Privacy Policy

1. Who we are

MMAI Technology Co., Ltd. is a technology company registered in Myanmar that builds web applications, mobile applications, business automation and custom AI agents, and operates the Onami AI Sales Agent product.

For the purposes of this policy, MMAI Technology is the data controller of personal information collected through the Site and our direct business relationships. Where we build or operate systems on behalf of a client, we normally act as a data processor on that client's instructions.

2. Information we collect

2.1 Information you give us

• Contact details such as your name, email address, phone number and company name when you email us, call us, or submit a form on the Site.
• The email address you submit to our product notification form.
• Project information you share with us during enquiries, scoping and delivery, including requirements, documents and access credentials you choose to provide.
• Billing and payment information required to invoice you for Services.

2.2 Information collected automatically

• Technical data such as IP address, browser type and version, device type, operating system, referring URL and pages viewed.
• Server logs generated by our hosting provider, which are used for security, abuse prevention and troubleshooting.

2.3 Information from clients' end users

When we operate an automation or AI agent on behalf of a client, that system may process personal information about the client's own customers or staff — for example names, contact details and message content. We process this data only on the client's documented instructions and under our agreement with that client.

We do not knowingly collect special categories of personal data (such as health, biometric or political data) through the Site, and we ask that you do not send such information to us unless it is expressly required by a signed agreement.

3. How we use information

• To respond to your enquiries and provide quotes, proposals and consultations.
• To deliver, support, maintain and improve the Services you have engaged us for.
• To send you product updates you have specifically requested, such as our notification list.
• To issue invoices, process payments and maintain accounting records.
• To operate, secure and improve the Site, including diagnosing technical problems.
• To comply with legal, regulatory and tax obligations.

We do not sell your personal information, and we do not share it with third parties for their own independent marketing purposes.

4. Legal basis for processing

Where data protection law such as the EU/UK GDPR applies to our processing, we rely on the following legal bases:

• Contract — to take steps at your request before entering into a contract and to perform a contract with you.
• Legitimate interests — to operate and secure our Site, understand how it is used, and communicate with business contacts, balanced against your rights.
• Consent — for optional communications such as the product notification list. You can withdraw consent at any time.
• Legal obligation — to meet accounting, tax and regulatory requirements.

5. Cookies and analytics

The Site is a static website and does not set advertising or cross-site tracking cookies. It may use strictly necessary cookies or local storage required for basic functionality, and our hosting provider records standard server access logs.

The Site loads web fonts from Google Fonts. When a page loads, your browser requests those font files from Google's servers, which means your IP address and browser information are visible to Google. See Google's privacy policy for details of how they handle that data.

If we introduce analytics or marketing cookies in future, we will update this policy and, where required by law, request your consent first. Most browsers let you block or delete cookies through their settings.

6. AI services and your data

Our custom AI agents and automation systems may send content you or your end users provide to third-party AI model providers in order to generate responses. We select providers that offer business or enterprise terms and, where those terms are available, we configure services so that your content is not used to train third-party foundation models.

• We do not use client business data to train our own general-purpose models without explicit written permission.
• Conversation logs and agent activity may be retained so that clients can audit, debug and improve their systems, subject to the retention terms in the client agreement.
• AI-generated output can be inaccurate. Systems we build include guardrails and, where appropriate, human review or handoff — but output should not be treated as professional advice.

7. Sharing and disclosure

We share personal information only in the following circumstances:

• Service providers — hosting, cloud infrastructure, email, payment and AI model providers who process data on our behalf under contract.
• Professional advisers — accountants, auditors and lawyers, where necessary and bound by confidentiality.
• Legal requirements — where disclosure is required by law, regulation or valid legal process, or to protect our rights, safety or property.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.

8. Third-party services we rely on

The Site and our Services are supported by third-party infrastructure, which may include Google Cloud (hosting and deployment), Google Fonts (typography), email providers, payment processors, and AI model providers. Each processes data under its own terms and security controls. Where we integrate a client's own platforms — such as CRM systems, Facebook or TikTok business APIs — data handling in those platforms is governed by the platform's own terms and the client's configuration.

9. International transfers

We are based in Myanmar and use cloud infrastructure that may store or process data in other countries. Where personal information is transferred across borders, we take reasonable steps to ensure it remains protected by appropriate contractual and technical safeguards with our providers.

10. Data retention

• Enquiry and contact records: kept while there is an active business relationship and for a reasonable period afterwards.
• Notification list emails: kept until you unsubscribe or ask us to remove you.
• Project and delivery data: kept for the duration of the engagement and any agreed support period, then deleted or returned as agreed with the client.
• Invoices and accounting records: kept as long as required by applicable tax and company law.
• Server logs: kept for a short period for security and troubleshooting.

11. Security

We apply reasonable technical and organisational measures to protect personal information, including encryption in transit (HTTPS), access controls, least-privilege credentials, managed cloud infrastructure and separation of client environments. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Please do not send passwords, API keys or other credentials by plain email. We will provide a secure method for sharing them during an engagement.

12. Your rights

Depending on where you live, you may have the right to request access to the personal information we hold about you, to have it corrected or deleted, to object to or restrict certain processing, to receive a portable copy, and to withdraw consent at any time.

To exercise any of these rights, email info@mmaitechnology.com. We will respond within a reasonable period and may need to verify your identity first. If your data is processed by us on behalf of a client, we will direct your request to that client, who is the controller.

13. Children's privacy

The Site and Services are intended for businesses and adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

14. External links

The Site links to third-party websites, including onami.asia. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing personal information.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The revised version will be posted on this page with a new "Last updated" date. Material changes affecting active clients will also be communicated directly.

16. Contact us

This policy is provided for general information and is not legal advice. Please have it reviewed by a qualified lawyer against your registered company details, registered office address and the jurisdictions your customers are based in before relying on it.