Privacy notice

• Your account: name, work email, role and division. Your password is stored only as a hash.
• If you ask for an account: your name, email, what you wrote on the form, and the internet address it came from, used only to stop the form being misused.
• To pay you or a vendor: the bank, account number and account holder name, the NPWP or NIK, the amounts, and the files attached — invoices, receipts and transfer slips.
• What was done in the app — approvals, edits, payments — kept as an audit trail.

To pay people correctly, to withhold and report tax as the law requires, to keep the companies’ books, and to catch mistakes and fraud through the approval steps and checks.

Only the people whose job needs it: you, the people who approve and pay what you file (reviewers, Finance, Directors), and Admins. The companies’ tax consultant receives the tax reports. The services that host the database and files (Supabase) and send the app’s emails process it on our behalf.

Some features use an AI model: reading invoices, receipts and transfer slips, proposing expense drafts, suggesting statement columns, and ranking possible bank matches. The document or text is sent through OpenRouter to the model’s provider, outside Indonesia, with settings that forbid the provider from keeping it or training on it.

• Photos of ID cards (KTP, NPWP cards) are not sent unless an Admin switches ID-card reading on.
• When ranking bank matches, account numbers are not sent; the AI is told only whether they match.
• In the text Drea Finance writes for the AI, NIK, NPWP, card and virtual-account numbers, mobile numbers, email addresses and account numbers written after “rekening” are masked to their last four digits before it is sent. Documents are sent as they are, because reading them is the job.
• The AI suggests; people approve, pay and post. Every AI call is logged, without its contents.

Financial records and their documents are kept as long as Indonesian tax law requires books and their supporting records to be kept (currently ten years). Notifications are deleted after 30 days. Files added to “Create expense drafts with AI” that never became an expense are deleted after a week; a file that became part of a draft stays with that draft.

To see what is kept about you, to correct it, to know how it is used, and to have it deleted where the law does not require it to be kept. Ask the Finance team or an Admin of Drea Finance.