Gantua Privacy Policy

Last updated: 29 September 2026.

Gantua is operated by GARGANTUAN SDN. BHD. (registration number 202601035957 (1698052-A)), 15-2, Dinasti Sentral, Jalan Kuchai Maju 18, Off Jalan Kuchai Lama, 58200 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia ("Gantua", "we", "us"). This notice explains how we handle personal information when you visit our website, use Gantua, or interact with a business using Gantua. It is information about processing, not blanket consent to every optional use.

1. Our role

We determine how information is used to operate our website and accounts, provide and bill for our service, respond to inquiries, and protect our systems. When a business uses Gantua to process information about its customers, leads, staff or other people under its instructions, that business generally determines the purpose of that work; Gantua handles the information to provide the service and under any applicable data-processing agreement. If a business supplied your information, you can contact it about its purposes and your rights, or contact us and we will help route the request.

2. Information we handle

For website visitors, we may receive information you send to our contact channels and technical request information such as IP address, device/browser details, requested page and time of access. Website preferences may include your device's reduced-motion setting. The marketing website does not currently set tracking cookies. The app uses a session credential to keep you signed in. If we add analytics, advertising or other non-essential storage later, we will update this notice and provide any consent choice required by law before that use begins.

For service users, we handle account and workspace information, authorised member roles, business or personal instructions, chat text, files and other material users submit, work Gantua produces, action requests and results, usage and billing records, and security or diagnostic records. When you connect another service, we may handle the identifiers, permissions and tokens needed for the connection and relevant information retrieved or sent under your authority. Information may also come from an authorised workspace member, a connected service, or someone communicating with a business that uses Gantua.

Do not provide sensitive or regulated information through a feature unless it expressly supports that use. This does not remove our responsibilities for information we receive.

3. Why we use information

We use information to respond to inquiries; administer accounts; deliver requested work; perform actions within approved permissions and budgets; manage subscriptions, credits and payments; keep records of actions and approvals; secure the service; prevent abuse; comply with legal obligations; and handle requests or disputes. We limit business-customer data processed on instruction to the authorised service purpose unless another lawful basis and appropriate notice apply.

The legal basis for a particular use depends on the information and applicable law. It may include providing a service under a contract, complying with a legal duty, our documented legitimate interests in operating and protecting Gantua, a business customer's lawful instructions, or consent where required. If information is optional, we will explain the relevant choice when we collect it. We do not treat acceptance of this notice as consent to optional tracking, marketing or model training.

4. AI processing and model improvement

We send the information needed to perform a requested AI task to service providers that help generate or process the result. Using information to perform your task is different from using it to train or improve a shared model. Gantua does not currently use customer content to train shared AI models.

If we later introduce shared-model improvement, the proposed scope is limited to text a user types directly into ordinary chat. Uploaded files, connected-account material, tool or retrieval results, and content derived from those sources would remain excluded. Before starting, we will explain the purpose and recipients, update this notice, provide an accessible opt-out, and obtain affirmative consent wherever law requires it. We will not start the use unless the controls, lawful basis, filtering and every enabled provider's terms and settings support the stated choice. Another person's personal or confidential information does not become eligible merely because it was typed into chat. Any future opt-out would affect subsequent collection and use after it takes effect; it could not necessarily reverse training already completed.

5. Who receives information

We share information only as needed for the purposes above with providers supporting hosting, AI processing, payment, communications, customer support and security; with connected services and recipients involved in actions authorised by a customer; and with professional advisers or authorities where a lawful basis applies. Information a customer chooses to publish or send may also be received by the destination platform or recipient under its own terms. We may disclose information in a genuine corporate transaction with appropriate safeguards and notice where required.

We may add or replace providers. A change does not itself expand the purposes for using information, permit additional training or override a customer choice. We will maintain applicable provider and subprocessor information separately and give notice or obtain authorisation where required by the applicable agreement or law. We do not sell personal information. Any advertising-related sharing or opt-out rights will be disclosed if such activity is used.

6. International processing and security

Gantua is based in Malaysia. Providers, connected services and authorised personnel may process information in other countries. We apply the transfer arrangements required for the information and destination involved and provide information about those arrangements on request, subject to lawful confidentiality limits.

We use access controls and other safeguards appropriate to the information and risks. No system can be guaranteed completely secure. We investigate incidents and notify affected people, customers or authorities when law or contract requires.

7. Retention, closure and deletion

We keep information for as long as needed for the purpose for which it was collected and then delete or anonymise it according to a documented schedule. In setting each period, we consider the duration of the account and service, whether the information is needed for ongoing work or a request, applicable accounting and legal obligations, security needs and dispute periods. Connected-service information already lawfully retained is not necessarily erased merely by disconnecting the service, and a completed action cannot be recalled from its recipient.

When an account is closed, Gantua stops service operations and provides 30 days of export-only access to retained exportable account data, subject to necessary security and legal restrictions. After that window, account content is deleted under the applicable retention schedule. Records required for billing, disputes or legal obligations are kept only for the relevant limited purpose and period. Backup and provider deletion follow their documented schedules rather than a promise of immediate removal from every copy.

8. Your rights and choices

Depending on applicable law and our role, you may have rights to access, correct, erase or receive your information, restrict or object to certain uses, withdraw consent, or challenge certain automated decisions. These rights may have conditions or exceptions. Withdrawal does not invalidate processing that was lawful before withdrawal. We may ask for proportionate proof of identity or authority. If a business customer controls the information, we will assist that customer with the request under the applicable agreement. You may complain to the relevant privacy regulator; you do not have to contact us first.

Contact us at privacy@gantua.com for privacy requests or support@gantua.com for general help. We will respond within the time required by applicable law. If optional tracking is used where consent is required, we will provide the relevant choice before it is activated.

9. Age and updates

The initial Gantua service is for people aged at least 18 or the applicable age of majority, whichever is higher. A separate future offering for young entrepreneurs would need its own provider, product and legal safeguards. If we receive information about a child in a customer's records or by mistake, we will handle it according to our role and applicable law.

We will date updates to this notice and explain material changes through appropriate channels. A revised notice does not by itself authorise a new purpose or replace consent where consent is required.