Nymoru

This policy explains what personal data Nymoru collects, why, where it is kept, who receives it and the rights you have under Thailand's Personal Data Protection Act B.E. 2562 (PDPA). It covers the Nymoru web app (app.nymoru.com and nymoru.com), the Nymoru desktop app, the Nymoru in Chrome extension and the admin site (admin.nymoru.com).

Nymoru never sells your personal data, never shows you ads and runs no third-party analytics or tracking scripts.

1. Who we are

Nymoru is a personal AI assistant provided by WOXA Corporation Ltd. ("WOXA", "we", "us"). WOXA is the data controller for the personal data described in this policy, except where a company uses Nymoru for its staff (see Company workspaces). You can reach us at info@nymoru.com.

2. Data we collect

Account and sign-in

• Your name, email address, profile picture, job title, language and time zone, and, in a company workspace, your company, manager and role.
• If you sign in with Google or Microsoft: the account identifier, name and email address that the provider sends us. We never receive your password for those accounts.
• If you sign in with an email and password: your password, stored only as a one-way hash that we cannot read.
• Your agreement to these documents: the version you accepted, how (sign-up, invitation or sign-in), the time and your IP address.
• Sign-in sessions and devices: the browser or app (user agent), IP address and times. We email you when your account is used from a new device.

What you put into Nymoru

• Your chats with your bots and in group chats, the bots, routines and tasks you create, the files you upload and the documents, images, videos and websites your bots make for you.
• Memories: facts, preferences, procedures and short summaries of past conversations that your bots keep so they can help you better. You can see, edit and delete them under Memories.
• Your ratings of answers (thumbs up or down and a reason) and the corrections you make.

Usage and billing

• A usage record for each AI request (time, the space it ran in, the amount of processing and its cost in credits) and your credit balance.
• For paid plans: invoices, payments and, if you ask for a Thai tax invoice, the name, address, tax ID and branch you give us.
• An audit log of important actions in your account (for example sign-ins, settings changes and approvals). In your personal space the audit log records that something happened, not its content.

Data from features you choose to use

Voice, teaching, the cloud computer, Nymoru in Chrome and connected apps each collect data only when you use them. Each is explained in its own section below.

Technical data

Our servers record technical information such as IP addresses, request times and error reports to keep the service running and secure. If you use our mobile app and allow notifications, we store your device's notification token and device name.

3. How we use it and why

• To provide Nymoru to you (performance of our contract with you): answering you, carrying out the tasks you ask for, keeping your chats, files and memories, connecting your apps, running your cloud computer, and metering and billing your use.
• To keep Nymoru secure (our legitimate interest, and legal obligations): sign-in protection, new-device notices, abuse and fraud prevention, rate limits and audit logs.
• To improve Nymoru (our legitimate interest; you can object at any time): synthetic product tests and the limited uses described in Learning from use.
• To communicate with you: account emails such as verification, password reset, invitations and security notices. We do not send marketing email.
• To meet legal obligations: tax invoices, accounting records and lawful requests from authorities.
• With your consent, where the law requires it. You can withdraw consent at any time; this does not affect what was done before.

We do not use your personal data for advertising and we do not make decisions about you that have legal or similarly significant effects by automated means alone.

4. AI processing

Nymoru answers you and carries out tasks using AI models hosted on Google Cloud and AI models provided by Anthropic. For each request Nymoru picks a suitable model; the request and the context it needs (for example recent messages, relevant memories, file contents or a web page your bot is working on) are sent to the model and the answer comes back to Nymoru. Before memories are saved, Nymoru removes passwords, keys, card numbers, Thai ID numbers and bank account numbers, and card numbers are never shown to the AI models.

AI answers can be wrong. Check anything important before you rely on it.

5. Learning from use

Nymoru improves from how people use it, in three separate layers. You control them in Settings > Privacy > Learning.

1. Personal learning (on by default). Your ratings, corrections, edited drafts and the tasks that worked are stored as preferences and procedures in your own memory, in the same space they came from (work or personal), and are used only for you and your bots. A bot tells you in the chat when it has learned something. You can view, edit and delete each item under Memories, or switch personal learning off.
2. Company sharing (off unless your company's admin turns it on). Procedures your bots learned in the work space can be shared with your colleagues, without your name, after names, contact details, IDs and similar details are removed and, by default, after an admin reviews them. Personal-space data is never shared.
3. Product improvement. Collection of customer conversation content for generalized improvement is paused. Historical samples without verified provenance are excluded from new global training and evaluation exports. Developer-authored synthetic examples may be used to test the product. Your personal learning and company sharing settings above remain separate.

Your personal space is never used to improve Nymoru for anyone else. Sensitive data under section 26 of the PDPA (such as health, religion, political opinions, sexual life, criminal records, ethnicity, disability, trade union membership, genetic and biometric data) is excluded from learning by default. Turning a switch off stops new learning at once. Deleting your account deletes what your bots learned and removes your signals from future training data.

Google API data — Limited Use

Nymoru uses data obtained through Google APIs only to provide the features you authorize: reading and summarizing email and Drive files, preparing drafts, sending messages, and managing calendar events. Relevant content may be processed by AI hosted on Google Cloud to fulfill your request. We do not use Google Workspace API data, including summaries, feedback or other data derived from it, to develop, improve or train generalized AI or machine learning models.

Nymoru’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data or use it for advertising. You can disconnect Google in Settings > Apps, revoke access in your Google Account, and delete your Nymoru data as described under Your rights.

6. Teaching your bots

You can teach a bot a task by recording your screen (optionally with your voice), by recording or uploading a voice explanation, or by giving it a document. Recording starts only when you start it, and you see a notice before you record.

• The recording or document is sent to AI models hosted on Google Cloud to work out the steps, rules and facts, which are saved as a skill in your own memory, in the space of the chat you taught in.
• Passwords, one-time codes and card numbers are hidden from what is learned, and typing in password fields is never stored. A web task taught on screen never repeats a payment, a permanent deletion or a grant of access: those always need your own tap.
• The raw recording is encrypted with a key specific to you and kept in your Library for 30 days, then moved to the trash for 30 more days and deleted. On the skill card you can keep it, delete it now, or choose not to keep it at all. The skill stays until you delete it.
• In your personal space nothing you teach leaves you. In the work space your company sees a skill only if it shares work procedures and you agree.
• Close anything private before recording, and do not show other people's personal data unless you are allowed to share it. You are responsible for the people and information that appear in your recordings.

7. Voice

• A voice call starts only when you start it (a tap, the Space key or a keyboard shortcut). Nymoru never listens in the background and has no wake word.
• During a call your audio is streamed to AI models hosted on Google Cloud. Live voice is currently processed in the United States.
• We do not store the audio of calls or voice notes. What you and your bot say is saved as text in the chat, like typed messages, and you can delete it.
• If you share your screen during a call, about one image per second is sent to the AI model while sharing is on. These images are not stored.
• So that a dropped call can resume, the AI service may keep the call's state for a short time (up to 24 hours).

8. Your cloud computer

Some plans include a cloud computer that your bots use for tasks such as browsing websites and working with files.

• It runs on Google Cloud in Singapore, separately for each person, with its own storage disk. Files in its home folder stay there when it sleeps or restarts.
• Its web browser keeps the sign-ins (cookies) of websites you or your bots sign in to on it, so tasks can continue later. You can sign out of those sites on the computer at any time.
• To see what they are doing, bots take screenshots and read the page. In browser screenshots, password, one-time-code and card fields are blanked before anyone sees them, and the bot never types card numbers. Full-desktop screenshots are not blanked field by field. The last screen image of a task is kept on the task card in your chat until you delete it.
• You can watch the computer live or take it over. Company admins and Nymoru staff cannot see your screen, files or results through Nymoru; they see only status information such as plan and last use.
• Please note that the engineers who run our infrastructure have technical access to the systems that hold these disks.
• Cloud computer disks are not backed up. Keep your own copies of anything important.
• When you delete your account, your cloud computer, the storage disk that held its files and any snapshots of that disk are deleted automatically within 24 hours, usually within minutes. The same happens to every cloud computer of a workspace that is closed. The system keeps retrying until it has checked that nothing is left, and the audit log records that the deletion happened, without any of the content.

9. Nymoru in Chrome (browser extension)

The extension acts only when you connect it to your Nymoru account and turn it on, and only in browser tabs it opens for a task you gave Nymoru, or a tab you share with it. While it works on such a tab it sends the page's text, the names of its buttons and fields, and small screenshots to Nymoru's servers so the assistant can do the task; card numbers, passwords and one-time codes are hidden before that, and nothing is sent from sites on your "never touch" list. Files you ask it to download go to your Nymoru Library. The extension does not read your saved passwords, cookies or browsing history, does not record what you type (it only notices that you clicked or typed in its tab, to pause), and does not run on other tabs. It stores on your computer: the address of the Nymoru server, a connection token that only opens this connection, your settings and the "never touch" list. Data sent to Nymoru is handled like the rest of your Nymoru data (stored in Singapore; model processing may run in other regions) and is never sold or used for advertising. Disconnect the extension in its popup or in Nymoru > Settings > Apps to revoke the token; uninstalling it removes everything it stored.

10. Connected apps

You can connect apps such as Gmail, Google Calendar, Google Drive, Microsoft Outlook, Slack and GitHub, and add plugins (MCP servers) from a catalogue, from your company or by address.

• You connect an app through the app's own sign-in page and see the permissions it asks for, for example reading and sending email, managing calendar events or reading files. Nymoru gets only those permissions.
• Access tokens are stored encrypted, are never shown to the AI models and are never returned by our API.
• Your bots read data from a connected app when a task needs it. For connected inboxes, Nymoru checks for new messages every few minutes and keeps a copy of recent messages (text up to a fixed length) to sort and summarise them for you.
• When a bot sends something or changes something in a connected app for you, it goes out after a short undo window; permanent deletions and granting access always need your own tap.
• A plugin you add is run by its provider. What your bots send to it is handled under that provider's terms and privacy policy.
• Disconnecting an app deletes its tokens and, where the provider supports it, revokes the access at the provider. Microsoft has no such option for us, so also remove Nymoru at myapps.microsoft.com. Deleting your account disconnects every app.

11. Company workspaces

If you use Nymoru through your employer or another organisation, it manages the workspace and may set rules for it. Each person has a work space and a personal space that never mix.

• Company admins can see members, roles, plan, invoices, usage and cost by member and department, credit limits, allowed apps and the company's audit log.
• No admin, whether at your company or at Nymoru, can read your conversations, memories, files or inbox, or anything in your personal space. Personal-space activity appears to admins only as counts and a total cost.
• Your company may have its own policies about how you use work tools. For work-space data we process on its behalf, your company may also be a controller; contact it about its own use of your data.

12. Who receives your data

We share personal data only as needed to run Nymoru, and only with:

• Google Cloud, our hosting, database, storage and AI provider, which processes data on our instructions.
• AI model providers, which process the request and its context only to produce the answer, on our instructions: Anthropic.
• Infrastructure providers: our domain name service, which also handles the redirect from nymoru.com to app.nymoru.com; the service that sends our account emails; GitHub, from which the desktop app checks for updates; and, if you use our mobile app with notifications on, Apple's and Google's notification services. In your personal space notifications say only that something new arrived; in your work space they may include a short preview of the message.
• Sign-in providers (Google, Microsoft) when you choose to sign in with them.
• Apps and plugins you connect, and websites your bots use for you, at your direction.
• Payment providers, when paid plans open, to process your payments. When a bot helps you buy something today, you pay on the shop's own page and Nymoru does not receive your card details.
• Your company, as described in Company workspaces.
• Authorities, when the law requires it, and professional advisers bound by confidentiality.
• A buyer or successor, if WOXA's business is sold or reorganised, under this policy's protections.

13. Where your data is stored and processed

Your account data, chats, files and memories are stored on Google Cloud in Singapore (database, files and backups). AI processing, including processing of personal data, may take place outside Singapore and Thailand, including in the United States and in Google Cloud's global locations; Anthropic processes the requests sent to it in the United States and other countries where it operates; and live voice is processed in the United States. These transfers rely on the safeguards permitted by sections 28 and 29 of the PDPA, including our contracts with Google Cloud and Anthropic. You can ask us for details of the safeguards (see Contact us).

14. Security

• Data is encrypted in transit and at rest.
• Personal-space memories and files are additionally encrypted with keys specific to you. When you delete your account, the key of your personal memories is destroyed, which also makes their copies in database backups unreadable.
• Each person's data is separated from other people's and other companies' data, including by database access rules.
• Passwords, keys and card numbers are removed before memories are saved, and app tokens are encrypted.
• Payments, permanent deletions and granting access always wait for your own tap.

No system is perfectly secure. If a breach affects your personal data we will notify the authorities and you as the PDPA requires.

15. How long we keep data

• Your account, chats, files, bots and memories: until you delete them or your account.
  • Memory is permanent. What Nymoru remembers about you, and the short summaries of your past conversations, are kept until you delete them or delete your account. They no longer expire after 180 days.
  • Memory is distilled over time. As you keep using Nymoru, it distills the important things from your ongoing use. Older detail is moved to an archive instead of being deleted.
  • You are in control. You can view, edit and delete your memories at any time. Deleting your account deletes everything, including what is archived.
  • Procedures your bots learned expire after 120 days unused.
• Trash: deleted files, messages, bots, chats, routines and memories stay in the trash for 30 days so you can restore them, then are deleted.
• Teaching recordings: 30 days in your Library and 30 days in the trash, unless you choose otherwise (Teaching).
• Learning signals: up to 90 days as signals; up to 12 months in evaluation and training sets (Learning).
• Activity and task records: the activity rows of finished work for 7 days; files of finished coding sessions for 30 days.
• Cloud computer and its disk: until you delete your account or your workspace is closed, then deleted automatically within 24 hours (Your cloud computer).
• Sign-in sessions: 12 hours, or 30 days from your last use (at most one year) when you choose to stay signed in.
• Links in our emails: verification 24 hours, password reset 1 hour, invitations 7 days.
• Database backups: 30 days. Deleted data can remain in backups until they expire, except personal-space memories, which become unreadable at once.
• System logs: for a limited period set by our cloud provider's log retention.
• After you delete your account: we delete your data at once (see Your rights). We keep, under the label "Deleted user" and without your email address, records we need for legal, accounting and security reasons: invoices, the credit ledger and purchases, your consent records, audit logs and approvals decided with colleagues. We keep them only as long as those reasons require.

16. Cookies and local storage

Nymoru uses only its own cookies, all needed for the service. We use no advertising or analytics cookies.

• Sign-in session (as long as the session) and protection against cross-site request forgery.
• Sign-in flow (about 10 minutes) and form protection (until you close the browser).
• Device recognition, for new-device notices (400 days; we store only a hash of it).
• Your language choice (one year).

The web app also keeps a few settings (such as your language and display choices) in your browser's local storage. The desktop app keeps its sign-in token in your operating system's secure credential store.

17. Your rights under the PDPA

Under the PDPA you have the right to:

• Access your personal data and get a copy, and ask how we obtained data you did not give us (section 30).
• Data portability: receive your data in a commonly used electronic format, or have it sent to another controller where technically possible (section 31).
• Object to processing based on our legitimate interests, including product improvement (section 32).
• Erasure: have your data deleted, destroyed or made anonymous (section 33).
• Restriction: have the use of your data suspended (section 34).
• Rectification: have inaccurate or incomplete data corrected (sections 35 and 36).
• Withdraw consent at any time, where we rely on consent (section 19).
• Complain to the Office of the Personal Data Protection Committee (PDPC) of Thailand.

Many of these you can do yourself in Nymoru: edit your profile; see, edit and delete memories; switch learning off in Settings > Privacy; disconnect apps in Settings > Apps; and delete your account in Settings. Deleting your account is immediate and cannot be undone. For anything else, including a copy of your data, email info@nymoru.com from your account's email address. We may need to confirm your identity and will answer within 30 days. If you cannot sign in, write to us from the account's email address.

18. Children

Nymoru is not designed for children. If you are a minor, you need the consent of your parent or guardian to use Nymoru where the law requires it. If you believe a child has given us personal data without the required consent, contact us and we will delete it.

19. Changes to this policy

We will post any change on this page with a new version date. If a change is significant, we will tell you in the app or by email before it takes effect and, where the law requires, ask for your consent again.

20. Contact us

WOXA Corporation Ltd., operator of Nymoru
Email: info@nymoru.com

For any question about this policy or your personal data, or to use your rights, write to us at the address above.