Privacy Policy

1. Who This Policy Covers

This Policy applies to:

• Website visitors — anyone who browses malya.io
• Registered users — customers with a Malya account (dashboard access, subscriptions)
• Enterprise clients — businesses that engage Malya for data, AI, analytics, or BI projects
• End users of Malya Voice — individuals who call businesses powered by our AI receptionist

2. Information We Collect

2.1 Information You Provide Directly

• Account registration details: name, company name, email address, phone number
• Billing information (processed securely via Stripe — we do not store raw card numbers)
• AI agent configuration: call scripts, business hours, routing logic, custom instructions
• Project intake forms and requirements documentation for enterprise engagements
• Support tickets, emails, and chat communications with our team

2.2 Data Generated Through Your Use of Our Services

• Data Infrastructure: Primavera P6 schedule data (XER/XML exports, activity-level data, CPM logic), Bluebeam markups, Aconex transmittals, ERP exports, database schemas, ingestion pipeline configurations, connection credentials (stored encrypted), and test datasets
• AI Agents for the Jobsite: Project archive documents (RFIs, submittals, drawings, daily reports, spec libraries, lessons learned) used to train or ground agents; agent configuration, prompts, and conversation logs; model training data you provide; feature definitions; output predictions
• Project Intelligence (Analytics & ML): Project performance data (cost reports, schedule SPI/CPI, productivity records, safety incidents), feature stores, model versions, predictions, and pipeline logs
• Portfolio Visibility (BI): Dashboard configurations, report definitions, KPI metrics, project P&L records, owner/client portal access logs
• Malya Voice — Voice AI Agents: Call recordings, call transcripts, call metadata (duration, timestamps, caller ID, end reason, escalation path), on-call routing logs, satisfaction scores — for both inbound and outbound calls
• All services: Usage logs, API request/response metadata, error logs, performance metrics

2.3 Automatically Collected Information

• IP address, browser type, device type, operating system
• Pages visited, time on page, referral URL, click events
• Cookies and similar tracking technologies (see our Cookie Policy)
• Session identifiers and authentication tokens

2.4 Voice and Audio Data

When you use Malya Voice, telephone calls may be recorded and transcribed. We collect this data to deliver the AI receptionist service, generate analytics, and improve model quality. Callers are informed of recording at the start of each call where required by applicable law (see Section 9 — State-Specific Rights).

3. How We Use Your Information

4. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

4.1 Service Providers (Sub-processors)

4.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or to protect the rights, property, or safety of Malya, our users, or the public.

4.3 Business Transfers

If Malya is involved in a merger, acquisition, or sale of assets, your data may be transferred. We will provide notice before your data is transferred and subject to a different privacy policy.

5. Data Retention

• Account data: Retained for the duration of your account plus 3 years after closure
• Call recordings & transcripts: Retained for 90 days by default; enterprise clients may configure longer retention
• Billing records: Retained for 7 years to comply with tax and financial regulations
• Project deliverables: Retained per the terms of your engagement agreement
• Support communications: Retained for 2 years
• Website analytics: Retained for 13 months

6. Data Security

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Role-based access control (RBAC) with Row-Level Security (RLS) enforced at the database layer
• Multi-factor authentication for internal systems
• Regular security audits and dependency scanning
• Encrypted storage of API keys and third-party credentials

No transmission over the Internet is 100% secure. While we use commercially reasonable efforts to protect your data, we cannot guarantee absolute security.

7. Your Rights and Choices

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Opt-out of marketing: Unsubscribe from marketing emails at any time via the link in any email

To exercise any right, email service@malya.io. We will respond within 30 days.

8. Cookies

We use cookies and similar technologies to operate our website and dashboard. Please see our Cookie Policy for full details. You can manage cookie preferences in your browser settings.

9. State-Specific Privacy Rights

California Residents (CCPA / CPRA)

California residents have the right to:

• Know what personal information is collected, used, shared, or sold
• Delete personal information we hold about them
• Opt out of the sale or sharing of personal information (we do not sell personal information)
• Non-discrimination for exercising CCPA rights
• Correct inaccurate personal information
• Limit use of sensitive personal information

To submit a CCPA request, email service@malya.io with subject line "CCPA Request."

Texas Residents (TDPSA — Effective July 1, 2024)

Under the Texas Data Privacy and Security Act, Texas residents have the right to:

• Confirm whether Malya processes their personal data, and access that data
• Correct inaccuracies in their personal data
• Delete personal data we hold about them (subject to legal retention requirements)
• Obtain a copy of their personal data in a portable, readily usable format
• Opt out of processing for purposes of targeted advertising, sale of personal data, or certain forms of profiling (Malya does not engage in any of these)
• Appeal a denied request — Malya will respond to appeals within 60 days

To submit a TDPSA request, email service@malya.io with subject line "TDPSA Request." We will respond within 45 days, with one possible 45-day extension if needed and notified.

Other State Privacy Laws

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and others) have similar rights under their respective statutes. To exercise any state-specific privacy right, email service@malya.io with your state and the right you wish to exercise.

Call Recording Notice

Some states require all-party consent for call recording. Malya Voice plays a disclosure at the start of every call informing callers that the call may be recorded. Clients are responsible for ensuring their use of Malya Voice complies with the call recording laws applicable in their jurisdiction.

10. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us immediately and we will delete it.

11. International Data Transfers

Malya is based in the United States. If you access our services from outside the US, your information may be transferred to, stored, and processed in the US where our servers are located. By using our services, you consent to this transfer. We implement appropriate safeguards where required by law.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy on this page with an updated effective date, and — for significant changes — by sending an email to registered users. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.

13. Contact Us