor names, file names, search text or anything else read from a document
Device and browser type, operating system, app version, language and time zone
Error and crash reports
In the web app only: session recordings. A recording shows what was on the screen during a visit, which can include the documents and figures you were looking at, together with clicks, and the browser’s console and network logs. Password fields are masked. We use recordings to find and fix problems. The mobile apps do not record your screen

The client upload link

When a firm sends its client an upload link, the client does not need an account. We receive the files the client uploads and any note the client adds, and they go into the firm’s workspace. Usage records for the link are kept without a name.

Forms on the website

Demo requests: name, email, phone number, firm name, state, and the accounting software the firm uses
Job applications: name, email, phone number, the role you are applying for, your current job title, your location, the link you give us and your message
Support messages: name, email, firm name, topic and your message
With each submission we also record the time, the page it came from and the browser used

Cookies and measurement on the website

accpilot.com uses Google Tag Manager to load measurement tags. They tell us which pages and adverts lead to a demo request, and they may set cookies in your browser. You can block or clear cookies in your browser settings and the website will still work.

The web app uses a cookie to keep you signed in. That one is needed for the app to work.

The mobile apps

The AccPilot apps for iOS and Android are for capturing documents on the spot. This is what they use on your phone.

Camera. Used only when you take a picture of a document. The app asks for permission the first time.
Photo library. Used only when you choose existing pictures to upload. Only the pictures you pick are uploaded.
Notifications. If you allow them, we store a push token for your device so we can send you notices about your firm’s documents. You can switch notifications off in your phone’s settings at any time.
Storage on the phone. Your sign-in is kept in the phone’s secure storage. Captures taken while you are offline wait on the phone until they have uploaded. Signing out clears the sign-in.
Usage and diagnostics. The app sends the usage and error records described above, linked to your account, together with an identifier the app creates for that install.

The mobile apps do not collect your location or your contacts, do not record audio or video, do not show adverts, and do not use an advertising identifier. Data from the apps is not used to track you across other companies’ apps or websites.

How we use it

To provide the service: read documents, match statement lines, build exports, and keep documents stored and searchable
To remember corrections for your firm, so the same vendor is read the same way next time
To sign you in and keep accounts secure
To bill the firm and keep the business records the law requires
To answer demo requests, job applications and support messages
To send service messages, such as sign-in codes, team invitations, invoices and notices about your account
To find and fix problems, and to understand which features are used so we can improve them
To measure which of our adverts and pages bring in demo requests
To meet legal obligations and respond to lawful requests

We do not sell personal data, and we do not use the documents a firm uploads for advertising.

We use other companies to run AccPilot. Each one receives only what it needs for its job.

Provider	What it does for us
Northflank	Runs the web app and its servers
Neon	Database
Wasabi	Stores the document files
Upstash	Short-term cache and job queue
OpenRouter, and the model providers it routes to	Reading documents. Document images and text are sent to machine-learning models run by these providers so that the details can be read
Resend	Sends account and service emails
PostHog	Usage analytics, error reports and web app session recordings
Sentry	Error and performance monitoring
Stripe	Card payments
Expo, Apple and Google	Deliver push notifications to your phone
Vercel	Hosts accpilot.com
Google	Tag Manager and fonts on the website, and the spreadsheets where website form submissions are kept
Cloudflare	Domain and network routing, and the check on the sign-up form that keeps automated sign-ups out

We also share data:

Within your firm. People in the same firm see the firm’s documents, according to their role.
When the law requires it. For example, in response to a court order or a lawful request from an authority.
If the business changes hands. If AccPilot is merged or sold, data moves to the new owner under the same commitments, and we will tell account holders.

Where it is kept

The web app and its database run in Singapore. Analytics data is held by PostHog in the United States. Some of the other providers listed above process data outside Malaysia as well.

By using AccPilot you understand that your data may be processed outside Malaysia. Whichever country it is in, we require our providers to protect it and to use it only for the job we gave them.

How long we keep it

Documents. Stored for 7 years from upload. Malaysian tax law requires business records to be kept for that long, and it is the storage period AccPilot offers firms. Deleting a document in the app removes it from the firm’s workspace. The original file stays in archive storage until the 7-year period ends, and is deleted after that.
The audit trail. Kept alongside the firm’s documents for the same period. It cannot be edited.
Account details. Kept while your account is open. Deleted or made anonymous after you delete your account, except for what the law requires us to keep.
Billing records. Kept for 7 years, as the law requires.
Website form submissions. Kept for as long as we need them to deal with your request. Ask us at any time and we will delete yours.
Usage and diagnostic data. Kept for as long as it is useful for running and improving the service, then deleted or made anonymous.

How we protect it

All connections to AccPilot are encrypted in transit.
Each firm’s data is kept separate from every other firm’s.
Access inside a firm is controlled by roles, and two-step sign-in is available.
Passwords are stored hashed.
Changes to documents are recorded in an audit trail.
Our own access to customer data is limited to the people who need it to run and support the service.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

You can:

ask for a copy of the personal data we hold about you
ask us to correct it
withdraw your consent, or ask us to stop or limit how we use it
ask us to delete it
complain to the Personal Data Protection Commissioner of Malaysia

These include your rights under Malaysia’s Personal Data Protection Act 2010.

To use any of these, send a message through the support page. We may need to confirm who you are before we act.

Some details are needed to run your account. If you ask us to stop using them, we may not be able to keep providing the service to you.

If your data is inside a document a firm uploaded, the firm decides what happens to it. Contact the firm first and we will help it respond.

Delete your account

You can delete your own AccPilot account at any time.

Sign in to the web app at app.accpilot.com.
Open Settings → Account.
Choose to delete your account and enter your password.
Open the confirmation link we email you. The link expires after a day. The account is deleted once you confirm.

If you are the only owner of a firm, make someone else an owner on the Team page first, or ask us to close the firm. A firm must always have an owner.

If you cannot sign in, or you only use the mobile app, send a request through the support page from the email address on your account and we will delete it for you.

What is deleted: your account, your sign-in details and your personal profile.

What is kept: the firm’s documents and audit trail, which belong to the firm and stay stored for the period described above, and billing records the law requires us to keep.

To close a whole firm, the firm’s owner should contact us through the support page.

Children

AccPilot is a tool for businesses. It is not meant for anyone under 18, and we do not knowingly collect personal data from children.

Changes to this policy

When we change this policy we update the date at the top of this page. If a change is significant, we will tell account holders by email or inside the app before it takes effect.

Contact

Send privacy questions and requests through the support page. The company responsible for AccPilot is named at the top of this page.