Privacy Policy

Abby is an AI-powered bookkeeping assistant for small businesses and freelancers across Southeast Asia. We help you log expenses via Telegram and keep a running ledger in Google Sheets — no accounting software required.

When this policy says "Abby," "we," "us," or "our," it refers to the service operator. For privacy questions, contact us at brendan@bklai.my.

We collect the following information when you use Abby:

• ✓Account data: Your email address, and a hashed password or Google OAuth token used for sign-in.
• ✓Financial inputs: Receipt images, PDFs, and text descriptions you send via Telegram. We use these to extract transaction details and categorise them.
• ✓Google account access: An OAuth token scoped to spreadsheets and drive.file only. This lets Abby append rows to the spreadsheet you designate — nothing else.
• ✓Telegram user ID: A numeric identifier provided by Telegram when you start the bot. We use this to route messages to your account.
• ✓Usage data: The number of receipts processed and queries answered each month, used to enforce plan limits and reset allowances.
• ✓Billing data: Payment details are collected and stored by Stripe. We receive a customer ID and subscription status; we never store your card number.

We use the information we collect exclusively to:

• ✓Provide the service — categorise receipts, append rows to your sheet, and answer spending queries in Telegram.
• ✓Enforce plan limits and calculate your monthly allowance reset date.
• ✓Process billing and send transactional emails (receipts, trial reminders, payment failures).
• ✓Diagnose technical issues and improve reliability.

We do not use your data for advertising or sell it to any third party.

Abby relies on the following sub-processors to deliver the service:

Each sub-processor is bound by its own privacy policy and, where applicable, a Data Processing Agreement with us.

Your data is hosted on Supabase infrastructure, with servers in Singapore and the United States. All data is encrypted in transit using TLS 1.2+ and encrypted at rest.

Receipt images and PDFs you send via Telegram are processed to extract transaction details, then deleted from our systems within 24 hours. The extracted structured data (amount, category, date) is retained in your account.

• ✓We do not sell your personal or financial data to any third party.
• ✓We do not use your receipt data or spending history to train AI models.
• ✓We do not read your Google Sheet for anything other than writing the rows you explicitly ask us to append.
• ✓We do not send marketing emails beyond transactional service messages.

Your account data and transaction history are retained for as long as your account is active. If you cancel your subscription and request deletion, we will purge your personal data within 30 days, except where we are required to retain records by law (e.g. billing records for tax purposes, retained for 7 years).

To request account deletion, email brendan@bklai.my with the subject line "Delete my account."

Under the Personal Data Protection Act (PDPA) of Malaysia and Singapore, and similar laws in other jurisdictions where we operate, you have the right to:

• ✓Access the personal data we hold about you.
• ✓Correct inaccurate or incomplete data.
• ✓Request deletion of your data (subject to legal retention obligations).
• ✓Withdraw consent for non-essential data processing.
• ✓Lodge a complaint with your national data protection authority.

To exercise any of these rights, contact us at brendan@bklai.my. We will respond within 30 days.

We use a single session cookie to keep you signed in. We do not use third-party advertising cookies or cross-site tracking. The session cookie is strictly necessary for the service to function and cannot be disabled while you are logged in.

We may update this policy from time to time. If we make material changes — such as processing new categories of personal data or sharing data with additional third parties — we will notify you by email at least 14 days before the change takes effect.

Continued use of Abby after the effective date of an update constitutes acceptance of the revised policy.

For privacy questions, data requests, or complaints: