Acceptable Use Policy

1. About this policy

This Acceptable Use Policy ("AUP") sets out what you may and may not do when you use Taokeh.

In this AUP:

• "Taokeh", "we", "us" and "our" mean Enya Venture, a sole proprietorship registered with the Companies Commission of Malaysia (Suruhanjaya Syarikat Malaysia, "SSM"), business registration no. 003853053-D (new format 202603132312), with a registered address in Inspirasi Mont Kiara, Jalan Kiara 4, 50480 Kuala Lumpur, Malaysia. Contact: admin@taokeh.my, tel +60 16-773 9678.
• "Service" means the Taokeh cloud accounting and ERP software, the website at https://taokeh.my, and all related features (general ledger, invoicing, inventory, banking, payroll, MyInvois e-invoicing, SST returns, marketplace channels, the hosted storefront, fixed assets, multi-currency and the optional AI helper features).
• "you", "your" and "the Customer" mean the person or business that subscribes to or uses the Service, including everyone you allow to use your workspace (your "authorised users").

This AUP is part of the Taokeh Terms of Service. By accepting the Terms — or by using the Service — you and your authorised users agree to this AUP. You only need to accept once; it covers both the Terms and this AUP.

2. Your responsibility for your workspace

• You must give accurate registration details, keep your login credentials (including any two-factor authentication) secure, and not share accounts beyond what your plan allows.
• You are responsible for everything done in your workspace, including the actions of all your authorised users and anything done using your credentials.
• You must make sure your authorised users follow this AUP. A breach by any of your authorised users is treated as your breach.

3. Prohibited uses

You must not, and must not allow anyone else to, use the Service to do any of the following.

3.1 Illegal or infringing content and conduct

• Use the Service for any unlawful purpose, or to store, transmit or help others carry out anything illegal under Malaysian law or any other applicable law.
• Upload, store or transmit content that infringes the copyright, trademark, trade secret, patent or other intellectual-property or proprietary rights of anyone else.

3.2 Malware and destructive code

• Introduce or transmit viruses, worms, trojans, ransomware, corrupted files, or any other code designed to disrupt, damage, disable or gain unauthorised access to any system, network or data.

3.3 Security circumvention and unauthorised access

• Probe, scan, or test the vulnerability of the Service or any related system or network, or conduct any penetration testing, without our prior written authorisation.
• Breach or try to breach, or circumvent, any authentication, access control, rate limit, or tenant-isolation measure (including our Row-Level-Security tenant separation).
• Access, or try to access, any data, account, workspace or tenant that you are not authorised to access.

3.4 Scraping and reverse-engineering

• Use any automated means (bots, scrapers, crawlers) to harvest data from the Service, or access the Service through any non-public or undocumented interface, except as we expressly permit.
• Reverse-engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying models or structure of the Service, except to the limited extent this restriction is prohibited by applicable law (e.g. non-waivable statutory rights to interoperability information).

3.5 Reselling or sublicensing without authorisation

• Resell, sublicense, rent, lease, white-label, time-share, or otherwise make the Service available to any third party as a service bureau, except as expressly permitted in writing under a partner or reseller agreement with us.

3.6 Overloading or abusing the infrastructure

• Impose an unreasonable or disproportionately large load on the Service, send excessive or abusive automated requests, or abuse storage or bandwidth.
• Take any action that degrades, or is likely to degrade, the performance, integrity, security or availability of the Service for other customers.

3.7 Uploading others' personal data without a lawful basis

• Upload, store or process the personal data of any third party — including your own customers, suppliers, employees, or storefront buyers — unless you have a valid lawful basis under the Personal Data Protection Act 2010 (PDPA) (including, as amended by the Personal Data Protection (Amendment) Act 2024), and the right to provide that data to us for processing.

For this data, you are the data controller and we act as your data processor on your documented instructions. You are responsible for having a lawful basis and for giving your own PDPA notice (and obtaining any consent) to the individuals concerned. This obligation is dealt with more fully in our Data Processing Agreement. Take particular care with sensitive personal data — such as employee IC/passport numbers, biometric data, health information, and bank or salary details — which generally requires explicit consent under PDPA s.40.

3.8 Fraud, money laundering and financial crime

• Use the accounting, invoicing, payroll, storefront, or any other feature to facilitate fraud, money laundering, terrorist financing, sanctions evasion, tax evasion, fictitious or false invoicing, or any other financial crime.

3.9 Harassment, abuse and harmful content

• Impersonate any person or entity, or falsify or disguise the origin of any content or communication.
• Send chain letters, spam, or unsolicited commercial messages through the Service.
• Harass, threaten, defame, stalk, or incite hatred or violence against any person, or engage in hate speech.
• Upload or transmit obscene material, or any child sexual abuse material (CSAM).
• Interfere with any other customer's use of the Service, falsify message headers or identifiers, or send deceptive or phishing communications.

3.10 Misuse of the AI features

The Service includes optional AI helper features (text only), which are turned on only after a one-time, workspace-level acceptance of the AI terms. When you use them, you must not:

• Attempt prompt-injection, jailbreak, or any other technique to bypass the AI's safeguards or make it behave outside its intended purpose.
• Submit content to the AI features that you are not entitled to share, or that you would otherwise be prohibited from processing under this AUP.

You acknowledge that AI outputs are assistive suggestions meant for human review, not professional legal, accounting, tax or financial advice, and that you must not rely on them for automated decisions that produce legal or similarly significant effects without human review.

4. Reporting abuse, security issues and infringing content

If you become aware of any violation of this AUP, a security vulnerability, or content that infringes your rights, please tell us so we can act:

• Email: admin@taokeh.my.
• Telephone: +60 16-773 9678.

For intellectual-property complaints, please identify the content, your rights in it, and your contact details so we can follow a takedown process.

5. Consequences of breach

If you or your authorised users breach this AUP, we may, at our discretion and to the extent reasonable in the circumstances:

• Warn you and ask you to fix the problem;
• Investigate, and remove or disable access to offending content;
• Throttle, suspend, or terminate your access to the Service, in whole or in part, or close your account.

Where practicable, we will give you notice first. But where there is a legal, security, fraud, or other risk of harm to the Service, to us, or to other customers, we may suspend or terminate immediately and without prior notice or liability.

Suspension or termination for breach of this AUP does not entitle you to any refund or compensation.

6. Reporting to authorities and cooperation

We may disclose information and cooperate with law-enforcement agencies, regulators (including the Personal Data Protection Commissioner) and other authorities where we are legally required to do so, or where reasonably necessary to protect the Service, our rights, or the safety of our customers or the public.

7. Your data on suspension or termination

Suspending or terminating access for a breach does not strand your records. Your data is handled in line with our Terms of Service and Privacy Policy, including any data-export window and retention/deletion timeline stated there. As a general rule, when a paid term lapses your workspace becomes read-only — your data is retained and remains exportable for the period stated in the Terms, and is not deleted immediately.

8. Changes to this policy

We may update this AUP from time to time. We will notify you of material changes (for example, by email or an in-app notice). If you continue to use the Service after a change takes effect, you accept the updated AUP.

9. Contact

Enya Venture (operating "Taokeh")
SSM business registration no. 003853053-D (202603132312)
Inspirasi Mont Kiara, Jalan Kiara 4, 50480 Kuala Lumpur, Malaysia
Email: admin@taokeh.my · Tel: +60 16-773 9678