Privacy Policy

This Privacy Policy explains how QUANTX SDN. BHD. (SSM No. 202601019058) (“QuantX”, “we” or “us”) collects, uses, discloses and protects personal data when you use the QuantX website, platform, mobile application and related services (the “Service”). It is our notice under the Personal Data Protection Act 2010 (“PDPA”).

By using the Service or giving us personal data, you agree to that data being processed as described in this policy.

We process personal data in two different roles:

• As data user. For the personal data of our clients’ authorised users, business contacts and website visitors — for example, your name and email when you sign in — QuantX decides how the data is used and is responsible for it under the PDPA.
• On behalf of our clients. Documents our clients upload, such as invoices and bank statements, often contain personal data about other people, such as suppliers, customers or employees. For that data, our client is the data user, and QuantX processes it on the client’s behalf and according to its instructions. If your personal data appears in a document a business has uploaded, please contact that business first.

• Account and contact data: your name, email address, the account identifier and basic profile information Google provides when you sign in, phone number, job role, and the company you belong to.
• Business documents and records: invoices, receipts, bank statements, payment records and related data uploaded to or generated by the Service. These may include names, addresses, phone numbers, email addresses, identity or business registration numbers, tax identification numbers and bank account details.
• Communications: messages you send us by email, WhatsApp or Telegram, or through the Service.
• Usage and technical data: activity logs, IP address, device and browser information, and the date and time of actions in the Service.
• Billing data: invoicing details and records of payments.

We collect personal data:

• directly from you;
• from your organisation, for example when an administrator gives you access;
• from Google, when you sign in with your Google account;
• from systems you connect to the Service, such as your accounting software and LHDN’s MyInvois system; and
• automatically, when you use the Service.

• to provide and operate the Service, including signing you in, extracting data from documents using automated and AI tools, preparing and posting entries to your accounting software, submitting e-Invoices, and producing reports;
• to provide support and send service, security and account notices;
• to issue invoices, collect payments and manage our client relationships;
• to keep the Service secure, prevent fraud and maintain audit records;
• to maintain and improve the Service, including the accuracy of automated extraction and matching;
• to send you information about QuantX services, which you may opt out of at any time; and
• to comply with law, respond to authorities, and establish, exercise or defend legal claims.

Account and contact data is obligatory to use the Service; if you do not provide it, we cannot give you access. Providing personal data for marketing is voluntary, and not providing it does not affect your use of the Service.

We may disclose personal data to:

• service providers who host, store and process data for us, including cloud hosting and storage (Google Cloud, Firebase and Google Drive), AI document processing (Google Gemini), and email delivery;
• messaging platforms such as WhatsApp and Telegram, when you communicate with us or use our assistant through them;
• your accounting software and other systems you connect, such as AutoCount and LHDN’s MyInvois system;
• administrators and authorised users of your organisation;
• our professional advisers, auditors and insurers;
• a buyer or successor, if QuantX’s business or assets are sold, merged or restructured; and
• regulators, law enforcement agencies, courts and other authorities, where required or permitted by law.

We do not sell personal data.

Our service providers may store and process personal data in data centres outside Malaysia. When personal data is transferred outside Malaysia, we take the steps the PDPA requires so that it continues to be protected to a standard consistent with the PDPA.

We use administrative, technical and physical safeguards, including encryption in transit, role-based access controls, audit logging and backups. No system is completely secure, and we cannot guarantee the security of personal data.

If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and affected individuals where the PDPA requires us to.

• We keep personal data for as long as it is needed for the purposes in this policy, and while your organisation’s subscription is active.
• After a subscription ends, we keep client data for up to thirty (30) days so that an export can be requested, then delete or anonymise it, unless we must keep it longer.
• We keep billing and transaction records for seven (7) years, or longer where the law requires.
• Copies held in backups are deleted as those backups are routinely replaced.

Under the PDPA, you may:

• request access to your personal data;
• request correction of personal data that is inaccurate, incomplete, misleading or out of date;
• withdraw your consent to our processing of your personal data;
• ask us to stop, or not to begin, using your personal data for direct marketing; and
• ask for your personal data to be transmitted to another data user, where technically feasible.

To make a request, email us using the details below. We will verify your identity and respond within the time the PDPA allows, which is twenty-one (21) days for access and correction requests. We may charge a fee for access requests as permitted under the PDPA, and may refuse a request where the PDPA allows.

If you withdraw consent or ask us to limit processing, we may be unable to continue providing the Service to you.

For personal data in documents uploaded by one of our clients, please direct your request to that client; we will assist them as required.

We use cookies and browser storage that are necessary to sign you in, keep your session secure and remember your settings. We do not currently use advertising cookies or third-party analytics cookies. If we introduce them, we will update this policy.

The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. We will publish the updated policy on this page, change the “Last updated” date, and notify clients of material changes by email or within the Service.

For questions, requests or complaints about personal data, contact our Data Protection Officer:

Data Protection Officer
QUANTX SDN. BHD. (SSM No. 202601019058)
C-2-28, Block C, Pusat Komersial Bayu Tasek, Persiaran Southkey 1, Kota Southkey, 80150 Johor Bahru, Johor.
Phone: +6013-5281111
Email: hello@quantx.tech (subject: “Personal Data Request”)

This Privacy Policy is available in English and in Bahasa Malaysia. If the two versions are inconsistent, the English version prevails.