Privacy Policy

1. Who This Policy Covers

This Policy applies to:

• Website visitors — anyone who browses malya.io
• Registered users — customers with a Malya account (dashboard access, subscriptions)
• Enterprise clients — businesses that engage Malya for data, AI, analytics, or BI projects
• End users of Malya Voice — individuals who call businesses powered by our AI receptionist

2. Information We Collect

2.1 Information You Provide Directly

• Account registration details: name, company name, email address, phone number
• Billing information (processed securely via Stripe — we do not store raw card numbers)
• AI agent configuration: call scripts, business hours, routing logic, custom instructions
• Project intake forms and requirements documentation for enterprise engagements
• Support tickets, emails, and chat communications with our team

2.2 Data Generated Through Your Use of Our Services

• Malya Voice: Call recordings, call transcripts, call metadata (duration, timestamps, caller ID, end reason), satisfaction scores
• Data Infrastructure: Database schemas, data pipeline configurations, connection credentials (stored encrypted), test datasets
• AI & Analytics: Model training data you provide, feature definitions, output predictions, pipeline logs
• Business Intelligence: Dashboard configurations, report definitions, data source connection details, KPI metrics
• All services: Usage logs, API request/response metadata, error logs, performance metrics

2.3 Automatically Collected Information

• IP address, browser type, device type, operating system
• Pages visited, time on page, referral URL, click events
• Cookies and similar tracking technologies (see our Cookie Policy)
• Session identifiers and authentication tokens

2.4 Voice and Audio Data

When you use Malya Voice, telephone calls may be recorded and transcribed. We collect this data to deliver the AI receptionist service, generate analytics, and improve model quality. Callers are informed of recording at the start of each call where required by applicable law (see Section 9 — State-Specific Rights).

3. How We Use Your Information

4. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

4.1 Service Providers (Sub-processors)

4.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or to protect the rights, property, or safety of Malya, our users, or the public.

4.3 Business Transfers

If Malya is involved in a merger, acquisition, or sale of assets, your data may be transferred. We will provide notice before your data is transferred and subject to a different privacy policy.

5. Data Retention

• Account data: Retained for the duration of your account plus 3 years after closure
• Call recordings & transcripts: Retained for 90 days by default; enterprise clients may configure longer retention
• Billing records: Retained for 7 years to comply with tax and financial regulations
• Project deliverables: Retained per the terms of your engagement agreement
• Support communications: Retained for 2 years
• Website analytics: Retained for 13 months

6. Data Security

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Role-based access control (RBAC) with Row-Level Security (RLS) enforced at the database layer
• Multi-factor authentication for internal systems
• Regular security audits and dependency scanning
• Encrypted storage of API keys and third-party credentials

No transmission over the Internet is 100% secure. While we use commercially reasonable efforts to protect your data, we cannot guarantee absolute security.

7. Your Rights and Choices

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Opt-out of marketing: Unsubscribe from marketing emails at any time via the link in any email

To exercise any right, email privacy@malya.io. We will respond within 30 days.

8. Cookies

We use cookies and similar technologies to operate our website and dashboard. Please see our Cookie Policy for full details. You can manage cookie preferences in your browser settings.

9. State-Specific Privacy Rights

California Residents (CCPA / CPRA)

California residents have the right to:

• Know what personal information is collected, used, shared, or sold
• Delete personal information we hold about them
• Opt out of the sale or sharing of personal information (we do not sell personal information)
• Non-discrimination for exercising CCPA rights
• Correct inaccurate personal information
• Limit use of sensitive personal information

To submit a CCPA request, email privacy@malya.io with subject line "CCPA Request."

Call Recording Notice

Some states require all-party consent for call recording. Malya Voice plays a disclosure at the start of every call informing callers that the call may be recorded. Clients are responsible for ensuring their use of Malya Voice complies with the call recording laws applicable in their jurisdiction.

10. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us immediately and we will delete it.

11. International Data Transfers

Malya is based in the United States. If you access our services from outside the US, your information may be transferred to, stored, and processed in the US where our servers are located. By using our services, you consent to this transfer. We implement appropriate safeguards where required by law.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy on this page with an updated effective date, and — for significant changes — by sending an email to registered users. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.

13. Contact Us