Privacy Policy · Notis Privasi

LazyHuman BOS (lazyhumanbegin.com) · Personal Data Protection Act 2010 notice · Last updated 3 October 2026

Notis ringkas (Bahasa Malaysia): LazyHuman BOS menyimpan data akaun anda (nama perniagaan, e-mel) dan rekod perniagaan yang anda masukkan (jualan, inventori, maklumat pekerja termasuk nombor KP dan gaji untuk pengiraan payroll). Data anda disimpan dengan selamat di pangkalan data awan, tidak dijual kepada sesiapa, dan hanya digunakan untuk menjalankan perkhidmatan ini. Anda berhak mengakses, membetulkan, atau meminta pemadaman data anda pada bila-bila masa — hubungi info@lazyhumanbegin.com. Jika anda sendiri menyambungkan aplikasi AI (contohnya Claude atau ChatGPT), aplikasi itu boleh membaca angka perniagaan anda dan — hanya jika anda benarkan — merekod untuk anda; ia tidak pernah menerima nombor telefon, e-mel, nombor KP, alamat, akaun bank atau gaji, dan anda boleh memutuskan sambungan pada bila-bila masa. Notis penuh dalam Bahasa Inggeris di bawah; hubungi kami untuk penjelasan dalam Bahasa Malaysia.

🔒 Is my data safe? (the short answer)
What we keep: only what you enter — sales, stock, customers, invoices, staff records. We never touch your money, and we never sell your data.
Where: a secure professional cloud (the same class of technology Xero, QuickBooks and banks use) — encrypted in transit and at rest, not on anyone's shop computer.
Who can see it: only you. Every business is locked in its own vault at the database level; your staff see only what you allow, and you can cut a staff login in one click.
Signing in: with your Google account (Google's own protection guards it) or your email and password — your password is stored scrambled, and we never see it.
AI apps (Claude, ChatGPT…): only if you connect one yourself. It sees names and business figures — never phone numbers, emails, IC numbers, addresses, bank accounts or pay — and you can disconnect it any time (section 5).
If your phone is lost: nothing is lost — automatic nightly backups (with a tested restore) mean you just log in from any device and everything is there.

1. Who we are

LazyHuman BOS is operated from Malaysia at lazyhumanbegin.com. For anything about your personal data, contact info@lazyhumanbegin.com.

2. What we collect

Account data: your business name, email address, and password (stored hashed — we never see it). Business records you enter: sales, purchases, inventory, customers, suppliers, documents, and staff records — which may include employees' names, NRIC numbers, salaries, bank account numbers, and statutory numbers, entered by you for payroll and HR purposes. Technical data: error logs and basic usage counters needed to keep the service healthy. We do not collect data from your device beyond what the app needs to function.

3. Whose data it is

For your employees' and customers' personal data, you (the business owner) are the data user under the PDPA — you decide what to record and must have the right to record it. LazyHuman processes it solely on your behalf to provide the service (for example, computing payroll from the salary you entered). We never use your business records for anything else.

4. How data is used and shared

Your data is used only to run the service: storing and syncing your records, computing figures, generating documents, and powering the Alpha assistant. We do not sell or rent data. Ever. Data is processed by these infrastructure providers under their own security terms: Supabase (database hosting), Vercel (application hosting), and — for AI chat only — the text of your chat messages is processed by AI providers (DeepSeek; Google Gemini for document reading) to generate responses. Chat text sent to AI providers is the message content you type and relevant business context, not your full database. If you share a read-only accountant link (Tax Agent View), the person holding that link can view the reports you shared until you revoke it. AI apps you connect yourself (Claude, ChatGPT and others) are covered in section 5.

5. AI apps you connect (Claude, ChatGPT and others)

You can choose to connect an outside AI app to LazyHuman so you can ask it about your business in plain words. Nothing is shared with any AI app until you connect one yourself.

How it connects: the AI app sends you to LazyHuman, you sign in and tap Allow. The AI app never gets your LazyHuman password — it receives a key that works only for your business. You can see every connected app, and Disconnect any of them at once, in More → Connected AI.

What it can see: your business figures and records — sales and best sellers, profit and expenses, invoices and who owes you, bills, stock and cash as recorded — including the names of customers, suppliers and staff where an answer needs them.

What it never gets: phone numbers, email addresses, IC or passport numbers, addresses, bank account numbers, anyone's salary or pay, your settings, or free-text notes. These are removed inside LazyHuman before any answer is sent.

Recording for you — only if you allow it: with your permission (a tick on the Allow page, or Allow recording in Connected AI) the AI app can record routine work for you — for example an expense from a receipt photo, or an invoice. It is asked to show you what it will record and wait for your yes. It can never pay, move money or delete. Everything it records is listed in Connected AI with an Undo, and Stop recording takes the permission away immediately. A receipt or invoice file you give it is kept with that record in your Documents (made smaller to save space).

Where your conversation goes: the questions you ask, and the answers LazyHuman sends back, become part of your conversation with that AI company and are kept under its own privacy policy (for example Anthropic for Claude, OpenAI for ChatGPT), which may be outside Malaysia. LazyHuman sends them only because you connected the app and asked. Check that company's settings for how long it keeps your chats and whether it may use them to improve its models.

What we keep: a list of what each connected app looked at and recorded, shown to you in Connected AI so you can check it. As the data user (section 3), connecting an AI app is your choice; because contact and ID details are never sent, what reaches the AI app is limited to names and business figures.

6. Storage, security and retention

Data is stored in cloud infrastructure with per-tenant isolation enforced at the database layer, encrypted in transit, monitored daily, and covered by backups with a practiced restore procedure. We keep your data for as long as your account exists. After account deletion, data is removed from live systems within 30 days (backup copies age out on their own cycle thereafter).

7. Your rights

Under the PDPA you may: access the personal data we hold about you (most of it is simply visible in your app), correct it (editable in-app), withdraw consent, and request deletion of your account and data. Email info@lazyhumanbegin.com — we respond within 21 days. Your employees may direct requests about their data to you as their employer; we will assist you in fulfilling them.

8. Cookies and tracking

The app uses only the storage needed to keep you logged in and to work offline. No advertising trackers, no third-party analytics scripts.

9. Changes

If this notice changes materially, we tell you in-app before the change takes effect.