DamauraOpen the web app

Damaura Privacy Policy

PDPA 2010 Compliance • Apple App Store Requirements

Last updated: October 2026

Damaura is published and operated by TACHYS X SDN. BHD. ("Tachys X", "we", "us"), in collaboration with SERENITILABS SDN. BHD. ("Serenitilabs"), which develops and maintains Damaura. Tachys X is the data controller responsible for your personal data.

We are committed to protecting your privacy and ensuring the responsible handling of your personal data. This Privacy Policy explains how we collect, use, store, and protect information across the Damaura mobile app, the Damaura web app and damaura.ai, in accordance with Malaysia's Personal Data Protection Act (PDPA) 2010 and applicable international standards.

By using Damaura, you consent to the practices described below.

1. What We Collect

We may collect the following types of data:

1.1 Personal Information

  • Name, email address, phone number (if provided)
  • Account login information. If you sign in with Apple or Google, they share your name and email address with us (Apple can share a private relay address instead); we never see your Apple or Google password
  • Credit packs you buy: the pack, price, date and store transaction ID. Apple or Google takes the payment; we never see your card or bank details
  • Device information (model, OS version, language settings)

1.2 Wellbeing & App Interaction Data

  • Reflections, journal entries, and mood logs voluntarily entered by the user
  • Preferences, goals, and selected wellbeing modules
  • Conversation inputs sent to our AI wellness assistant
  • Non-identifiable analytics (e.g., feature usage, session length)

1.3 Automatically Collected Data

  • IP address
  • App performance logs
  • Crash reports
  • Basic device analytics (non-identifying)

1.4 Sensitive Personal Data

Only if voluntarily provided by the user through:

  • Wellbeing reflections
  • Emotional self-assessments
  • General stress or mood descriptions

Important: Damaura does not collect clinical, diagnostic, or medical records.

2. Our Purpose for Collecting Data

We process your data solely for wellness and app functionality, including:

  • To provide AI-driven wellbeing conversations and reflective tools
  • To personalise your experience and track your wellbeing trends
  • To improve app safety, quality, and usability
  • To troubleshoot issues, ensure system stability, and prevent misuse
  • To send optional reminders, updates, or support messages
  • To comply with legal obligations where applicable

Damaura does not provide medical or therapeutic diagnosis. All guidance is general wellness support only.

3. How We Use AI

Damaura uses artificial intelligence to generate supportive wellbeing responses.

When you interact with the AI:

  • Your text inputs are processed securely to generate responses
  • Your messages are sent to Anthropic (Claude), which generates responses, and to OpenAI, which creates the text embeddings Damaura uses to recall earlier context. Both process data in the United States
  • Inputs may be anonymised and used to improve response accuracy

We ensure that all AI processing complies with PDPA requirements, and no data is used for marketing or profiling.

4. Third-Party Data Sharing

We do not sell or rent your personal data.

Data may be shared only in the following limited situations:

4.1 Authorised Service Providers

These parties process data on our behalf to run Damaura:

  • SERENITILABS SDN. BHD. (Malaysia) – develops, maintains and operates Damaura for Tachys X
  • Supabase – database, accounts and sign-in; your data is stored in Australia
  • Resend (United States) – sends account emails such as sign-up confirmation and password reset
  • Netlify (United States) – hosting for damaura.ai and the Damaura web app
  • Anthropic (United States) – AI responses
  • OpenAI (United States) – text embeddings
  • Expo, Apple and Google – push notification delivery; Apple and Google also take payment for credit packs
  • RevenueCat (United States) – processes credit-pack purchases made through Apple and Google

These providers must comply with strict confidentiality, PDPA standards, and data-security requirements.

4.2 Transfers Outside Malaysia

Your data is stored in Australia, and your messages are processed in the United States, as described above. We transfer personal data outside Malaysia only with the consent you give when you create your account, or where the transfer is needed to provide something you ask for: RevenueCat processing a credit-pack purchase in the United States, or Resend sending your account emails, such as sign-up confirmation and password reset.

4.3 When You Request It

  • If you choose to export or share data
  • If you ask for a referral to a mental-health professional

4.4 Legal Requirements

We may disclose information only when required by law, such as:

  • Imminent risk of serious harm to yourself or others
  • Court orders, subpoenas, or regulatory directives

We aim to minimise disclosure and notify users where legally permitted.

5. Data Security Measures

We use industry-standard protections, including:

  • Encrypted transmission (HTTPS/TLS)
  • Encrypted data storage
  • Secure server infrastructure with firewalls
  • Role-based access controls
  • Regular security audits and monitoring
  • Staff confidentiality training
  • Strict internal data-handling policies

No digital system can guarantee absolute security, but we take all reasonable steps to protect your information.

6. Data Retention

We retain personal data only for as long as necessary:

  • Active account: data retained for user functionality
  • Account deletion: data is removed or anonymised within 30–90 days. Delete your account in the app or request deletion here
  • Purchase records: kept for 7 years, as Malaysian tax law requires. When you delete your account they are no longer linked to you
  • Backups: permanently removed within the standard backup retention cycle
  • Legal exceptions: extended retention only when legally required

7. Your Rights Under PDPA 2010

You may exercise the following rights at any time:

  • Right to Access – Request a copy of your data
  • Right to Correction – Fix inaccurate or incomplete data
  • Right to Withdraw Consent – Stop data processing where applicable
  • Right to Data Portability – Export your data
  • Right to Erasure – Request deletion of your personal data

To exercise your rights, contact us using the details below.

8. Children's Privacy

Damaura is intended for users aged 17 and above.

We do not knowingly collect data from individuals under 17. If such data is mistakenly collected, we will delete it promptly upon notice.

9. General Wellness Disclaimer

Damaura is a self-help and wellbeing application. We do not:

  • Provide medical or mental-health diagnosis
  • Offer clinical treatment
  • Replace licensed mental-health professionals

If you are experiencing a crisis or severe distress, please contact local emergency services or a licensed professional immediately.

10. Changes to This Privacy Policy

We may update this policy occasionally. Revisions take effect immediately once posted on this page. If we make a material change, such as a change in who controls your data, we will tell you in the app and ask you to review it.

We encourage you to review this policy periodically.

11. Contact Us

For questions, concerns, or requests regarding your personal data:

Email: hello@damaura.ai

Data Controller:

TACHYS X SDN. BHD.

Registration No: 202601027682 (1689778-W)

Suite 7, Pintu B, Kelab Sultan Sulaiman, Jalan Dewan Sultan Sulaiman, 50300 Kuala Lumpur

In collaboration with:

SERENITILABS SDN. BHD.

Registration No: 202601000377 (1662475-P)