nahlaaiPrivacy Policy
We are committed to protecting your privacy and being transparent about how we handle your data.
Delete any project, or your whole account, anytime. We permanently erase it from our cloud and email you confirmation.
AES-256 at rest, TLS 1.3 in transit.
Your schedules are never used to train AI models.
Export or delete on request.
Access, correction, and deletion rights.
01Introduction
Nahla AI is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our agentic project-controls platform at nahla.ai.
02Information we collect
Account information
When you create an account, we collect:
- Email address
- First and last name
- Company name (optional)
- Password (stored encrypted)
Project files
When you use the service, you may upload project schedule files (.XER, .MPP, .ZIP and .xlsx). These files are processed to generate your analytics, reports, and agent actions.
Usage data
We automatically collect basic usage information:
- Browser type and version
- Pages visited and features used
- Date and time of access
03How we use your information
- Provide and maintain our service
- Process and analyze your project files
- Generate reports and visualizations
- Send important service updates and notifications
- Respond to your inquiries and support requests
- Improve our platform and develop new features
AI & your schedule data
We do not use your schedule data to train AI models, ours or anyone else's. Your uploaded schedules are processed only to generate your analysis, reports and the agent actions you request. When you use AI chat or an agent, the relevant schedule context is sent to a specialist third-party AI provider in the United States to generate the response; your prompts are not used to train their models. Your chat history is stored in your account so you can return to a conversation, and you can delete conversations at any time.
AI agents & communications
Some agents can draft emails on your behalf, for example Progress Collection drafts update requests to the subcontractors you choose. These are sent only after you approve them, and only to the recipients you specify. Each recipient opens a secure, single-use link (no account required); we store only a hashed token, never the raw link. The information you include in a request is shared with that recipient.
04Data storage, retention & deletion
Reports & analytics
Generated reports and analytics may be stored so you can access your previous analyses. You can delete any project and its data yourself at any time from within the app. This permanently removes the project's schedule data and your uploaded files from our cloud storage (AWS), and we email you a confirmation once the erasure is complete. Shared report links can be viewed by anyone who has the link, and expire after 30 days.
Account data
Your account information is retained for as long as your account is active. You can delete your account and all of its data yourself at any time from your account settings, no need to contact us. This permanently removes your projects, schedule data, uploaded files, and account records from our cloud (AWS), and we send a confirmation email once the erasure is complete. Deletion is irreversible.
05Data security
We implement industry-standard security measures including:
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for data at rest
- Hosting on SOC 2 / ISO 27001-certified cloud infrastructure (AWS)
- Security monitoring and audit logging
Subprocessors
We rely on a small set of trusted subprocessors to run the Service: Amazon Web Services (cloud hosting & storage, in Sydney, Australia), a specialist AI provider in the United States (AI processing), Amazon SES (transactional & agent email), Cloudflare (network protection and bot checks on forms) and Stripe (billing). Each processes data only as needed to provide the Service, and none uses your data to train models.
06Your rights
You have the right to:
- Access · request a copy of your personal data
- Correction · update or correct your account information
- Deletion · request deletion of your account and associated data
- Export · download your reports and analytics data
- Withdraw consent · opt out of non-essential data processing
To exercise any of these rights, please contact us at support@nahla.ai. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
07International data transfers
Our core services are hosted on cloud infrastructure in the Asia-Pacific (Sydney) region. Enterprise customers can have their data hosted in their own country on request. To generate AI responses, limited schedule context is processed by a specialist AI provider located in the United States. By using the AI features, you consent to this overseas processing. If you're accessing our services from outside Australia, please also be aware that your data may be transferred to, stored, and processed in Australia.
08Changes to this policy
We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date above and, for material changes, notify you in-app or by email. Your continued use of the service after an update means you accept the revised policy.
09Contact us
Questions about this policy or how we handle your data? Contact us at support@nahla.ai and we'll get back to you.
Questions about your privacy?
Reach out, we treat every question as a real one.