Privacy Policy

1. Introduction

nammu ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

2. Information We Collect

We may collect information about you in a variety of ways. The information we may collect via the website includes:

2.1 Personal Data

Personally identifiable information such as your name, email address, and telephone number that you voluntarily give to us when choosing to participate in various activities related to the website and our services. This might include signing up for newsletters, participating in surveys, or providing feedback.

2.2 Derivative Data

Information our servers automatically collect when you access the website, such as your IP address, browser type, operating system, access times, and the pages you have viewed directly before and after accessing the website.

2.3 Cookies and Web Beacons

We use one strictly-necessary session cookie (kiwi_sess) to keep you signed in, plus optional analytics and advertising cookies that are only set after you consent via our cookie banner. For full details of the cookies we set and how to change your choice, see our Cookie Policy.

3. How We Use Your Information

We may use the information we collect about you for the following purposes:

• To provide, operate, and maintain our website and services
• To improve, personalize, and expand our website and services
• To understand and analyze how you use our website
• To develop new products, services, features, and functionality
• To communicate with you, including for customer service and updates about our services
• To process transactions and send related information
• To prevent fraudulent transactions, monitor against theft, and protect against criminal activity
• For marketing and advertising purposes

4. Legal Basis for Processing

We process your personal data according to the following legal bases:

• Consent: Where you have explicitly agreed to our processing of your personal data for one or more specific purposes
• Performance of a Contract: Where processing is necessary for the performance of a contract with you
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject
• Legitimate Interests: Where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party

5. Disclosure of Your Information

We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

5.1 By Law or to Protect Rights

If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.

5.2 Third-Party Service Providers

We may share your information with third parties that perform services for us or on our behalf, including payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance.

5.3 Business Transfers

In the event of a business transaction, such as a merger, acquisition, partnership, joint venture, or bankruptcy proceeding, your information may be transferred to a successor or affiliate.

6. Your Rights Under GDPR

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. nammu aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal data.

Under the GDPR, you have the following rights:

• Right to Access: You have the right to request copies of your personal data.
• Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to Erasure: You have the right to request that we erase your personal data, under certain conditions.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions.
• Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you wish to be informed what personal data we hold about you and if you want it to be removed from our systems, please contact us at info@nammu.ch or info@app.kiwi.

7. Data Retention

We only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements. In practice, we apply the following retention periods:

• Account and profile data: kept while your account is active, then up to 30 days after you request deletion, after which it is irreversibly anonymized.
• Audit and security logs: kept for 24 months, then automatically purged.
• Chat and AI-agent messages: kept for up to 24 months to provide agent memory and context, unless you delete them earlier.
• Accounting records (invoices, quotes, transactions): kept in line with applicable statutory retention obligations, typically 10 years in Switzerland and the EU.
• Backups: encrypted and rotated on a rolling cycle, with older backups overwritten within 30 days.

Where a period is stated as "up to" a duration, that is a maximum, data may be deleted sooner. To determine the appropriate period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes of processing, and the applicable legal requirements.

8. Data Security

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure.

Sub-processors & Third-Party Providers

To deliver our services we rely on a limited set of carefully selected sub-processors. Each one processes data only for the purpose shown. Transfers to providers located in the United States rely on the European Commission's Standard Contractual Clauses (SCCs). CRM contact data and email content sent to the agent execution provider are pseudonymized beforehand (see the "AI Agents & Your Data" section above).

9. International Transfers

We are based in Switzerland, but our services can be accessed globally. Therefore, we might transfer and process data in various countries. Where we transfer personal data outside of the EEA or Switzerland, we ensure that appropriate safeguards are in place to ensure an adequate level of data protection.

10. Changes to This Privacy Policy

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Last updated" date and the updated version will be effective as soon as it is accessible. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

11. Contact Us

If you have questions or comments about this privacy policy, you may contact us at: