Privacy Policy

Laras.ai (“Laras”, “we”, “us”, “our”) is an AI-assisted expense, memo and approval service for businesses. Laras is operated by PT Brilliann Nuswantara Bhagawanta, a limited liability company established under the laws of the Republic of Indonesia, with its registered address at Gedung Menara Kuningan Lantai 7 Unit M, Jl. H.R. Rasuna Said Blok X-7 Kav. 5, Kelurahan Karet Kuningan, Kecamatan Setiabudi, Kota Administrasi Jakarta Selatan, DKI Jakarta, Indonesia, and business identification number (NIB) 022010489171.

The Laras mobile apps are published on the Apple App Store and Google Play by PT Digital Equitas Primier on behalf of PT Brilliann Nuswantara Bhagawanta. PT Digital Equitas Primier acts only as the app publisher: it receives the download and store statistics that Apple and Google provide to every publisher, and it does not access the information you put into Laras.

Privacy contact and Data Protection Officer: info@laras.id

Laras serves companies registered in Indonesia and in Singapore. The rules that apply to you follow the country your company selected when it registered: Indonesian Law No. 27 of 2022 on Personal Data Protection (“UU PDP”) and its implementing regulations for companies in Indonesia, and the Singapore Personal Data Protection Act 2012 (“PDPA”) for companies in Singapore.

Laras is used by companies. Each company (the “Customer”) registers an account and invites its own people (employees, finance staff, approvers). This creates two different situations, and we treat them differently.

The table shows the legal basis under UU PDP. For companies in Singapore, we rely on your consent (including consent given by your use of the Service for the purposes we notify you of here), on the legitimate interests exception, or on another basis the PDPA permits; see Section 17.2.

We use your data only for the purposes listed here. If we want to use it for a new purpose that is not compatible with these, we will tell you first and, where the law requires it, ask for your consent.

Laras uses large language models from Anthropic PBC (United States) through Anthropic's commercial API to read receipts and invoices, draft memos, learn a company's memo template and reply in chat. To do this, the content you give Laras (document images and PDF files, your chat messages and the related memo details) is sent to Anthropic for processing.

• We ask for your explicit permission before any of your content is sent to Anthropic. You give it at sign-up, separately from accepting these documents. You can withdraw it at any time (Section 13); because reading documents and chatting with Laras depend on it, the AI features stop working for you if you do.
• Under Anthropic's commercial terms, Anthropic does not use content sent through its API to train its models, and keeps it only for a limited period for trust and safety purposes.
• Laras's outputs are suggestions. Laras never approves or rejects a memo; every approval decision is made by a person. Values Laras proposes are marked as suggested until a user confirms them. You have the right to object to decisions made solely by automated processing; in Laras, no decision with legal or financial effect on you is made that way.

Laras is built to fit the way businesses work in each region and industry. To do that, we study how the Service is used.

6.1 Usage analytics. We analyse usage, device and technical data to understand which features are used, where users get stuck, how long responses take and what goes wrong, so that we can fix and improve the Service.

6.2 Aggregated, de-identified insights. We combine data from many Customers, including information read from documents (such as expense categories, typical amounts, document formats, tax treatment and common spending patterns by region or industry), into aggregated statistics that do not identify any person or any Customer (“Aggregated Data”). Aggregated Data belongs to us. We use it to localise and improve Laras, to give Customers anonymous benchmarks, and we may share or commercialise it with third parties, for example as industry or regional reports.

To make Laras read Indonesian and regional receipts more accurately, we may use samples of documents and memos to test and tune Laras (for example, to build test sets, improve our instructions to the AI model, or, in future, train a model of our own). When we do this:

• we remove or mask personal details such as names, phone numbers, signatures and account numbers where it is practical to do so;
• access is limited to the members of our team who need it, under confidentiality obligations;
• the material is never given to Anthropic or any other AI provider for training their models;
• a Customer can opt out in writing at info@laras.id, and its documents are then excluded going forward.

9.1 Your company. Users of your company see the data the Service is designed to show them, according to their role: for example, your approver sees the memos you send for approval, and your Admin sees users and company settings.

9.2 Our service providers (processors). We use the following providers to run the Service. Each processes personal data only on our instructions and is bound by contract to protect it with the same or equal protection as this Policy.

We will update this list before we add a provider that processes personal data, and we notify Customers' Admins of material changes.

9.3 Legal reasons. We may disclose personal data when required by law, a court order or a lawful request from a government authority, or to protect the rights, property or safety of Laras, our users or the public.

9.4 Business transfers. If our business is merged, acquired or its assets are sold, personal data may transfer to the new owner, who must continue to protect it under this Policy. We will notify you before that happens.

Our main systems and your stored data are hosted in Jakarta, Indonesia, for companies in both Indonesia and Singapore. Some processing takes place elsewhere, namely AI processing by Anthropic in the United States and some Firebase and Apple services. For companies in Singapore, this means your data is transferred from Singapore to Indonesia and to the United States.

We only transfer personal data across borders in line with the law that applies to you: under UU PDP, to a country with an equal or higher level of protection, under binding contractual safeguards, or with your consent; under the PDPA, only where the recipient is bound by legally enforceable obligations (such as contracts) to protect it to a standard comparable to the PDPA. By giving the AI consent in Section 5, you consent to the transfer of your content to Anthropic in the United States for that purpose.

Because deletion of inactive companies runs at the end of each calendar year, the actual time between last activity and deletion can be longer than the minimum shown. A Customer can ask us to delete its whole company account sooner by contacting us; the Admin can export the company's records first.

All data is encrypted in transit (TLS). Passwords are stored only as one-way hashes. Secrets are kept in a managed secret store. Access is controlled by role and checked on our servers for every protected action; every memo, approval and settings change is written to an audit log that cannot be edited. Approval decisions in the mobile app require Face ID, Touch ID or fingerprint (or the device passcode). Our staff access personal data only when needed to run or support the Service.

No system is perfectly secure. If a personal data breach occurs, we will notify the affected people and the authorities within the time the law of your country requires (Section 17), and tell you what happened, what data was involved and what we are doing about it. Where the breach concerns Customer Data, we will also notify the Customer's Admin without delay, so the Customer can meet its own obligations.

Depending on the law of your country (Section 17), you have the right to:

• get information about how we process your personal data and why;
• access your personal data and obtain a copy;
• correct inaccurate or incomplete data;
• have your personal data deleted;
• withdraw your consent;
• object to decisions based solely on automated processing, including profiling;
• restrict or suspend processing;
• receive your data in a commonly used format and have it transferred to another controller;
• claim compensation for a breach of your rights, under the law.

How to exercise them. You can update most of your details in Settings. To delete your account, use Settings > Delete account in the mobile app or the web app. If you cannot use the app, follow the steps at https://laras.ai/delete-account or email info@laras.id from your registered address. For anything else, email info@laras.id. We may ask you to verify your identity. We respond within the time the law of your country requires (Section 17), and tell you if a request will take longer to complete.

Requests about Customer Data. If your request concerns your company's records (for example, deleting a memo or a receipt), we will pass it to your company, which decides as the controller of those records, and we will help it respond.

Withdrawing consent does not affect processing that took place before you withdrew it. If you withdraw the AI consent, the AI features stop working for you; your account and records remain.

The mobile apps ask for these permissions only when you use the related feature, and you can change them in your device settings at any time:

• Camera: to photograph a receipt or invoice.
• Photos: to upload a receipt, invoice or signature image you choose.
• Notifications: to tell you about approvals and memo updates. Laras works without them; you will see updates inside the app.
• Face ID, Touch ID or fingerprint: to confirm an approval decision and to unlock the app. The check runs on your device only.

The Service is for businesses and for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Policy as the Service changes. We will show the version and effective date at the top. For material changes we will notify you in the app or by email before they take effect and, where the law requires, ask for your consent again.

The country that applies to you is the country your company selected when it registered for Laras.