HEYOHM.AI · LEGAL

Privacy Policy

Last updated: October 21, 2026

1. Data Controller & Corporate Details

HeyOhm.ai is operated by Oasis Swiss Sdn Bhd (“we,” “us,” or “our”), which acts as the data controller responsible for your personal information:

• Company Name: Oasis Swiss Sdn Bhd
• Registration No.: 201101030331 (958466-U)
• Direct Selling License (AJL): AJL932427
• Registered Address: 25, Jalan PP 11/3, Taman Putra Perdana, 47130 Puchong, Selangor, Malaysia

This Privacy Policy outlines how we collect, use, disclose, and protect your personal information when you interact with or use our website, applications, and related services (collectively, the “Service”). For any inquiries, privacy concerns, or data protection requests, please contact us at [email protected].

2. Information We Collect

We collect information to provide, improve, and secure the Service. An email address and password are required to create an account; all other information is provided voluntarily depending on the features you choose to use:

• Account Details: Your name, email address, password, and associated workspace details.
• Your Content: Prompts, product photos, product specifications, images, audio, video files you upload, and any AI-generated outputs created from them.
• Face & Voice Data: If you create a custom “Creator” avatar, we collect the original audio/video recordings you upload and process the biometric characteristics necessary to generate the resulting synthetic images, avatars, and voice models.
• Billing Information: Details regarding your subscription plan, purchase history, and credit transactions. Payment card details are collected and processed directly by our third-party payment processor (Stripe) and are never stored on our servers.
• Connected Platform Accounts: When you connect third-party platforms (such as TikTok, TikTok Shop, or Instagram), we collect access tokens and the basic account data necessary to publish content and display analytics authorized by you.
• Support & Communications: Messages, queries, and feedback sent to our support team.
• Technical & Usage Data: Log files, IP address, device type, operating system, browser details, and activity metrics regarding how you interact with the Service.

3. Purposes and Permissions

We process your personal information strictly for the following purposes:

• Service Operation: To deliver and maintain the Service, process AI generations, and create the custom content you request.
• Billing & Subscriptions: To handle payments, invoice processing, subscription plans, and credit usage.
• Social Platform Integration: To publish content to, and fetch performance data from, third-party platforms (such as TikTok, TikTok Shop, or Instagram) at your direction.
• Service Communications: To contact you regarding account management, security updates, feature announcements, and changes to these Terms or policies.
• Security & Enforcement: To monitor, detect, and prevent fraud, platform abuse, security threats, and violations of our Terms.
• Legal Compliance: To comply with applicable legal obligations and official governmental requests.

Data Privacy Guarantee: We do not sell your personal information, nor do we use it to serve third-party advertising. You may choose to stop providing optional information at any time (for example, by disconnecting a connected social account), though related features requiring that data will cease to function.

4. Faces, Voices, and AI Providers

• “Creator” Avatars & Likeness Rights: A “Creator” avatar is generated using the audio and video recordings you upload. We store these original recordings and the resulting digital assets within your workspace so you can generate content. You must ensure you have obtained explicit consent from any individual whose face, voice, or likeness is used to create a Creator (as set forth in our Terms).
• Third-Party AI Model Processing: To generate content, we transmit necessary inputs—such as prompts, images, text, and media recordings—to specialized third-party AI model providers. These providers process your inputs solely to deliver the requested output in accordance with their respective terms and privacy policies.
• No AI Model Training: We do not use your uploaded content or generated outputs to train, fine-tune, or improve our own proprietary AI models.

5. Information Sharing and International Transfers

We do not sell your personal data. We share your information only under the following circumstances:

• Essential Service Providers: With third-party vendors that help us operate the Service, including cloud hosting and database storage, AI model providers, payment processing (Stripe), and email/communications delivery.
• Connected Platforms: With social platforms you choose to integrate (such as TikTok, TikTok Shop, or Instagram) solely to execute the publishing and analytics actions you authorize.
• Workspace Members: With members or users within your workspace, who can access workspace content and credits based on their assigned roles and permissions.
• Public or Shared Media: With other users or on public channels only with your explicit consent. Your content remains strictly private to your workspace across all plans, including the Free plan.
• Legal & Safety Requirements: When required by applicable law, regulation, or court order, or to enforce our Terms and protect the rights, property, and safety of HeyOhm.ai, our users, or the public.
• Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

International Data Transfers: Your information may be transferred to, stored, and processed in countries outside of your country of residence. Where required by law, we implement appropriate standard contractual mechanisms and security safeguards to protect your personal data during international transfers.

6. Cookies and Similar Technologies

• Essential Cookies: We use essential cookies and local storage technologies strictly necessary to operate the Service—such as keeping you securely signed in, remembering your session preferences, and protecting your account against security risks.
• No Advertising or Tracking Cookies: We do not use third-party advertising, tracking, or invasive behavioral analytics cookies.
• Third-Party Payment Services: Subscription and payment pages are hosted directly by our payment processor, Stripe, which may set functional and security cookies under its own Privacy Policy.

7. Retention and Security

• Data Retention: We retain your personal information for as long as your account remains active or as necessary to provide the Service, fulfill legal obligations, resolve disputes, and enforce our agreements.
• Account Deletion & Anonymization: When you request the deletion of your account, we securely delete or permanently anonymize your personal data, except where retaining certain records is required by applicable law or regulation.
• Security Safeguards: We implement robust technical and organizational measures designed to protect your personal information from unauthorized access, alteration, disclosure, or destruction. However, because no method of transmission over the Internet or electronic storage system is completely secure, we cannot guarantee its absolute security.

8. Your Rights and Choices

• Data Privacy Rights: Subject to applicable local data protection laws (such as Malaysia’s PDPA and other applicable privacy frameworks), you may have the right to access, rectify, delete, or port your personal information, as well as the right to withdraw consent or object to specific data processing activities.
• Self-Service Account Controls: You may review and update your account details directly within your settings or disconnect third-party platforms at any time to halt further data access.
• Submitting Data Requests: To exercise your privacy rights or submit inquiries regarding your data, please email us at [email protected]. To protect your privacy and maintain security, we may take reasonable steps to verify your identity before processing your request.

9. Minors and Policy Updates

• Children’s Privacy: The Service is strictly intended for adult use and is not directed to individuals under 18 years of age (or the applicable legal age of majority in your jurisdiction). We do not knowingly collect, solicit, or maintain personal data from minors under 18. If you become aware that a child under 18 has provided us with personal information, please notify us immediately at [email protected], and we will take prompt action to permanently delete such data from our systems.
• Updates to This Policy: We reserve the right to modify or update this Privacy Policy periodically. When changes are made, we will publish the updated version on this page and revise the “Last Updated” date at the top. For material updates, we will provide additional notice through the Service or via email prior to the changes taking effect.