Privacy protected

Privacy Policy

We are committed to protecting your privacy and being transparent about how we handle your data.

Last updated · July 2026
Privacy at a glance
You're in control of your data

Delete any project, or your whole account, anytime. We permanently erase it from our cloud and email you confirmation.

Encrypted end to end

AES-256 at rest, TLS 1.3 in transit.

No AI training

Your schedules are never used to train AI models.

You own your data

Export or delete on request.

GDPR-aligned

Access, correction, and deletion rights.

01

Introduction

Nahla AI is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our project-intelligence platform at nahla.ai.

02

Information we collect

Account information

When you create an account, we collect:

·Email address
·First and last name
·Company name (optional)
·Password (stored encrypted)
Project files

When you use the service, you may upload project schedule files (.XER, .xlsx, and MS Project exports). These files are processed to generate your analytics, reports, and agent actions.

Usage data

We automatically collect basic usage information:

·Browser type and version
·Pages visited and features used
·Date and time of access
03

How we use your information

Provide and maintain our service
Process and analyze your project files
Generate reports and visualizations
Send important service updates and notifications
Respond to your inquiries and support requests
Improve our platform and develop new features
AI & your schedule data

We do not use your schedule data to train AI models, ours or anyone else's. Your uploaded schedules are processed only to generate your analysis, reports and the agent actions you request. When you use AI chat or an agent, the relevant schedule context is sent to a specialist third-party AI provider in the United States to generate the response; your prompts are not used to train their models. Your chat history is stored in your account so you can return to a conversation, and you can delete conversations at any time.

AI agents & communications

Some agents can draft emails on your behalf, for example Progress Collection drafts update requests to the subcontractors you choose. These are sent only after you approve them, and only to the recipients you specify. Each recipient opens a secure, single-use link (no account required); we store only a hashed token, never the raw link. The information you include in a request is shared with that recipient.

04

Data storage, retention & deletion

Reports & analytics

Generated reports and analytics may be stored so you can access your previous analyses. You can delete any project and its data yourself at any time from within the app. This permanently removes the project's schedule data and your uploaded files from our cloud storage (AWS), and we email you a confirmation once the erasure is complete.

Account data

Your account information is retained for as long as your account is active. You can delete your account and all of its data yourself at any time from your account settings, no need to contact us. This permanently removes your projects, schedule data, uploaded files, and account records from our cloud (AWS), and we send a confirmation email once the erasure is complete. Deletion is irreversible.

05

Data security

We implement industry-standard security measures including:

TLS 1.3 encryption for all data in transit
AES-256 encryption for data at rest
Hosting on SOC 2 / ISO 27001-certified cloud infrastructure (AWS)
Regular security audits and monitoring
Subprocessors

We rely on a small set of trusted subprocessors to run the Service: Amazon Web Services (cloud hosting & storage, in Sydney, Australia), a specialist AI provider in the United States (AI processing), and Amazon SES (transactional & agent email). Each processes data only as needed to provide the Service, and none uses your data to train models.

06

Your rights

You have the right to:

Access · request a copy of your personal data
Correction · update or correct your account information
Deletion · request deletion of your account and associated data
Export · download your reports and analytics data
Withdraw consent · opt out of non-essential data processing

To exercise any of these rights, please contact us at [email protected].

07

International data transfers

Our core services are hosted on cloud infrastructure in the Asia-Pacific (Sydney) region. To generate AI responses, limited schedule context is processed by a specialist AI provider located in the United States. By using the AI features, you consent to this overseas processing. If you're accessing our services from outside Australia, please also be aware that your data may be transferred to, stored, and processed in Australia.

08

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date above and, for material changes, notify you in-app or by email. Your continued use of the service after an update means you accept the revised policy.

09

Contact us

Questions about this policy or how we handle your data? Contact us at [email protected] and we'll get back to you within 24 hours.

Questions about your privacy?

Reach out, we respond within 24 hours and treat every question as a real one.