Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how THEBRG Enterprise (Business Registration No. 003120480-W), a sole proprietorship registered in Malaysia and trading as NAX (“we”, “us”, “our”), handles information when you use the NAX AIGC platform, including the website, the studio, your render library, billing flows and support channels.

We act as the data user (controller) for account and billing data, and as a processor of the content you choose to submit for generation. This policy should be read together with our Terms & Conditions. It is written to comply with the Malaysian Personal Data Protection Act 2010 (PDPA) and reflects GDPR-style principles for users outside Malaysia.

2. Information we collect

We collect only what is needed to operate the platform, bill it accurately and keep it safe.

• Account data: name, email address, password hash, company or brand name, country, preferred language, and communication preferences.
• Billing data: plan, billing cycle, invoices, credit balance and transaction history. Card and bank details are collected and stored by our payment processor, never by us; we receive only a token, the last digits, card brand and outcome.
• Generation content (Input): prompts, negative prompts, style, camera, lighting, ratio, duration, seed and other settings, plus any images, video, audio or documents you upload as references.
• Generated content (Output): the video, image, audio and text produced for you, together with its recipe metadata, stored in your library so you can review and reuse it.
• Usage and diagnostic data: credits consumed, engine and model used, job status, render duration, queue timings, error and failure logs, feature interactions, device and browser type, approximate location derived from IP, and IP address.
• Local browser storage: we store certain interface state and, where applicable, library data on your device so the studio behaves consistently between visits.
• Support data: the content of your messages, attachments and any generation identifiers you share when contacting us.

3. Sensitive data and content you should not upload

Please do not upload sensitive personal data unless it is strictly necessary and lawful. This includes health or medical records, biometric identifiers, government identity documents, financial account records, payment card images, religious or political affiliation, and any material relating to children.

If you upload media containing an identifiable person, you confirm in the Terms that you hold that person’s documented consent for AI processing and for your intended use. We may block, remove or refuse to process content that appears to breach this, and we may retain a record of the incident where required for legal or safety purposes.

3A. Identity verification data

To use creation features, every account must pass identity verification. For individuals we collect your full legal name, NRIC number, images of the front and back of your identity card, and a selfie with the face fully visible. For companies we collect the registered business name, business registration (SSM) number, registered address, the registration certificate and, where provided, a director's identity document.

This data is collected for one purpose only: confirming that the account holder is a real, identifiable person or a lawfully registered business, and preventing fraud, scams, impersonation and unlawful use of generative tools. It is never used for advertising, never sold, and never used to train AI models.

Documents are stored in private storage that is not publicly reachable. Each account can only see its own submission, and reviewer access is limited to authorised NAX staff through short-lived links, with every review action logged against the reviewer.

Verification records are retained while the account is active and for the period required by Malaysian law for fraud-prevention and legal-defence purposes, then deleted or anonymised. Approval lasts six (6) months, after which a fresh submission is required.

Under the Malaysian Personal Data Protection Act 2010 you may request access to or correction of your verification data by contacting us from your account email. Because identity data is required by our anti-fraud obligations, deleting it means the account can no longer use creation features.

4. How and why we use information

We use information on the following lawful bases: performance of our contract with you, our legitimate interests in operating and securing the service, your consent where required, and compliance with legal obligations.

• To create and administer your account, authenticate you and provide the studio and library.
• To transmit your Input to the AI model providers required to generate your requested Output, and to return the result to you.
• To meter and bill credits, process subscriptions, prevent payment fraud and maintain accurate financial records.
• To operate abuse prevention, safety filtering and content moderation, including automated detection and, where necessary, limited human review of flagged material.
• To debug failures, improve reliability, measure aggregate platform performance and plan capacity.
• To provide support and to send service, security, billing and policy notices.
• To send marketing communications only where you have opted in, with an unsubscribe link in every message.
• To comply with law, respond to lawful requests, and establish, exercise or defend legal claims.

5. We do not use your content to train our own models

We do not use your prompts, uploads or generated Output to train, fine-tune or otherwise develop our own AI models, and we do not sell your content or personal data to anyone.

Third-party model providers process your Input to fulfil your generation request under their own terms. We select providers and configure integrations with the intention that customer content is not used for provider model training where such a setting or contractual commitment is available. Because these are independent companies whose policies can change, we cannot warrant their internal practices, and you should avoid submitting confidential material you could not tolerate being processed by a third-party provider.

6. Who we share information with

We share information only with the categories of recipients needed to run the platform, and only to the extent necessary:

• AI model and inference providers, to generate your requested Output from your Input.
• Cloud hosting, storage, content delivery and database providers, to run the platform and hold your library.
• Payment processors and accounting providers, to take payment, issue invoices and meet tax obligations.
• Email delivery, error monitoring, product analytics and customer support tools.
• Professional advisers, insurers and auditors, where reasonably required, under confidentiality obligations.
• Law enforcement, regulators, courts or rights holders, where we are legally required or where disclosure is necessary to investigate abuse, prevent serious harm, or protect our rights.
• A successor entity, in the event of a reorganisation, merger or transfer of the business, subject to this policy.

7. International transfers

Our providers operate globally, so your information, including prompts and uploads, may be transferred to and processed in countries outside Malaysia, including the United States, the European Union and the Asia-Pacific region.

Where we transfer personal data internationally, we take reasonable steps to ensure a comparable level of protection through contractual safeguards such as standard contractual clauses, provider data-processing agreements and encryption in transit.

8. Storage and retention

Generations are saved to your library so you can review, reuse and manage them; the library is a convenience feature, not a backup or archival service, and you should keep your own copies of anything you rely on.

We keep information for as long as needed for the purpose it was collected, then delete or anonymise it. Indicative periods:

• Account data: for the life of the account, then up to 12 months after closure to handle disputes and reinstatement requests.
• Input and Output in your library: until you delete it, or until the storage or retention limit of your plan is reached; content is deleted within a reasonable period after account closure.
• Billing and tax records: up to 7 years, as required by Malaysian tax and accounting law.
• Diagnostic and job logs: typically up to 90 days, longer where needed for security investigations.
• Moderation and abuse records: as long as necessary to prevent recurrence or to defend legal claims.

9. Security

We apply reasonable technical and organisational measures appropriate to the platform, including encryption in transit, access controls, credential hashing, least-privilege administration, provider-managed infrastructure security and monitoring.

No internet service can be guaranteed absolutely secure. You are responsible for using a strong, unique password, keeping credentials confidential and controlling who has access to your account and seats. If we become aware of a breach that materially affects your personal data, we will notify you and any relevant authority as required by law and without undue delay.

10. Your rights

Subject to the PDPA and other applicable law, you may:

• Request access to the personal data we hold about you and information about how it is processed.
• Request correction of inaccurate or incomplete data.
• Request deletion of your content or account, subject to records we must retain by law.
• Withdraw consent to marketing at any time, and limit certain processing.
• Request a copy of data you provided in a portable format, where technically feasible.
• Ask questions or complain about our handling of your data; you may also complain to the Personal Data Protection Department of Malaysia.

11. Cookies and local storage

We use strictly necessary cookies and browser storage for authentication, session security, load balancing and interface state, including keeping your studio settings and library available on your device.

Where we use analytics to understand aggregate usage, it is configured to minimise personal data. You can clear or block cookies and local storage in your browser, but core features such as staying signed in and retaining studio state may stop working.

12. Children

The platform is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the platform, our providers and the law change. The effective date above indicates the current version, and material changes will be communicated in the platform or by email. Continued use after the effective date means you accept the updated policy.

14. Your responsibility as the uploader of other people's data

Where you upload or prompt with material containing another person's face, voice, name, identity documents or other personal data, you are the data user (controller) for that material and we act on your instructions as processor. You are responsible for having a lawful basis and, where required, documented consent for the AI processing, for the intended publication and for the territory of publication.

You are also responsible for giving those individuals the notices their local law requires, for honouring any withdrawal of consent, and for telling us promptly so we can delete the affected material. We do not contact, notify, verify or obtain consent from third parties on your behalf, and we have no way to know whether consent exists. Any claim brought by a person depicted in material you supplied or requested is indemnified by you under the Terms.

15. Automated processing, safety screening and no automated legal decisions

Prompts, settings and uploads pass through automated content-safety screening before credits are spent, and through automated abuse, fraud and rate-limit checks. These systems can block a request, flag an account for human review, or suspend access where the signals indicate serious risk.

Automated screening is imperfect: it may block permitted material or fail to catch prohibited material. It is a risk-reduction measure, not a guarantee, an approval, a legal clearance or an endorsement of anything you generate or publish. No decision producing legal effects about you is made by automated means alone — enforcement decisions involving suspension or termination are reviewed by a human, and you may ask for that review by replying through Studio Support.

16. Security incidents and the limits of security

We maintain access controls, row-level database isolation, private storage with short-lived signed links, encrypted transport and least-privilege service credentials. No system, however, is perfectly secure, and we cannot warrant that unauthorised access, interception or loss will never occur.

If a personal-data breach occurs that is likely to cause significant harm, we will investigate, contain it, and notify affected users and any competent authority as and where the law requires, without undue delay after we become aware. Our notification will describe what we know, what we are doing and what you should do.

You are responsible for the security of your own device, email account and password, and for anyone you allow to use your account. Compromise arising from your own credentials, devices, integrations or shared access is outside our control and outside our liability.

17. We do not sell your data

We do not sell, rent, licence or trade personal data, prompts, uploads or generated media, and we do not use them for third-party advertising, profiling for advertising, or cross-context behavioural tracking. Sharing is limited to the processors needed to run the platform, as listed above, each bound by contract to use the data only for that purpose.

In the event of a reorganisation, merger, acquisition or transfer of the business, data may transfer to the successor entity, which will remain bound by a policy no less protective than this one. You will be notified through the platform or by email if that happens.

18. Complaints and supervisory authority

If you are unhappy with how we handle your data, contact us first with your account email and a description of the issue; we aim to acknowledge within five (5) business days and to resolve substantive requests within thirty (30) days, or to explain any lawful delay or refusal.

If you remain dissatisfied, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia, or with the supervisory authority of your country of residence where that authority has jurisdiction. Raising a complaint does not affect your other legal rights.

We may charge a reasonable fee or refuse a request where the law permits — for example where a request is manifestly unfounded, repetitive, would reveal another person's data, or where we are required to retain records for tax, accounting, safety, fraud-prevention or legal-defence purposes. Retained records are kept only for those purposes and access to them is restricted.

19. Contact

THEBRG Enterprise (003120480-W), trading as NAX, Malaysia. For privacy requests, data access or deletion, or to report misuse of content, contact us through the channels listed at naxaigc.com, including your account email so we can verify your request.