Legal

Privacy Notice

Version 1.0 · Effective 5 October 2026

This Privacy Notice explains what personal information HimalayaAI Studio (studio.himalayaai.org) collects, why, where it goes and how long we keep it. The controller is Himalaya A.I. Labs. We handle personal information in line with the Individual Privacy Act, 2075 (2018) of Nepal and the other laws that apply to us. You can reach us about privacy at info@himalayaai.org.

Accepting the Terms of Service includes your consent to the processing this Notice describes, including by the providers outside Nepal named in section 7. You can withdraw that consent as section 10 explains.

You sign in with Google. We ask Google for your basic profile and email address (the openid, email and profile scopes), and we keep:

your Google account identifier, a number Google assigns that lets us recognise you on your next sign-in;
your email address, which must be verified by Google;
your display name as given by Google;
when you first signed in and when you last signed in.

Google also sends your profile photo; we do not store it. We do not receive your Google password, and we do not keep any Google access or refresh token: once you are signed in, we do not contact Google on your behalf again.

2. Your session

Signing in creates a session. Your browser holds a random session token in a cookie that scripts on the page cannot read; we store only a one-way hash of that token, with the time the session was created, when it expires (seven days later) and whether you signed out, plus your browser's user-agent string. Signing out ends the session immediately.

When you accept or decline the Studio's documents we record your account, which documents and which versions you were shown, a fingerprint of their exact text, the acknowledgements you made, the time, your session, and your browser's user-agent string. We keep this record to show that you agreed, and to know when to ask you to accept an updated version.

4. What you submit

What happens to your submissions depends on where you make them:

Playground (LLM, Voice, Vision). Your prompts, audio, images and the results are sent to our inference provider to produce a response. The Studio itself does not store them.
Himmy Agent. Your messages are sent to the Himmy agent service we operate, which uses our inference provider and may keep run records in its own store.
Voice Agent. Your microphone audio is carried in real time through a media server we operate to the voice agent, which sends it to our inference provider for speech recognition and speaks the reply. The Studio does not configure call recording.
Document Agent. The document or image you upload, and the text and fields read from it, are stored in our database and file storage. The Studio does not currently show you past runs.
Himkosh. Your Contributions — recordings, transcriptions, translations, annotations, handwritten pages and reviews — are stored in our database and file storage, together with task metadata such as language, capture mode, duration and the time submitted. They are not currently stored against your account. As the Terms of Service explain, Contributions may be published in open datasets.

Please do not submit other people's personal information, or sensitive information about yourself, unless a task requires it. Identity documents, cheques and voice recordings contain personal information, so upload them only when you are entitled to.

5. What we store in your browser

Besides the session cookie, the Studio stores your theme and sidebar preferences in your browser. We do not use advertising or analytics trackers.

6. Why we use your information

To let you sign in and keep your session secure (necessary to provide the service you asked for).
To provide the Studio's models, agents and Himkosh to you (necessary to provide the service).
To record your acceptance of the Terms and your consent under this Notice (our legal and contractual interest in evidencing the agreement).
To build and publish Nepali training datasets and train and evaluate models, from Himkosh Contributions only (your consent and the licence in the Terms).
To protect the Studio, investigate misuse, and meet legal obligations.

We do not sell personal information, and we do not use Playground or Agent submissions to train models.

7. Who processes it

Google authenticates you when you sign in.
Tarka runs model inference for us; your prompts, audio, images and documents are sent to it to produce Outputs. Tarka's servers are in Germany.
Amazon Web Services hosts the Studio and its file storage in the Mumbai (ap-south-1) region, India.
Dataset hosts such as Hugging Face receive Himkosh Contributions when we publish a dataset, and make them publicly available.

We may also disclose information when the law requires it, to protect people's safety or our rights, or to an organisation that takes over the Studio, which would remain bound by this Notice.

8. Transfers outside Nepal

Because of the providers above, your information is processed in India, Germany and the other countries where Google operates. We use these providers because they are what the Studio runs on today.

9. How long we keep it

Account information is kept while your account exists.
Sessions expire after seven days; the session records are kept with your consent record.
Consent records are kept for as long as your account exists and for a reasonable period afterwards in which we may need to show what you agreed to.
Document Agent uploads and results are kept until deleted; there is not yet an automatic deletion period.
Himkosh Contributions are kept for as long as they are useful for building datasets and models, and published copies remain available under their licence.

10. Your rights

Subject to the law, you may ask us to tell you what personal information we hold about you, to correct it, to delete it, or to withdraw your consent. Write to info@himalayaai.org from the email address you sign in with. The Studio does not yet offer self-service account deletion, so we handle these requests by hand. Withdrawing consent does not affect processing that happened before, and Contributions already published in an open dataset cannot be recalled. If you are not satisfied with our response, you may complain to the competent authority under the law of Nepal.

11. Security

We use encrypted connections (HTTPS), keep the inference and storage credentials on our servers and never in your browser, require a signed-in, consenting account for every part of the Studio except this Notice and the sign-in pages, and store session tokens only as hashes. No system is completely secure; tell us at info@himalayaai.org if you suspect a problem.

12. Age

The Studio is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18; if you believe a child has used the Studio, please contact us and we will delete their account.

13. Changes

When we change this Notice materially we will publish a new version with a new effective date and ask you to review it before you continue using the Studio.