Privacy Policy

1. Data We Collect

From Shop Owners

• Account Information: Email address and encrypted account credentials used to access the Service.
• Facebook Page Data: Facebook Page ID and Page name, connected through Meta's official authorisation flow.
• Business Information: Shop name, product catalogue (names, descriptions, prices, images), and payment details you choose to share with customers.
• Subscription Data: Subscription plan type, expiry date, and payment evidence submitted for plan upgrades.
• Promotion Code Data: Your unique referral code and payout account details provided for commission processing.
• Usage Data: AI assistant interaction history, credit usage, sales analytics, and order records generated through the Service.
• Device Information: Device identifiers required to deliver push notifications to your mobile device.

From End Customers (via Facebook Messenger)

• Identity Data: A platform-assigned user identifier and any name or phone number voluntarily provided during the order process.
• Order Data: Items ordered, quantities, selected payment method, delivery address, phone number, and order status.
• Payment Evidence: Payment confirmation images sent by the customer to complete a purchase, stored securely and linked to the relevant order record.
• Conversation Data: Messages exchanged between the customer and the AI sales agent, used solely to process orders and generate appropriate responses.

2. How We Use the Data

• Service Delivery: To operate the AI sales agent, process orders, manage product catalogues, and provide sales analytics to shop owners.
• AI Processing: Customer messages and relevant shop context are processed by our AI service to generate appropriate sales responses.
• Push Notifications: To send order alerts and subscription notifications to shop owners and administrators on their mobile devices.
• Subscription Management: To verify payments, activate subscriptions, and process referral commissions.
• Security and Fraud Prevention: To detect and prevent account abuse, referral fraud, and unauthorised access.
• Service Improvement: To monitor system performance, diagnose errors, and improve Service functionality.
• Legal Compliance: To comply with applicable laws and regulations in Myanmar.

3. Data Storage

Your data is stored on secure cloud servers operated by reputable third-party cloud infrastructure providers. All stored data is protected through access controls, encryption, and role-based permissions. Only authorised personnel and systems can access your data, and only to the extent necessary to provide the Service.

By using the Service, you acknowledge that your data and your customers' data may be processed and stored on servers outside Myanmar, in accordance with international data processing standards.

4. Data Sharing

We do not sell your data or your customers' data to any third party. We share data only in the following circumstances:

• Infrastructure Providers: We use trusted third-party cloud and AI service providers to operate, store, and process data. These providers are bound by data processing agreements and are permitted to use your data only to provide services to us.
• Meta (Facebook): Order confirmation messages and AI-generated responses are delivered to customers through Facebook Messenger via Meta's official platform.
• Internal Administration: Authorised Company administrators may access subscription upgrade requests and referral code details solely to administer the Service.
• Legal Requirements: We may disclose data if required to do so by law, court order, or government authority in Myanmar.

5. Data Retention

We retain your data only for as long as necessary to provide the Service and meet our legal obligations. Account data is retained for the duration of your account and for a reasonable period following termination. Order records and payment evidence are retained for a period sufficient to resolve any disputes and comply with financial record-keeping requirements. Conversation data is retained for a limited period after the last interaction.

After the applicable retention period, data is permanently deleted from our systems unless a longer retention period is required by law.

6. Data Security

We implement industry-standard security measures to protect your data from unauthorised access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, strict access controls, role-based permissions, and regular security reviews.

No system is completely secure. We encourage you to use a strong, unique password and to contact us immediately at info@onami.asia if you suspect any unauthorised access to your account.

7. Shop Owner Responsibilities

Shop owners who use Onami AI to interact with their customers are responsible for the personal data of those customers. MMAI TECHNOLOGY COMPANY LIMITED processes this data on the shop owner's behalf and in accordance with their instructions.

Shop owners are responsible for:

• Informing their customers that an AI agent is handling order communications on their Facebook Page.
• Ensuring they have a lawful basis for collecting and processing their customers' personal data.
• Responding to any customer requests to access or delete their personal data.
• Complying with all applicable data protection and consumer privacy laws in Myanmar.

8. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data to our Service, please contact us at info@onami.asia and we will take steps to delete such data promptly.

9. Your Rights

As a Shop Owner, you have the following rights regarding your personal data:

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may request that we correct any inaccurate data.
• Deletion: You may request deletion of your account and associated data, subject to legal retention requirements. See our Data Deletion Policy.
• Portability: You may request a copy of your business data in a portable format.
• Objection: You may object to certain processing of your data by contacting us directly.

To exercise any of these rights, contact us at info@onami.asia. We will respond within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the Effective Date at the top of this document and notify active users through the application. Your continued use of the Service after any changes constitutes acceptance of the updated Policy.

11. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy, please contact: