Privacy Policy

1. Introduction

COAI International Sdn. Bhd. ("COAI", "we", "our" or "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect, why we collect it, how we use and store it, who we share it with, how long we keep it, and the choices and rights you have.

It covers both our website and the COAI platform — our AI workforce products, COAI B.O.S and AMBER.

We handle personal data in accordance with Malaysia's Personal Data Protection Act 2010 (Act 709). Where you connect a Google account to COAI, we additionally comply with the Google API Services User Data Policy, including its Limited Use requirements. See section 7.

2. Who we are

COAI is the data controller for the personal data described in this policy.

3. Information we collect

Information you give us

• Account and contact details — name, email address, phone number, company name and business details you provide when you enquire, register or subscribe.
• Content you create or upload — messages, documents, customer records, notes and files you put into your COAI workspace, or ask COAI to produce for you.
• Information from accounts you connect — where you choose to connect a third-party account (such as Google), the specific data described in section 7.

Information we collect automatically

• Usage data — IP address, browser type, device type, pages visited and actions taken on our website and inside the platform.
• Operational records — a record of what the platform did on your instruction, so that you can see and check the work carried out on your behalf.

Information from marketing activity

• Marketing data — your preferences, and your interactions with our campaigns, events and materials.

We do not intentionally collect sensitive personal data (such as health, religious or political information). Please do not submit it unless we have specifically asked for it and explained why.

4. Why we use your information, and our legal basis

We do not sell your personal data. We do not, and will not, sell, rent or trade personal data to data brokers or advertisers.

5. Where your data is held

The COAI platform runs on a shared server located in Kuala Lumpur, Malaysia. Your workspace on that shared platform is logically separated from every other customer's workspace, and access is controlled per workspace.

Data is encrypted in transit using TLS. Credentials and access tokens for any accounts you connect are stored encrypted and held separately from your workspace content.

Some processing takes place outside Malaysia. Specifically, where a task requires an AI model to produce a result, the relevant content is sent to a third-party AI processing provider, some of which operate outside Malaysia. This is described in section 8.

We do not offer a dedicated single-customer server today. If your organisation requires one, please contact us before subscribing so we can tell you honestly what is and is not possible.

6. Who we share information with

We share personal data only in these circumstances:

• Service providers who help us operate — hosting, AI processing, email delivery, payment processing — and only to the extent needed to perform that service for us.
• Legal authorities, where we are required to disclose by law, court order or a lawful request.
• Business partners, only with your consent.
• In a merger or acquisition of COAI, in which case we will notify you.

We do not disclose your data for advertising or marketing by any third party.

7. Google user data

This section applies only where you choose to connect a Google account to COAI. If you never connect one, nothing in this section applies to you.

We request only the permissions needed for the features you have enabled, and we ask for the narrowest permission that will do the job.

7.1 The permissions we request, and what we do with each

We request no other Google permissions.

7.2 How Google user data is stored, shared and retained

• Stored — inside your own COAI workspace on our shared server in Kuala Lumpur, logically separated from other customers and encrypted in transit. Access and refresh tokens are stored encrypted, separately from workspace content.
• Who can see it — people you have invited into your COAI workspace, according to the role you gave them. COAI staff do not read the content of your connected accounts, except in the limited circumstances in section 9.
• How long — as set out in section 10.
• Shared — only as described in section 6, and only where it is necessary to provide the feature you asked for.

7.3 Limited Use

COAI International's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, and as binding commitments:

• We do not sell Google user data, and we do not transfer or use it for advertising, advertising personalisation, or any form of ad targeting.
• We do not use Google user data to train, retrain, improve or develop generalised artificial-intelligence or machine-learning models — our own or anyone else's.
• We do not allow humans to read Google user data, except: with your explicit consent for a specific purpose you have asked us about; where it is necessary for security or abuse investigation; where the law requires it; or where the data has been aggregated and de-identified.
• We do not transfer Google user data to third parties except as necessary to provide or improve the feature you asked for, to comply with law, or as part of a merger or acquisition — and in that last case, only after notice to you.
• We use Google user data only for the purposes disclosed in this policy.

7.4 Disconnecting your Google account

You can disconnect a connected Google account at any time — from the connections screen inside your COAI workspace, or directly from your Google Account at https://myaccount.google.com/permissions.

Disconnecting stops all further access immediately, and the stored access and refresh tokens for that connection are deleted at that point. To also have data we already retrieved deleted, see section 11.

8. AI processing

Your data is processed by Ollama, whose terms state that prompts and responses are handled transiently and are never used to train their models.

A second provider, OpenRouter, is available as a fallback and is used rarely — under one turn in a thousand. Some providers reachable through OpenRouter may use inputs for model training, and for that reason data obtained from Google Workspace is never sent through that fallback path.

We use no other AI provider.

9. Security and staff access

We use technical and organisational measures appropriate to the risk: encrypted transport, encrypted credential storage, per-workspace separation, and access control on administrative systems.

Staff access.

COAI staff do not read the content of your workspace or your connected accounts as a matter of routine. Access by a named engineer is possible only where you have asked us for support and consented for that specific purpose, where it is necessary to investigate a security incident, or where the law requires it.

No system is perfectly secure. If a breach occurs that is likely to cause you significant harm, we will notify you and the relevant authority as required by law.

10. How long we keep your data

We keep data only as long as we need it for the purpose it was collected for.

You can ask us to delete data sooner — see section 11.

11. Your rights

Under the Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you.
• Correct it if it is inaccurate, incomplete or out of date.
• Withdraw your consent to processing, including marketing, at any time.
• Limit or object to processing, including processing for direct marketing.
• Request deletion of your data, subject to records we are legally required to keep.

How to make a request.

Email info@coai.international from the email address associated with your account, and tell us what you want. We will acknowledge your request and complete it within 30 days. There is no charge for a reasonable request.

To delete data retrieved from a connected Google account, use the same address. Disconnecting the account (section 7.4) stops further access immediately; emailing us removes what we already hold.

If you are not satisfied.

Please contact us first at info@coai.international so we can try to put it right. You also have the right to complain to Malaysia's data protection regulator:

Jabatan Perlindungan Data Peribadi (Personal Data Protection Department), Malaysia
Website: https://www.pdp.gov.my

12. Cookies and tracking

We use cookies and similar technologies on our website to keep it working, remember your preferences, and understand how the site is used. You can control or block cookies through your browser settings; some parts of the site may not work correctly if you block them entirely.

13. Other websites

Our website and the platform may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. Please read their own privacy policies.

14. Children

The COAI platform is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. When we do, we will post the updated version on this page and change the effective date at the top. Where a change materially affects how we handle your data, we will tell you directly.

16. Contact us

Questions about this policy, or about how we handle your data: