Privacy Policy
Effective date: 30 May 2026
1. Introduction
NakTahu AI (“we”, “our”, or “the Service”) is a Malaysian civic knowledge assistant that helps users find information about public services, government procedures, education, finance, healthcare, and related civic affairs.
This Privacy Policy explains what data we collect, how we use it, and your rights over it. By using NakTahu AI you agree to the practices described here.
2. Data We Collect
2.1 Data you provide
- Account information — email address when you sign in via Email Magic Link or Google OAuth.
- Query text — the questions you submit to the AI assistant.
2.2 Data collected automatically
- Anonymous session ID — a randomly generated UUID stored in your browser’s localStorage before sign-in, used solely to migrate your pre-login history to your account upon sign-in.
- Query metadata — detected language, domain category (e.g. tax, EPF), confidence score, and timestamp stored alongside your query history.
- Error and performance data — anonymised error events sent to Sentry for debugging. These do not include your query content.
- Experiment traces — anonymised pipeline traces (latency, token count, model used) sent to Weights & Biases Weave for model quality monitoring. These do not include your account identity.
2.3 Data we do NOT collect
- We do not collect payment information.
- We do not collect device fingerprints or persistent tracking cookies.
- We do not store the full AI-generated responses server-side — only a short summary for history display.
3. How We Use Your Data
- To provide the service — routing your query through the AI pipeline and returning an answer.
- Query history — storing up to 50 recent queries per account in Redis (TTL 30 days) so you can revisit past questions.
- Rate limiting — keying anonymous users (30 req/hr) and authenticated users (200 req/hr) to prevent abuse.
- Service improvement — anonymised traces help us tune model quality and latency.
4. Data Storage and Retention
- Authentication data is stored by Supabase (hosted on AWS ap-southeast-1).
- Query history is stored in Redis with a 30-day rolling TTL. History is automatically deleted after 30 days of inactivity.
- Account deletion — you may request deletion of your account and all associated data by emailing us. We will process requests within 14 days.
5. Third-Party Services
NakTahu AI uses the following third-party providers. Each has its own privacy policy.
| Provider | Purpose |
|---|---|
| Supabase | Authentication and database |
| Anthropic | AI language model (fallback synthesis) |
| ILMU API (Malaysia) | AI language model (primary) |
| Sentry | Error monitoring |
| Weights & Biases | Model experiment tracking |
| Vercel | Frontend hosting |
| Render | Backend API hosting |
We do not sell your data to any third party.
6. Cookies and Local Storage
We use browser localStorage only to store your anonymous session ID and UI language preference. We do not use advertising cookies or third-party tracking pixels. Supabase stores an authentication session token in a secure cookie after sign-in.
7. Your Rights
Under Malaysia’s Personal Data Protection Act 2010 (PDPA) and, where applicable, GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your data.
- Withdraw consent at any time by deleting your account.
To exercise these rights, contact us at the email below.
8. Children
NakTahu AI is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us for removal.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be announced via a notice on the website at least 7 days before they take effect. Continued use after the effective date constitutes acceptance.
10. Contact
For privacy questions or data requests, contact us at: privacy@naktahu.my