Privacy Policy
Last updated: 27 July 2026. This explains what Gantua collects, why, where it goes, and the choices you have. It is written to comply with the Malaysian Personal Data Protection Act (PDPA) and to be readable by humans.
1. Who this covers
Three groups of people touch Gantua: founders and their teams (our customers), leads the platform researches on a customer's instruction, and customers' customers (for example a buyer who places a storefront order). This policy covers all three.
2. What we collect and why
| Data | Why |
|---|---|
| Account data — name, email, password (hashed), workspace membership | Sign-in, security, and telling teammates apart |
| Business data — your company charter, discovery interview answers, goals, documents and content you provide | This is what your AI staff works from; it is the product |
| Work product — drafts, decision cards, sites, plans the platform produces for you | So you can review, approve, and reuse it |
| Lead data — publicly-sourced and licensed firmographic data about businesses you ask us to research, with a recorded lawful basis per lead | Lead generation you explicitly start |
| Order data — a storefront buyer's name, contact, and order note | Captured only to relay the order to the business they bought from |
| Usage and billing data — AI tokens used, per-call costs, credit balances, charges frozen at usage time | Honest metering and billing |
| Channel identifiers — Telegram chat ID, WhatsApp number, push subscription, mailbox settings you connect | Delivering the notifications and sends you configure |
The marketing site (gantua.com) sets no tracking cookies. The app uses a session credential to keep you signed in.
3. Where your data goes
Gantua runs on infrastructure we operate, and specific features send specific data to processors:
- AI providers (currently Google's Gemini models): the text needed for the task at hand — for example your charter facts when drafting your website. Your data is not used by us to train models.
- Data gateway (Monid): lead-research queries you initiate, and image-generation prompts.
- Payments (Stripe): top-up payment details are handled by Stripe; we never see card numbers.
- Messaging channels you connect (your own mailbox, Telegram, WhatsApp): the messages you approve for sending.
- Advertising platforms (Meta), only when you fund and confirm managed advertising.
We do not sell personal data. Ever, to anyone.
4. What appears publicly
The public activity pulse on gantua.com shows your company name and the type of action (for example "approved a decision card") with a minute-coarse time. It never shows content, customer details, people's names, amounts, or identifiers. Websites and storefronts you approve for publication are, by definition, public.
5. Security
- Stored credentials (API keys, tokens) are encrypted at rest; session tokens are hashed at rest; passwords are hashed.
- Access to production systems is restricted to the platform operator.
- No system is perfectly secure; if a breach materially affects you, we will notify you as the law requires.
6. Retention and deletion
- Your business data and work product are kept while your account is active so the platform can keep working from them.
- Billing records are kept as required for accounting and tax.
- The app includes a privacy request flow — you can request export or deletion of personal data from inside the platform, or by email. Deletion requests are honoured except where the law requires retention.
- Leads can be marked do-not-contact; one unsubscribe suppresses an address from every future campaign, permanently.
7. Your rights
Under the PDPA (and equivalent laws that may apply to you), you can request access to, correction of, or deletion of your personal data, and withdraw consent to processing that is based on consent. Storefront buyers and leads can direct requests to us or to the business that holds their relationship; we relay and honour them.
8. Children
Gantua is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.
9. Changes
We will post updates here with a new date. Material changes to how we handle personal data will be flagged in the app.
10. Contact
Privacy questions and requests: contentteam@kamiunlimited.com.