Privacy Policy

1. Who we are

OnlyAIApp is a product operated by Academy of AI Sdn Bhd (“AOAI”, “we”, “us”, or “our”), a company incorporated in Malaysia. The service lets you build and deploy a real, working software system with the help of an AI agent. This policy covers our product available at onlyaiapp.com. For any privacy question, you can reach us at support@goacademyai.com.

2. What data we collect

We aim to collect only what we need to give you a working product. The data we collect falls into these categories:

• GitHub account information. When you sign in with GitHub (OAuth), we receive your email address and GitHub username, which we use to create and identify your account and to provision a repository for your project.
• Contact details you choose to add. You may optionally provide a phone or WhatsApp number so we can reach you about your build. Providing this is entirely voluntary.
• A short profile you voluntarily provide. You may optionally tell us your role, what you're building, your company size, and how you heard about us. This helps us tailor your experience and improve the product. It is never required to use the service.
• Usage and analytics data. We collect information about how you interact with the product (pages visited, features used, and similar events) to understand usage and improve the service.
• Payment information. If you make a payment, your card and billing details are collected and processed directly by Stripe, our payment processor. We do not store your full card number on our servers.

3. How we use your data

• To run the service — authenticate you, create your account, and let you build with the AI agent.
• To provision and operate the infrastructure for your project (database, hosting, and code repository).
• To provide customer support and respond to your questions, including via the phone or WhatsApp number you choose to share.
• To understand product usage and improve features, reliability, and security.
• To send you product updates and marketing — only where you have given consent. You can withdraw that consent at any time (see Section 5).

4. Legal bases for processing (GDPR)

If you are in the EU or UK, we rely on the following legal bases under the GDPR:

• Contract. Processing necessary to provide the service you signed up for — creating your account and provisioning your project.
• Legitimate interest. Processing to operate, secure, and improve our product, where this is not overridden by your rights and freedoms.
• Consent. Processing for marketing communications and any optional information you choose to share. You can withdraw consent at any time.

Under Malaysia's PDPA, we process your personal data with your consent, or where the Act otherwise permits it without consent — for example where processing is necessary to perform a contract with you, or to comply with a legal obligation. You may withdraw your consent at any time (see Section 5).

5. Marketing & consent

We only send marketing and non-essential product updates if you have opted in. Opting in is your choice and is never a condition of using the service.

You can withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by emailing us at support@goacademyai.com. Withdrawing consent for marketing does not affect essential, service-related messages (for example, security or billing notices).

6. Who we share data with (sub-processors)

We do not sell your personal data. We share data only with trusted service providers (sub-processors) who help us run the product, and only as needed for them to perform their service. Our key sub-processors are:

• SupabaseDatabase & authentication hosting
• VercelApplication hosting & deployment
• GitHubOAuth sign-in & code repository provisioning
• StripePayment processing
• AnthropicAI model provider (Claude) powering the build agent
• ResendTransactional & marketing email delivery
• PostHogProduct analytics

These providers process data under their own privacy and security commitments. We may also disclose data where required by law or to protect our rights, users, or the public.

7. Data retention

We keep your personal data only for as long as we need it for the purposes described in this policy — typically while you have an active account, and for a reasonable period afterwards to meet legal, accounting, or security obligations. When data is no longer needed, we delete or anonymise it. You can ask us to delete your data sooner (see Section 8).

8. Your rights

Depending on where you live, you have rights over your personal data under the PDPA and/or the GDPR, including the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data, where applicable.
• Withdraw consent at any time, where we rely on consent.
• Data portability — receive a copy of your data in a portable format.

To exercise any of these rights, email us at support@goacademyai.com. We will respond within the timeframes required by applicable law. If you are in the EU/UK, you also have the right to lodge a complaint with your local data protection authority.

9. International data transfers

We and our sub-processors may store and process data in countries outside Malaysia, including the United States and the European Union. Where we transfer personal data across borders, we take steps to ensure it remains protected — for example, relying on recognised safeguards such as the EU Standard Contractual Clauses, and meeting the cross-border transfer requirements of Malaysia's PDPA — so your data receives a standard of protection comparable to that under the PDPA.

10. Cookies & similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the product is used (analytics). You can control cookies through your browser settings; disabling some cookies may affect how the service works.

11. Children

OnlyAIApp is not intended for children. The service is not directed to anyone under 16 (or under 18 where local law sets a higher age), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. We encourage you to review this page periodically.

13. How to contact us

For any questions about this policy or your personal data — or to reach our Data Protection Officer — email us at support@goacademyai.com. We are committed to resolving any concerns you may have about how we use your data.