Privacy & Data Protection
Where your data goes, who sees it, and how it stays in-region when that matters to you.Compliance language on this page describes our controls and commitments as a vendor. It is not legal advice, and statutory obligations that sit with you as data controller remain yours — we help you meet them.
Who is responsible for your data
Nano AI is a trading name of Nano System for Artificial Intelligence LLC, registered office 53 Capital Mall, 2nd Floor, Behind the Court, Fifth Settlement, New Cairo 11835, Egypt. The company is the controller of personal data collected through this website (contact and demo forms, WhatsApp enquiries) and the processor of data its clients entrust to it. Privacy requests: hello@nano-ai.net.
Regulatory scope
We operate against four regimes: the Saudi Personal Data Protection Law (PDPL), the UAE PDPL, the EU General Data Protection Regulation (GDPR, for EU-lane work), and Egypt's Personal Data Protection Law No. 151/2020. For each, we implement consent flows, purpose limitation, support for data-subject requests, and breach-notification support — while obligations that remain with you as the data controller stay yours.
Our role, and data retention
Nano AI acts as a processor for client-owned data. A Data Processing Agreement template is available on request as part of our procurement pack. We support client controllers in fulfilling access and deletion requests within their statutory windows.
Retention defaults are set per service — conversation logs, call audio, and documents each have a default retention period, with per-client overrides available in the statement of work.
Cross-border transfer & regional hosting
For clients requiring in-region data residency, we deploy on GCC cloud regions — including UAE, Saudi Arabia, and Bahrain regions of the major cloud providers — and configure model access through endpoints consistent with the client's residency requirements. Where a required capability has no in-region option, we say so in the Assess-stage risk register before you sign, not after.
Frequently asked questions
We implement processor-level controls consistent with the Saudi PDPL and UAE PDPL — consent flows, purpose limitation, data-subject request support, and breach-notification support — and offer in-region hosting where required. The statutory obligations that sit with you as data controller remain yours; this page is not legal advice.
In most cases, yes — we deploy on in-region cloud provider zones for clients that require it. We confirm exact regional availability per service during the Assess stage and disclose any gap in the risk register before you sign.
Chat on WhatsApp