Privacy policy
Last updated 30 September 2026
This policy explains what Sutera Hijau Academy Sdn. Bhd. (1226682-T) collects when you use OrcaSym and its Nora edition, why, and the control you have over it. It is written to meet Malaysia's Personal Data Protection Act 2010.
Research mode: please read this first
Nora is in a lab release. Your chats and feedback may be reviewed by the OrcaSym team to fix bugs and improve Nora. Please do not share private or confidential matters. Your saved memories stay encrypted and are yours to export or delete.
What we collect
- Account: your email address and, if you use Google sign-in, your name and Google account identifier.
- Conversations: what you type or say to Nora, files and images you give her, and her replies.
- Memories: facts Nora saves so she can remember you across conversations.
- Voice: audio from your microphone while you are speaking to Nora, used to transcribe what you said.
- Usage: how much of your allowance you have used, and technical logs such as errors, browser type and IP address.
- Billing: your plan and a Stripe customer reference. Card details go directly to Stripe; we never receive them.
- Connections you switch on: if you connect Gmail or Google Calendar, Nora reads them only to carry out what you ask.
Why we use it
- to provide the service: answering, remembering, speaking and carrying out tasks;
- to meter usage and bill paid plans;
- to keep the service secure and prevent abuse;
- to fix bugs and improve Nora during the lab release;
- to contact you about your account, such as billing or important changes.
We do not sell your personal data, and we do not use it for advertising.
Who processes it for us
Running Nora means sending the relevant part of a conversation to the services that power her. These providers process data on our instructions:
- AI models: DeepSeek and Google (Gemini) for understanding and generating answers and for transcribing speech.
- Voice: ElevenLabs, to turn Nora's replies into speech.
- Payments: Stripe.
- Sign-in: Google, if you choose Google sign-in.
- Hosting: DigitalOcean, in Singapore.
Some of these providers are outside Malaysia, so your data may be processed in other countries. We may also disclose data where the law requires it.
How long we keep it
We keep your account, conversations and memories until you delete them or close your account. Technical logs are kept for a limited period for security and debugging. Billing records are kept as long as tax and accounting law requires.
Your control
- Export: Settings → Data & Privacy → Export my data gives you your conversations and memories in one file.
- Delete: you can clear your conversations from the same place, and ask us to delete your account and everything in it.
- Access and correction: you can ask what we hold about you and have it corrected.
- Withdraw consent: you can disconnect Google connections at any time and stop using the service.
To make a request, email admin@suterahijau.com from the address you sign in with. We respond within 21 days.
Security
Data is encrypted in transit, saved memories are encrypted at rest, and access to production systems is limited to the team that operates them. No system is perfectly secure; if a breach affects you, we will tell you.
Children
The service is not intended for children under 13. Users under 18 need the consent of a parent or guardian.
Changes
If we change this policy in a way that matters, we will tell you in the app or by email before the change applies. Questions: see the contact page.