Peka Akaun

Dasar Privasi

Privacy Policy · Dikemas kini 4 November 2026

Hanya fail yang anda pilihKami tak boleh lihat fail lain dalam Google Drive anda.
Dikira dalam browserLaporan dikira dalam browser anda, bukan di server kami.
Data kewangan tak disimpanServer kami hanya simpan akaun dan senarai fail anda, bukan isi fail.
BAHASA MELAYU

1. Tentang laman ini

Laman akaun.wazza.my ("Peka Akaun") dikendalikan oleh Wazza (wazza.my). Laman ini menjana laporan kewangan (Ringkasan, Analisis, Untung Rugi, Kunci Kira-kira, Aliran Tunai, Imbangan Duga dan Aset) daripada fail Google Sheet atau fail Excel Peka Akaun milik anda.

2. Data Google yang kami akses

Bila anda pilih Log masuk dengan Google, kami meminta kebenaran berikut sahaja:

  • Profil asas (openid, email, profile): ID akaun Google, alamat emel dan nama anda, untuk mencipta akaun Peka Akaun anda.
  • drive.file: kami hanya boleh membuka fail yang anda pilih sendiri melalui Google Picker. Kami tidak boleh melihat, menyenarai atau mengubah fail lain dalam Google Drive anda.
  • Daripada fail itu, kami membaca nama fail, nama tab, dan nilai sel dalam julat laporan sahaja (tab Transaksi, _Pemetaan, Utama, Assets, _Pelarasan, _BakiAwal dan _Cukai).
  • Kami tidak menulis atau mengubah apa-apa dalam fail anda.
  • Kami tidak meminta kenalan, Gmail atau data Google lain.

2a. Extension Peka Akaun untuk Google Sheets

Extension (Extensions → Peka Akaun) berjalan di dalam Google Sheets anda melalui Google Apps Script, di server Google. Ia meminta kebenaran berikut sahaja:

  • spreadsheets.currentonly: baca dan tulis fail Google Sheet yang sedang dibuka sahaja (contoh: import penyata ke tab bulan, simpan transaksi ke tab Transaksi). Fail Sheet lain tidak boleh diakses.
  • script.container.ui: paparkan Panel dan tetingkap (contoh Kiraan Cukai) di dalam Google Sheets.
  • drive.file: bila anda import penyata PDF, salinan PDF disimpan dalam folder Bank Statement Archive di Google Drive anda, dan satu dokumen sementara dicipta untuk membaca teks PDF, kemudian terus dipadam. Hanya fail yang dicipta oleh extension boleh diakses.
  • script.external_request: untuk memanggil Google Drive API (membaca teks PDF tadi). Tiada data anda dihantar ke server Wazza.
  • userinfo.email: emel anda direkod dalam tab log audit fail anda sendiri (siapa ubah apa).

Panel memuat turun peraturan cukai dan berita produk daripada akaun.wazza.my; permintaan ini tidak mengandungi data kewangan anda. Data dalam Sheet anda kekal dalam Google Drive anda dan tidak disalin ke server Wazza.

3. Cara data digunakan

Data daripada fail anda digunakan untuk satu tujuan sahaja: memaparkan laporan kewangan kepada anda. Browser anda membaca fail terus daripada Google dan mengira laporan di situ. Isi fail tidak dihantar ke server kami.

Maklumat akaun (emel, nama, senarai fail) digunakan untuk mengekalkan log masuk anda dan memaparkan "Fail saya", di mana-mana peranti.

4. Penyimpanan

  • Server kami (di Malaysia, dikendalikan Wazza) menyimpan:
    • ID akaun Google, emel dan nama anda;
    • kunci akses Google (refresh token), disulitkan, supaya anda kekal log masuk tanpa perlu izin semula;
    • ID dan nama fail dalam "Fail saya", serta masa terakhir dibuka;
    • sesi log masuk (cookie), kekal sehingga anda log keluar atau tidak digunakan lebih setahun.
    Server tidak menyimpan isi fail atau data kewangan anda, dan tidak merekod log akses laman ini.
  • Dalam browser anda sendiri (localStorage): salinan data laporan terakhir yang dipaparkan (supaya laporan muncul serta-merta) dan pilihan paparan. Tekan Log keluar atau Tutup untuk memadamnya, terutamanya pada komputer yang dikongsi.
  • Fail Excel yang di-upload: dibaca dalam browser anda sahaja dan tidak dihantar ke mana-mana.

4a. Cara data dilindungi

  • Penyulitan semasa dihantar: semua sambungan ke akaun.wazza.my dan ke Google menggunakan HTTPS (TLS).
  • Penyulitan semasa disimpan: kunci akses Google (refresh token) disulitkan dengan libsodium (XSalsa20-Poly1305) sebelum disimpan. Kunci penyulitan disimpan berasingan daripada database, dalam fail yang hanya boleh dibaca oleh pentadbir server.
  • Sesi log masuk: cookie HttpOnly, Secure dan SameSite=Lax. Server hanya menyimpan hash SHA-256 token sesi, bukan token itu sendiri.
  • Kawalan akses: database tidak boleh dicapai dari internet; hanya aplikasi Peka Akaun dalam server yang sama boleh mengaksesnya. Akses ke server terhad kepada staf teknikal Wazza yang diberi kuasa, dan percubaan log masuk berulang disekat secara automatik.
  • Backup: backup harian database disulitkan sebelum disimpan di luar server, dan dipadam selepas 30 hari.
  • Data minimum: server tidak menyimpan isi fail atau data kewangan anda. Extension memproses data di dalam Google (Apps Script), dan data kekal dalam Google Drive anda.
  • AI/ML: kami tidak menggunakan data yang diterima daripada Google API (termasuk Google Workspace API) untuk membangun, menambah baik atau melatih model AI/ML.

5. Perkongsian data

Kami tidak menjual, berkongsi atau memindahkan data Google anda kepada mana-mana pihak, dan tidak menggunakannya untuk iklan. Kunci akses Google hanya digunakan untuk memberi browser anda akses sementara kepada fail yang anda pilih.

Penggunaan dan pemindahan maklumat yang diterima daripada Google API oleh Peka Akaun mematuhi Google API Services User Data Policy, termasuk keperluan Limited Use.

6. Perkhidmatan pihak ketiga

Untuk berfungsi, laman ini menggunakan log masuk Google dan Google Picker (log masuk dan pilih fail), Google Fonts (fon), dan SheetJS dari cdn.sheetjs.com (hanya bila anda upload fail Excel). Penyedia ini mungkin menerima alamat IP anda mengikut dasar privasi masing-masing.

7. Menarik balik akses

  • Log keluar: tamatkan sesi pada peranti tersebut.
  • Padam akaun (dalam kad "Fail saya"): kami tarik balik akses Google dan padam semua data akaun anda dari server dengan serta-merta. Fail dalam Google Drive anda tidak disentuh.
  • Anda juga boleh buang akses Peka Akaun pada bila-bila masa di myaccount.google.com/permissions.

8. Hubungi kami

Soalan tentang dasar ini: team@wazza.my. Jika dasar ini berubah, tarikh di atas akan dikemas kini.

ENGLISH

1. About this site

akaun.wazza.my ("Peka Akaun") is operated by Wazza (wazza.my). It generates financial reports (Summary, Analysis, Profit & Loss, Balance Sheet, Cash Flow, Trial Balance and Fixed Assets) from your own Peka Akaun Google Sheet or Excel file.

2. Google user data we access

When you choose Sign in with Google, we request only:

  • Basic profile (openid, email, profile): your Google account ID, email address and name, to create your Peka Akaun account.
  • https://www.googleapis.com/auth/drive.file: we can only open the files you select with the Google Picker. We cannot see, list or modify any other file in your Google Drive.
  • From those files we read only the file name, sheet (tab) names and the cell values of the report ranges (Transaksi, _Pemetaan, Utama, Assets, _Pelarasan, _BakiAwal and _Cukai tabs).
  • We never write to or modify your files.
  • We do not request your contacts, Gmail or any other Google data.

2a. Peka Akaun extension for Google Sheets

The extension (Extensions → Peka Akaun) runs inside your Google Sheets through Google Apps Script, on Google's servers. It requests only:

  • https://www.googleapis.com/auth/spreadsheets.currentonly: read and write only the spreadsheet that is currently open (for example importing a bank statement into a month tab, or saving a transaction to the Transaksi tab). No other spreadsheet can be accessed.
  • https://www.googleapis.com/auth/script.container.ui: show the Panel sidebar and dialogs (for example the tax calculator) inside Google Sheets.
  • https://www.googleapis.com/auth/drive.file: when you import a PDF statement, a copy is saved to a Bank Statement Archive folder in your Google Drive, and a temporary document is created to read the PDF text and deleted immediately. Only files created by the extension can be accessed.
  • https://www.googleapis.com/auth/script.external_request: to call the Google Drive API (reading that PDF text). None of your data is sent to Wazza servers.
  • https://www.googleapis.com/auth/userinfo.email: your email is recorded in the audit log tab of your own file (who changed what).

The Panel downloads tax rules and product news from akaun.wazza.my; these requests contain none of your financial data. Data in your spreadsheet stays in your Google Drive and is not copied to Wazza servers.

3. How we use the data

File data is used for a single purpose: displaying your financial reports to you. Your browser reads the file directly from Google and calculates the reports there. File contents are not sent to our servers.

Account information (email, name, file list) is used to keep you signed in and to show "Fail saya" (My files) on any device.

4. Storage

  • Our server (in Malaysia, operated by Wazza) stores:
    • your Google account ID, email and name;
    • your Google refresh token, encrypted, so you stay signed in without granting access again;
    • the IDs and names of files in "Fail saya", and when each was last opened;
    • your sign-in session (cookie), kept until you sign out or it goes unused for over a year.
    The server does not store file contents or any financial data, and keeps no access logs for this site.
  • Your own browser's local storage keeps a copy of the last report shown (so it appears instantly) and display preferences. Click Log keluar (sign out) or Tutup (close) to remove it, especially on a shared computer.
  • Uploaded Excel files are read in your browser only and are never uploaded.

4a. How we protect your data

  • Encryption in transit: all connections to akaun.wazza.my and to Google use HTTPS (TLS).
  • Encryption at rest: the Google refresh token is encrypted with libsodium (XSalsa20-Poly1305) before it is stored. The encryption key is kept separately from the database, in a file readable only by the server administrator.
  • Sign-in sessions: cookies are HttpOnly, Secure and SameSite=Lax. The server stores only a SHA-256 hash of the session token, never the token itself.
  • Access control: the database is not reachable from the internet; only the Peka Akaun application on the same server can access it. Server access is limited to authorised Wazza technical staff, and repeated failed sign-in attempts are blocked automatically.
  • Backups: daily database backups are encrypted before they are stored off the server, and are deleted after 30 days.
  • Data minimisation: the server stores no file contents or financial data. The extension processes data inside Google (Apps Script), and your data stays in your Google Drive.
  • AI/ML: we do not use data obtained from Google APIs (including Google Workspace APIs) to develop, improve or train AI/ML models.

5. Sharing

We do not sell, share or transfer your Google user data to anyone, and do not use it for advertising. The Google refresh token is used only to give your own browser temporary access to the files you selected.

Peka Akaun's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Third-party services

The site uses Google sign-in and the Google Picker (sign-in and file selection), Google Fonts, and SheetJS from cdn.sheetjs.com (only when you upload an Excel file). These providers may receive your IP address under their own privacy policies.

7. Revoking access

  • Log keluar (sign out) ends the session on that device.
  • Padam akaun (delete account, in the "Fail saya" card) revokes Google access and immediately deletes all your account data from our server. Files in your Google Drive are not touched.
  • You can also remove Peka Akaun's access at any time at myaccount.google.com/permissions.

8. Contact

Questions about this policy: team@wazza.my. If this policy changes, the date above will be updated.