Privacy Policy

1. Who We Are

Nawaya, Inc. (“Nawaya”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect personal information when you use our website, platform, and services.

• Company name: Nawaya, Inc.
• Legal form: Delaware C Corporation
• Address: c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States
• Contact email: info@nawaya.io
• EU representative (Art. 27 GDPR): Mahmoud Rami Hajji, An der Weberei 13, 73540 Heubach, Germany — email: info@nawaya.io.

Although Nawaya is incorporated in the United States, we offer our services internationally and comply with the EU General Data Protection Regulation (GDPR) and other applicable data-protection laws where required.

2. Data We Collect

We collect the following categories of personal data:

3. How We Use Your Data

• To operate and provide the platform and its features
• To create and manage user accounts
• To enable journaling, content creation, and participation in sessions or programs
• To provide chatbot and AI-assistant features (Neya, Guide Copilot)
• To send newsletter and marketing emails where you have consented
• To improve our services, functionality, and user experience
• To communicate service-related updates and important information
• To process payments and manage subscriptions or access rights
• To ensure platform security, prevent misuse, and detect fraud
• To comply with legal and regulatory obligations

4. Legal Basis for Processing (GDPR)

We process personal data only where permitted by law. Depending on the context, processing is based on one or more of the following legal grounds under Article 6 GDPR:

• Contractual necessity – where processing is required to provide our services
• User consent – particularly for analytics, marketing/newsletter, and optional features
• Legitimate interests – such as platform security, service improvement, and operational efficiency
• Legal obligations – where processing is required to comply with applicable laws

You may withdraw your consent at any time with future effect.

5. Cookies & Analytics

We use cookies and similar technologies to operate our website, analyze usage, and improve performance. Non-essential cookies and tracking technologies are only used with your explicit consent, and are loaded only after you have consented.

Depending on your consent choices, we may use the following tools:

These tools may collect information such as IP address, device data, pages visited, interaction patterns, and event data. Detailed information about cookies, providers, purposes, and retention periods is available in our Cookie Policy. You may adjust or withdraw your consent at any time via the cookie settings on our website.

6. Data Sharing & Processors

We only share personal data where necessary and in accordance with applicable laws. In particular, we use the following processors and recipients:

• MongoDB Atlas (USA) – database hosting and storage of platform data
• Cloudinary (USA) – storage and delivery of images/uploads (e.g. profile pictures)
• our email/SMTP provider – sending sign-in links, notifications, and newsletter emails
• Zoom (USA) – running the video sessions between Growers and Guides
• Stripe (USA) – payment processing
• OpenAI (USA) – powering our website chatbot and the in-platform AI assistants “Neya” and “Guide Copilot”; text you enter is processed to generate responses
• Google (Google LLC, USA) – optional “Sign in with Google”, and — with consent only — analytics/optimization
• Meta (USA) and Microsoft Clarity (USA) – reach and usage analytics (with consent only)
• Legal authorities where disclosure is legally required

We have data-processing agreements in place with all processors under Article 28 GDPR. A current list of the providers we use is available on request (info@nawaya.io).

7. International Data Transfers

Your personal data may be processed outside the EU/EEA, in particular in the United States. There is no general adequacy decision for the United States. Where required under GDPR, we base such transfers on appropriate safeguards — the EU-US Data Privacy Framework (where the relevant provider is certified) or EU Standard Contractual Clauses (SCCs) — to ensure an adequate level of data protection.

Recipients in the United States include, in particular, Stripe, Zoom, OpenAI, Google, Meta, Microsoft, MongoDB, and Cloudinary. Copies of the Standard Contractual Clauses are available on request.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, including providing our services, complying with legal obligations, and resolving disputes.

Account-related data is generally retained for the duration of your account. Certain data may be retained longer where legally required (e.g. accounting or compliance obligations). Some data categories — such as chat transcripts, messages, or expired pending records — are additionally subject to technical retention limits after which they are deleted automatically.

When you delete your account, your personal data is deleted or anonymized across all systems, subject to statutory retention obligations (e.g. accounting records).

9. Your Rights

Under the GDPR, you have the following rights:

• Access personal data
• Rectify inaccurate or incomplete data
• Request deletion of your data
• Restrict processing
• Request data portability
• Object to processing
• Withdraw consent at any time

You can request a machine-readable export of your data and delete your account directly from your account settings. To exercise other rights, contact us at info@nawaya.io. You also have the right to lodge a complaint with a supervisory data-protection authority, in particular in your country of residence or place of alleged infringement.

10. Security

We implement appropriate organizational and technical measures to protect personal data against unauthorized access, loss, or misuse. However, no system is completely secure, and we cannot guarantee absolute security.

11. Marketplace, Messaging, Chatbot & AI Assistants

Nawaya is a marketplace that connects Growers (people seeking guidance) and Guides (mentors). To make working together possible, certain profile data becomes visible to the other side — e.g. name, profile picture, country, languages and a short bio, and for Guides also expertise areas, ratings and availability.

When a session is booked or an invitation is sent, we share the information needed for it with the parties involved (e.g. booking and appointment details). Messages you send within the platform are delivered to the respective recipient and stored to provide the chat feature.

On our website we offer a chatbot/support assistant; within the platform we also provide the AI assistants “Neya” (dashboard assistant) and “Guide Copilot” (support for Guides). If you use these features, the text you enter is transmitted to and processed by OpenAI (USA) to generate responses. For the “Guide Copilot”, information about the mentee (e.g. first name, goals) may also be processed. The legal basis is performance of the user contract and our legitimate interest in providing the feature; for the transfer to the United States, see section 7.

12. Newsletter & Marketing Emails

If you subscribe to our newsletter, we process your email address to send you marketing emails. Subscription uses a double opt-in process: we first send you a confirmation email, and you are only subscribed once you click the confirmation link.

The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time — via the unsubscribe link in every newsletter email or by contacting info@nawaya.io. Unconfirmed subscriptions are deleted automatically after a short period.

13. Sign in with Google

You may optionally sign in with your Google account (“Sign in with Google”). In doing so, we receive your name, email address, and Google account identifier from Google (Google LLC, USA) to create or sign you in to your Nawaya account. The legal basis is contract performance or pre-contractual measures (Art. 6(1)(b) GDPR). For the transfer to the United States, see section 7.

14. Referral & Invitation Links

Nawaya uses referral links. If you visit the website via such a link, we store a short referral code locally in your browser (localStorage) and link it to your account when you later register, in order to attribute the referral. The legal basis is our legitimate interest in attributing referrals (Art. 6(1)(f) GDPR).

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or via other appropriate means.