Privacy Policy

1. Introduction

Nalya("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at nalya.ai(the "Service"). The Service is operated by Connection Companion.

Please read this privacy policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you sign in with Google, we receive your name, email address, and profile picture.
• Google Calendar Data: If you choose to connect your Google Calendar, we access your calendar list, event details (titles, times, locations, descriptions), and free/busy information. See Section 8 for details.
• Conversation Data: Text conversations you upload for analysis.
• User Content: Any content you create, upload, or share through the Service.
• Phone Number: If you opt in to SMS messaging, we collect and store your phone number to send notifications and enable text-based interactions with our AI assistant. See Section 9 for details.
• Communications: Feedback, support requests, and other communications with us.

2.2 Information Collected Automatically

• Usage Data: How you interact with the Service, features used, and time spent.
• Device Information: Browser type, operating system, and device identifiers.
• Log Data: IP address, access times, and pages viewed.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Analyze conversations and generate insights as requested by you
• Process your requests and respond to your communications
• Send you technical notices, updates, and support messages
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

4. Data Security and Encryption

We implement industry-standard security measures to protect your data:

• End-to-End Encryption: Sensitive conversation data is encrypted using strong cryptographic protocols based on the Signal Protocol.
• Forward Secrecy: We use the Double Ratchet algorithm to provide forward secrecy, ensuring that even if encryption keys are compromised in the future, past communications remain protected.
• Secure Storage: Data is stored on secure cloud infrastructure with encryption at rest.
• Access Controls: Strict access controls limit who can access your data.
• Regular Audits: We regularly review our security practices and update them as needed.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party services that help us operate the Service (e.g., cloud hosting, analytics).
• Legal Requirements: When required by law or to respond to valid legal requests.
• Safety: To protect the rights, property, or safety of Nalya, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

6. Your Rights and Choices

You have the right to:

• Access: Request a copy of your personal data.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your data (subject to legal retention requirements).
• Portability: Request your data in a portable format.
• Opt-out: Opt out of certain data collection and marketing communications.

To exercise these rights, please contact us at support@nalya.ai.

7. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy. When you delete your account, we will delete or anonymize your personal information within 30 days, unless we are required to retain it for legal purposes.

8. Google Calendar Integration

Nalya offers an optional Google Calendar integration. You may connect or disconnect your Google Calendar at any time from the Settings page. When connected, we request the following Google OAuth scopes:

• calendar.readonly: Used to retrieve your list of calendars so you can choose which one to sync with, query your free/busy times to suggest available scheduling slots, and check for conflicts with existing events when you schedule a plan.
• calendar.events: Used to create a calendar event when you publish a plan or are accepted as an attendee, update the calendar event when plan details (time, location, description) change, and delete the calendar event when a plan is unpublished or cancelled.

8.1 How We Use Google Calendar Data

Google Calendar data is used solely to provide and improve the scheduling features of the Service. Specifically:

• Display your available calendars so you can select which calendar to sync plans with.
• Show your free/busy times to suggest optimal scheduling slots for plans.
• Warn you of scheduling conflicts when you create or modify a plan.
• Automatically create, update, and delete calendar events to keep your plans in sync with your calendar.
• Check whether linked calendar events still exist to keep plan status accurate.

We do notuse Google Calendar data for advertising, marketing, user profiling, or any purpose unrelated to providing or improving the Service's scheduling functionality. We do not sell, share, or transfer Google Calendar data to third parties, except as necessary to provide the Service (e.g., secure cloud storage).

8.2 Storage and Security of Google Calendar Data

Google Calendar OAuth tokens (refresh and access tokens) are encrypted using AES-256-GCM before being stored in our database. Calendar event metadata (such as event IDs and links) is stored alongside plan data to maintain synchronization. We do not store the full contents of your calendar; we only query event data in real time when needed for conflict checking and availability suggestions.

8.3 Revoking Access

You can disconnect your Google Calendar at any time from Settings > Integrations. When you disconnect, we revoke the OAuth tokens and delete all stored calendar connection data, including encrypted tokens and calendar metadata. You can also revoke access directly from your Google Account permissions page.

9. SMS and WhatsApp Messaging

Nalya offers optional SMS and WhatsApp messaging features for match reminders, scheduling notifications, and conversational interactions with our AI assistant. This section explains what data we collect, how we use it, and how you can opt out. Sections 9.1–9.6 describe SMS; Section 9.7 describes WhatsApp.

9.1 Data We Collect via SMS

When you opt in to SMS messaging, we collect and store:

• Phone number: Your mobile phone number, used to send and receive SMS messages.
• Message content: The text of messages you send to us and our replies, stored as conversation history to provide context-aware responses from our AI assistant.
• Opt-in/opt-out status: Whether your SMS connection is active or deactivated, including timestamps of status changes.
• Delivery metadata: Message delivery status (sent, delivered, failed) provided by our SMS carrier for troubleshooting and reliability.

We do not collect contacts from your phone, location data via SMS, or any information beyond the message content and phone number you provide.

9.2 How We Use SMS Data

• Send match reminders, squad notifications, and scheduling updates you have opted in to receive.
• Process your inbound text messages and generate AI-assisted responses.
• Maintain conversation history so our AI assistant can provide contextual, personalized replies.
• Comply with carrier and regulatory requirements (e.g., honoring STOP/START keywords).

SMS data is not used for advertising, marketing to third parties, or sold to any third party.

9.3 Message Frequency

Message frequency varies based on your activity. You may receive messages when matches are scheduled, squads are formed, plans change, or when you initiate a conversation with our AI assistant via text. Under normal usage you will not receive more than 25 messages per day.

9.4 Message and Data Rates

Standard message and data rates from your wireless carrier may apply. Nalyadoes not charge any additional fees for SMS messaging.

9.5 Opting Out and Deleting SMS Data

You may opt out of SMS messages at any time by replying STOP to any message from us. You will receive a single confirmation and no further messages will be sent. Reply to re-subscribe. Reply for support information.

10. Third-Party Services

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

We use the following third-party services:

• Google Sign-In: For authentication (subject to Google's Privacy Policy)
• Google Calendar API: For calendar integration as described in Section 8 (subject to Google's Privacy Policy)
• Firebase: For data storage and hosting (subject to Google Cloud's Privacy Policy)
• OpenAI/Anthropic: For AI-assisted analysis (conversation data is processed but not stored by these providers for training)
• Telnyx: For SMS messaging delivery, and as our WhatsApp Business Solution Provider, as described in Section 9 (subject to Telnyx's Privacy Policy)
• Meta / WhatsApp: For messaging over the WhatsApp Business Platform as described in Section 9.7 (subject to WhatsApp's Privacy Policy)

11. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. These countries may have different data protection laws. By using the Service, you consent to the transfer of your information to these countries.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: