Privacy Policy

This Privacy Policy describes how 3 Orbit Solutions Sdn. Bhd. (Company Registration No. 202501010528 (1602942-M)), the operator of FlowAudit AI, collects, uses, stores, and protects personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and applicable data protection legislation.

By accessing or using FlowAudit AI, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

We collect personal data only to the extent necessary to provide our services. This includes:

1.1 Account & Identity Information

• Full name, professional designation, and email address
• Firm name, SSM registration number, and business address
• Account credentials (passwords are hashed and never stored in plain text)

1.2 Professional & Engagement Data

• Financial documents, transaction data, and audit-related materials uploaded by you
• Outputs generated by the platform, including workpapers and risk assessments
• Engagement metadata such as client names, engagement titles, and timestamps

1.3 Technical & Usage Data

• IP address, browser type, device type, and operating system
• Log data including pages accessed, features used, and session duration
• Cookies and similar tracking technologies (see Section 7)

Your personal data is used solely for the following purposes:

• To create, manage, and maintain your account and firm profile
• To process documents, run analysis pipelines, and generate audit outputs
• To communicate with you regarding your account, subscription, security notices, and platform updates
• To process billing and subscription management
• To detect, investigate, and prevent fraudulent activity, security breaches, and misuse of the platform
• To comply with our legal and regulatory obligations under Malaysian law
• To improve platform performance, reliability, and user experience (using aggregated, anonymised data where possible)

We do not use your data for advertising, profiling, or any purpose beyond what is stated above.

We process your personal data under the following legal bases:

• Contractual necessity — processing required to deliver the services you have signed up for
• Consent — where you have expressly consented to a specific use of your data
• Legal obligation — where we are required to process data to comply with applicable law
• Legitimate interests — for platform security, fraud prevention, and service improvement, where such interests do not override your rights

We do not sell, rent, or trade your personal data to any third party. We may engage trusted service providers to support the operation of FlowAudit AI. These providers are bound by strict data processing agreements and are contractually prohibited from using your data for any purpose other than delivering services on our behalf.

We may also disclose your data where required by law, court order, or regulatory directive, or where disclosure is necessary to protect the rights, safety, or property of 3 Orbit Solutions Sdn. Bhd., our users, or the public.

No personal data is disclosed beyond what is strictly necessary for the above purposes.

We retain your personal data for as long as your account remains active or as required to fulfil the purposes described in this Policy. Specifically:

• Account and profile data is retained for the duration of your subscription and for up to 7 years thereafter, in accordance with Malaysian statutory record-keeping requirements
• Uploaded financial documents and engagement data are retained for the period specified in your subscription plan
• Technical logs are retained for a maximum of 12 months
• Upon account closure, personal data is securely deleted or anonymised within 90 days, unless retention is required by law

We implement and maintain appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication requirements for all system access
• Regular security assessments and monitoring
• Restricted internal access to personal data on a need-to-know basis

While we take all reasonable precautions, no system is completely secure. In the event of a data breach that poses a risk to your rights, we will notify affected users as required under applicable law.

To report a security concern, contact security@flowaudit.my.

FlowAudit AI uses cookies and similar technologies to maintain session state, ensure platform security, and understand aggregate usage patterns. We do not use cookies for advertising or cross-site tracking.

You may configure your browser to refuse cookies, though doing so may affect the functionality of certain platform features.

Under the PDPA and applicable law, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you
• Right to correction — to request correction of inaccurate or incomplete data
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
• Right to erasure — to request deletion of your data, subject to legal retention obligations
• Right to restrict processing — in certain circumstances, to request that we limit how we use your data

To exercise any of the above rights, submit a written request to privacy@flowaudit.my. We will respond within 30 days. We may require identity verification before processing your request.

Your data is primarily processed and stored in Malaysia and the Asia-Pacific region. Where data is transferred outside of Malaysia, we ensure that adequate safeguards are in place consistent with the requirements of the PDPA, including contractual protections with relevant service providers.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. Material changes will be communicated via email or a prominent notice on the platform. The effective date at the top of this Policy will be updated accordingly.

Continued use of FlowAudit AI following any changes constitutes acceptance of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us: