Privacy Policy
Who we are
Nuwy Tech is a sole proprietorship owned by Thimira Nuwan, based at 382/9, Pragathipura, Atakohota, Nawadagala, Sri Lanka. We build software and web applications and operate SmartMessageAI, a WhatsApp AI messaging and CRM platform available at smartmessageai.com. In this policy, “we”, “us” and “our” mean Nuwy Tech.
You can reach us at hello@nuwytech.com or on +94 78 441 9630.
What this policy covers
This policy applies to our website at nuwytech.com and to the SmartMessageAI service. It explains what personal data we handle, why, who else handles it, and how you can ask us to delete it.
SmartMessageAI has two groups of people whose data we handle:
- Our clients: businesses that sign up for SmartMessageAI and their staff.
- Our clients' customers: people who message a client's WhatsApp Business number.
For our clients' customers, the client decides why and how their customers' messages are used. We process that data on the client's behalf, only to provide the service.
Information we collect
When you visit nuwytech.com
Our website does not use cookies, advertising trackers or analytics tools, and it does not load fonts, scripts or images from other companies. Like most web servers, ours keeps standard access logs (IP address, date and time, pages requested, browser type) for security and troubleshooting. These logs are rotated automatically.
When you contact us
If you email or phone us, we receive your contact details and whatever you tell us, and we use it to reply to you.
Client accounts
When a business signs up for SmartMessageAI we collect the account holder's name, email address, phone number, business name and login credentials, and records of the plan, payments and support requests. Payments are made by bank transfer, so we do not store card numbers.
Our clients' customers
When a customer messages a client's WhatsApp Business number, SmartMessageAI receives and stores:
- the customer's WhatsApp phone number and profile name;
- the content of the messages sent and received, including images or documents such as payment slips;
- details the client records in the CRM, such as notes, orders and delivery details.
Client settings and uploads
Clients can upload product information and photos, and can add their own AI provider API key. API keys are stored encrypted and are never displayed in full.
Cookies in the SmartMessageAI dashboard
The SmartMessageAI dashboard uses only the cookies or browser storage needed to keep a client signed in securely.
How we use information
- To provide SmartMessageAI: send and receive WhatsApp messages, generate AI replies, and show conversations, customers and orders to the client and the client's staff.
- To create and manage client accounts, process bank-transfer payments and give support.
- To keep the service secure, prevent abuse and fix problems.
- To send service emails, such as plan reminders and monthly reports requested by the client.
- To meet legal and accounting obligations.
We do not use customer messages to advertise to anyone, and we do not build advertising profiles.
AI processing
SmartMessageAI uses AI models to write replies and to detect things like orders. To do this, the relevant parts of a conversation and the client's business information (such as product details) are sent to the AI provider the client has chosen, currently OpenAI or Anthropic. The provider is accessed with an API key that belongs to the client or, during a trial, to us. Providers process this data under their own terms and privacy policies.
AI replies can be wrong. Clients are responsible for reviewing how their assistant behaves and can switch the AI off for any conversation.
Service providers
We use these companies to run our services. Each receives only what it needs for its role.
- Meta (WhatsApp Cloud API): delivers WhatsApp messages between clients and their customers.
- Supabase: database, sign-in and file storage.
- Hetzner: server hosting, in Germany.
- OpenAI and Anthropic: AI models, as described above.
- Resend: sending service emails.
- Backblaze: encrypted database backups.
Some of these providers are located outside Sri Lanka, so personal data may be transferred and stored in other countries, including Germany and the United States.
Sharing and selling
We do not sell personal data. We share it only with the service providers above, with the client whose customer you are, when the law requires it, or to protect our rights and the safety of others.
How long we keep data
We keep client account data while the account is active, and customer conversations and CRM records for as long as the client keeps them in SmartMessageAI. When a client closes their account, or when someone asks us to delete data and we can do so, we delete it as described below. We may keep limited records, such as payment and invoice records, for as long as the law or our accounting obligations require.
Security
We protect data with encrypted connections (HTTPS), access controls, separation between clients' data, encrypted storage of API keys and encrypted backups. No online service is completely secure, but we work to reduce risk and to fix problems quickly.
Data deletion
You can ask us to delete your personal data at any time.
How to ask
Email hello@nuwytech.com with the subject “Data deletion request”. Tell us:
- your name and the phone number or email address the data is linked to;
- whether you are a SmartMessageAI client or a customer who messaged a business that uses SmartMessageAI, and if so which business.
We may ask you to confirm your identity so that we do not delete or disclose data to the wrong person.
What happens next
- We confirm your request within 7 days.
- We delete the data within 30 days of the request being confirmed.
- Copies in encrypted backups are overwritten as backups rotate, which takes up to 7 further days.
What we delete
For a client: the account, business settings, products, customer records, conversations, orders and uploaded files. For a customer of a client: your phone number, name, messages and CRM records stored in SmartMessageAI. If the business holds the data for its own purposes, we may need to pass your request to that business, and we will tell you if we do.
What we may keep
Records we are legally required to keep, such as payment and invoice records, and the record of your deletion request itself. We will tell you what we kept and why.
Messages on your own phone and in WhatsApp are not stored by us. To remove them, use WhatsApp's own controls.
Your rights
You can ask us to tell you what personal data we hold about you, to correct it, to delete it, or to stop using it for a purpose you object to. We aim to handle personal data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022. To use any of these rights, email hello@nuwytech.com.
Children
Our services are for businesses and are not directed at children under 18. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as our services change. We will change the “Last updated” date at the top of this page, and for significant changes we will notify clients by email.
Contact us
Nuwy Tech
382/9, Pragathipura,
Atakohota, Nawadagala,
Sri Lanka
hello@nuwytech.com
+94 78 441 9630