Privacy Policy

This policy explains how Denomy Web Services (“Denomy,” “we,” or “us”) handles personal data when you use Nadi2, a hosted web-based AI assistant at nadi2.com, and this website (together, the “Service”). It follows Malaysia's Personal Data Protection Act 2010 (the “PDPA”), including its 2024 amendments, and the principles in it: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity, and Access.

1. Who we are

Nadi2 is operated by Denomy Web Services (202603117150 (LA0089057-A)), Malaysia. We are the data user under the PDPA for the personal data described here.

Contact: support@nadi2.com

2. What we collect

• Account information: your name and email address.
• Content you create: chats, files you upload, bot instructions and settings, memories, routines, and the access tokens for the apps you connect.
• API keys: the model provider keys you add. We store them encrypted.
• Billing information: when paid plans start, your plan, subscription status, and payment records. Card details are handled by our payment processor, not stored by us.
• Usage and log data: technical records such as IP address, browser and device type, pages and features used, timestamps, and errors.
• Support messages: what you send us when you contact us.
• Cookies: an essential cookie that keeps you signed in. Analytics cookies are used only if analytics is enabled (see section 4).

We collect this from you directly, from what you connect or authorise your bots to access, and automatically when you use the Service.

3. Why we use it, and our legal bases

• To provide the Service and run your bots, chats, routines and connected apps. This is necessary to perform our agreement with you.
• To secure the Service, prevent abuse, and fix problems. This is in our legitimate interest in running a safe service.
• To give you support and send service emails about your account, and to manage billing when paid plans start.
• To meet legal obligations, such as tax and accounting records.
• To understand and improve how the Service is used, only if analytics is enabled, on the basis of your consent or our legitimate interests as the law allows.

We process personal data on the basis of your consent, which you give when you create an account and use the Service, and where processing is necessary for our agreement with you, to comply with the law, or for our legitimate interests. You can withdraw consent at any time (section 10).

Service emails, such as sign-in, billing and security notices, are sent as part of the Service. If we ever send marketing emails, you can opt out at any time and we will stop.

4. Who we share it with

We do not sell your personal data. We share it only as needed with:

• Services you choose and configure. You bring your own model provider and API key, and may also connect voice, memory, computer and other services, and apps. Nadi2 does not bill for model usage; your provider does. Your prompts and the content you send to a service you configured go to that service, under its own terms and privacy policy, not ours. When you connect an app, data flows between Nadi2 and that app as you direct.
• Hosting and infrastructure providers that run our servers and storage.
• Email delivery: Amazon Web Services (Amazon SES), in the AWS Asia Pacific (Malaysia) region, sends our service emails.
• Payment processor, when paid plans start.
• Product analytics, only if we enable analytics.
• Professional advisers and acquirers, such as lawyers and accountants, or a buyer in a merger or sale of the business, under duties of confidentiality.
• Authorities, where the law requires or a valid legal request is made.

Providers that process data on our behalf are bound to protect it and to use it only for the services they give us.

5. Transfers outside Malaysia

Some of the services above, including the model providers and apps you choose, may process data outside Malaysia. Where we transfer personal data abroad, we do so as the PDPA permits, with your consent or with contractual safeguards that give the data comparable protection.

6. How long we keep it

• Account information and content: while your account is active, then deleted or anonymised as described below.
• Billing records: for the period Malaysian tax and accounting law requires.
• Logs: for a limited period.

When we no longer need personal data, we delete or anonymise it, except what we must keep to comply with the law or resolve disputes. Information already sent to a service you configured is subject to that service's own retention.

To delete your account, email support@nadi2.com.

7. Cookies

We use an essential cookie to keep you signed in. It is needed for the Service to work. Analytics is used only if enabled; if it is, we will say so here.

8. Security

We use reasonable technical and organisational measures to protect personal data, including encryption in transit (TLS), encrypted storage of API keys and other credentials, and access controls on our systems. No system is completely secure.

If a personal data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the affected individuals as the PDPA requires.

9. Children

Nadi2 is not for people under 18. We do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

10. Your rights

Under the PDPA you may ask us to:

• give you access to the personal data we hold about you;
• correct personal data that is inaccurate, incomplete or out of date;
• withdraw your consent to processing;
• limit or stop processing that may cause you damage or distress;
• transmit your personal data to another service provider you name (data portability), where technically feasible;
• delete personal data we no longer need for the purposes above.

Email support@nadi2.com. We may ask you to verify your identity first. Withdrawing consent may mean we can no longer provide the Service.

11. Complaints

Please contact us first so we can try to fix the problem. You may also complain to the Personal Data Protection Commissioner of Malaysia.

12. Changes to this policy

We may update this policy. The date above shows when it last changed. If a change is significant, we will tell you by email or in the Service before it takes effect.

13. Governing language

This policy is written in English. If it is translated, for example into Malay, the English version prevails.

14. Contact

Denomy Web Services (202603117150 (LA0089057-A))
Malaysia
support@nadi2.com