This policy explains how NiMo handles personal data in three places:

• Part A — our website, nimogroups.com: accounts, learning, purchases and payment, the contact form and AI Check, job applications, and what your browser loads and stores;
• Part B — our Facebook Page, Messenger and customer care: conversations with our team, and the customer record we keep to serve you;
• Part C — our Telegram sales assistant, @NiMoBizAgent_bot: questions, orders and payment for Cambodia Biz Agent.

The common part applies to all three. Where they differ, the part that applies says so.

At a glance

• We collect what you give us and what our systems need to work: your account, your learning, your orders, and your conversations with us.
• We do not sell your data, and we do not use it for anyone's advertising lists.
• We name every company that receives your data (section 3). Your data is held outside Cambodia (section 4).
• You can see, correct, download or delete your data, and ask us to stop contacting you — write to contact@nimogroups.com (section 5).
• Some things happen automatically, including our Telegram AI assistant; you can always ask a person (section 2).

---

COMMON PART

1. Who we are

NIMO SOLUTIONS CO., LTD., under the brand NiMo Solutions — commercial registration number 1000645295, TIN K002-902603395. We decide why and how your data is used, in all three parts.

Khmer legal name	នីម៉ូ សឹលូសិន ឯ.ក
Registered address	#515, 2nd Floor, Room F2.5, Preah Monivong Boulevard, Phum 1, Sangkat Boeng Keng Kang Ti Pir, Khan Boeng Keng Kang, Phnom Penh, Cambodia
Telephone	+855 97 608 4888
Email	contact@nimogroups.com

2. Principles that apply everywhere

• We do not sell your data, and we do not give it to other companies for their own advertising.

• No customer lists for advertising. We do not give Meta or any other advertising platform lists of our customers' contact details, and conversations on Messenger or with our Telegram assistant are never used for advertising. If that ever changes, we will ask for your permission first and publish a new version of this policy.

• Some things are done automatically, and you can always ask a person.

  • Our Telegram sales assistant is an AI: it answers questions, reads the payment receipt you send, and delivers your purchase automatically when the payment matches. If it cannot match the payment, a member of staff checks it. It tells you it is an AI if you ask.
  • On the website, two rules run automatically: whether the 7-day withdrawal right applies to an order, and the 30-day window of the online refund form.
  • Refund and complaint decisions are made by our staff. If you ask for a refund decision to be reviewed, a different person reviews it.
  • In our internal customer system, an AI assistant may help staff read and summarise your record; it does not decide anything about you.
  • AI training. Anthropic does not use what we send it to train its models.

  To have a person look at anything that was decided automatically, write to contact@nimogroups.com.

3. Who receives your data

These are the companies our systems send personal data to, what each receives, and for which part.

Company	What it receives	Why	Part
Railway	Our website database (every group in Part A); our internal customer system (Part B); the Telegram assistant's working memory (Part C)	It runs our servers	A, B, C
ABA Bank (PayWay)	Your name, email, phone (if given), order number, and the name and price of each item	To take ABA Pay and KHQR payments on the website. We never receive your bank details	A
Brevo	Your email and name; what you bought and the amounts (receipts); refund-case messages, including your statement and our decision; the full text of a contact-form message, with your phone number; a password-reset link when you ask for one; and, if you apply for a job, your application (sent to our team) and a confirmation (sent to you)	To send email	A
Google	(1) That you are signing in, if you choose Google sign-in — we receive your name, email, picture and Google identifier back. (2) Your IP address and browser when you open our Contact page, which shows a Google map. (3) Conversation and customer-record text our staff translate. (4) Our sales Google Sheet and Gmail (Part C). (5) The emails our website sends to our team — contact messages, refund cases and job applications — which arrive in our company mailboxes at Google.	Sign-in, map, translation, order records and email	A, B, C
Cloudflare	Your IP address and browser when you play a lesson video; stored book content, job applicants' CV files, and our nightly website backups	Video delivery and storage	A
Cloudinary	Your IP address and browser when your browser loads our images; documents our staff attach to a customer record	Image hosting and document storage	A, B
GitHub	Our nightly website backup passes through GitHub's servers on its way to storage; it is not kept there	Making the backup	A
Sentry	Technical error reports: the address of the page or service where something went wrong, the error message, and possibly the type of browser and device. Never what you typed, your IP address or your account	Finding and fixing faults on our website	A
Meta (Facebook, Messenger, WhatsApp)	The messages between you and our Page; your WhatsApp messages if you choose WhatsApp for a reply	Messaging	A, B
Telegram	Your conversation with our Telegram assistant; your name, phone (if given) and a short excerpt of your message, posted in our team's internal group so a person can help; for the website, a short alert to our team when an order is paid, a refund case is opened, a contact message arrives or someone who finished AI Check asks us to contact them — the order or case number, amount, product names, topic, or business sector and recommendation, never your name or contact details	Messaging and alerting our team	A, B, C
Anthropic (AI)	Your messages to our Telegram assistant and the receipt photos you send it; parts of your customer record when staff use the AI assistant in our internal system	AI answers, receipt reading, helping staff	B, C
Voyage AI	Text our staff type to the AI assistant in our internal system, which may include details from your customer record	Helping the assistant find related notes	B
Authorities	What the law requires us to disclose	Legal obligation	A, B, C

If NiMo's business is sold or merged with another company, your data passes to the new owner, who must keep the promises in this policy; we will tell you before that happens.

4. Where your data is held, and transfers abroad

Your data is held outside Cambodia. The website's servers and database are in Singapore. Our internal customer system and our Telegram assistant run on our hosting provider's servers outside Cambodia. Our sales Google Sheet is held by Google.

The companies in section 3 process data in their own countries and networks — for example Brevo in the European Union, and Google, Meta, Telegram, Anthropic, Voyage AI, Cloudflare, Cloudinary, GitHub and Sentry on their international networks. ABA Bank is in Cambodia. By using our website, messaging our Page or talking to our Telegram assistant, you understand that your data is transferred to and held in these places.

5. Your rights

Wherever your data came from, you can ask us:

• to see it — a copy of the data we hold about you;
• to correct it — fix something that is wrong;
• to delete it (sections 6, A8, B6 and C6 say exactly what is deleted and what stays);
• to receive your data in a file in a common format, so you can take it elsewhere;
• to stop contacting you;
• to object to what we do on the basis of our legitimate interest — such as follow-ups and the business notes in C1 — and we stop unless the law requires otherwise;
• to withdraw your agreement where we rely on it, without affecting what was done before;
• for a person to look again at anything done automatically (section 2).

Write to contact@nimogroups.com . We confirm receipt within 1 working day and complete a deletion within 30 days. You can also complain to the authority in section 9.

If something goes wrong. If a security incident puts your personal data at risk, we tell you as soon as we can — at the latest within 72 hours of confirming it — by email or on the channel you used with us, saying what happened, what data was involved and what you can do.

6. What deletion cannot remove

Some records stay after a deletion, because the law requires them or because they record what happened to money:

• Website orders and invoices — with the buyer's name, email, phone, address and TIN. An invoice is a tax document: the law forbids us to delete it and requires us to keep it for at least 10 years from the end of the tax year of the sale.
• Payment records and refund cases linked to those orders, including what you told us and what we decided.
• Administrator action records, including the record that a deletion was carried out, which keeps the email address it was carried out for.
• Payment records of Part C orders in our accounting book (amount, date, package and order number — no name).

Each part says what else is deleted: A8 for a website account, B6 for Messenger and customer care, C6 for the Telegram assistant.

7. Children

You must be 18 or older to buy from us, and our services are meant for adults. Our systems do not ask for a date of birth and do not check age.

If you are a parent or guardian and have good reason to believe your child has an account with us or has been talking to our team, contact us and we will delete that data under section 5. If a purchase was made, the invoice remains, as section 6 explains — tax law has no exception for age.

8. Changes to this policy

A published version is never edited; any change is a new version with its own effective date, and earlier versions remain readable on this page. Withdrawing a version published in error does not delete it — the previous version comes back into force.

For significant changes we publish the new version here at least 30 days before it takes effect.

9. Language, contact and complaints

The Khmer version is the legally valid version; the English version is a translation.

contact@nimogroups.com — we reply within 1 working day and resolve within 3 working days.

You may complain at any time to the Consumer Protection, Competition and Fraud Repression Directorate-General (CCF) of the Ministry of Commerce.

Law. We follow the Cambodian laws that apply today, including the Law on Electronic Commerce and tax law. When Cambodia's personal data protection law comes into force, we will update this policy to meet it.

---

PART A — THE WEBSITE (nimogroups.com)

A1. Your account

What we keep. Name, email address, your password stored hashed (never as readable text), Google identifier (if you sign in with Google), avatar (only the picture Google provides, if you sign in with Google), your chosen language, account role, account status, and creation/modification dates. We do not store a phone number, an address or a date of birth for your account — the registration form shows optional country and phone fields, but what you type there is not saved.

Your agreement at sign-up. When you create an account we record that you accepted our terms, with your IP address and browser information.

The devices you sign in on. Each sign-in creates a record holding the device's IP address, its browser information (user-agent), whether you used a password or Google, when you signed in, roughly when the device was last used, and — once it ends — when and why it was signed out. This is what lets an account be used on at most two devices at once, and what lets you see your signed-in devices on your profile page and sign any of them out.

Wishlist and notifications. The products you add to your wishlist, and the notifications we show you (what kind of event, and which order, case or product it is about).

Password reset. If you use "Forgot password?", we keep a one-time code for the link we email you — stored only in scrambled (hashed) form — with when it expires (one hour after it is sent) and when it was used.

A2. Learning

Book annotations — including the original text of the passage you highlighted — bookmarks, lesson notes, comments, progress, quiz results and certificates.

Progress. We store where you stopped (your position in a video, your position in a book), what you completed, and when you last made progress or opened or downloaded an item. We do not record how long you spend reading or watching.

What others can see. Product reviews and lesson comments show your name and Google picture to other users. A certificate can be checked publicly by its number, and shows your name.

Notes and annotations are free text you write yourself, so they may contain anything. We do not read them for any purpose other than showing them back to you.

Your email address inside the content you read. Book content displayed on screen carries a watermark containing your email address and account number. If you share your screen or take a screenshot for someone else, your email address goes with it.

A3. Purchases and payment

With each order we keep the billing name, email address, billing address, phone number (optional) and TIN (optional — the only reason we ask is to issue a tax invoice instead of a commercial one). The invoice copies the name, email, address and TIN, because the law requires them on it. We also keep the payment record our payment provider returns. We never receive or store your bank account details.

Evidence of your consent. Each time you tick a consent box at checkout, we store your IP address and browser information, with the exact wording shown to you and the version of each document it referred to — to establish who agreed to what wording and when.

First use. We record the first time you use each item you bought (a download, an opening, a video play). This record cannot be edited or removed on its own, and it is evidence in a refund dispute — it protects you more than it protects us.

Refund requests. If you ask for a refund we keep your reason, your statement, the evidence frozen at the time, our decision and its explanation, and a log of each step.

A4. The contact form and AI Check

Your name, email address, phone number, the topic, the course or product you mention (if any), your message, the channel you would like a reply on, and the language of the page. You do not need an account to send one, and a message is not linked to your account even if you are signed in. The message is emailed to our team through Brevo, and our team is alerted on Telegram that a message arrived, with its reference number and topic only. If you choose Telegram, WhatsApp or phone for the reply, we answer you there.

AI Check. When you finish AI Check, we save your answers: your business sector and team size, the difficulties you chose, where you keep your business information, how often you use AI, your goal, anything you typed into an "other" box, and the recommendation we showed you. These answers do not include your name or contact details, and they are not linked to your account even if you are signed in. We use them to understand which businesses use AI Check and to improve it. If you choose "Discuss your setup", we also save your name, phone number, Telegram username (if you give one) and the best time to reach you, together with your answers, so that our team can call or message you about your check. Our team is alerted on Telegram that a request arrived, with your business sector and the recommendation only. If you choose "Get it on Telegram", our Telegram assistant (Part C) sends you a checklist and plan made from your answers; the website records only that it was sent, and your chat with the assistant is handled as described in Part C.

How long. We delete a contact message, and an AI Check record, 24 months after it was last updated; it may remain in our nightly backups for up to 30 more days.

A5. Job applications

If you apply for a job: your name, email address, phone number (if you give one), your CV file, portfolio and LinkedIn links (if any) and your cover letter. You do not need an account to apply, and an application is not linked to any account. Your application is emailed to our recruitment inbox, and we email you a confirmation that it arrived, both through Brevo.

A6. What your browser loads and stores

Stored in your browser. We use no advertising or analytics cookies. This is everything our site stores:

Name	Kind	What it is for	How long
token	Local storage	Keeps you signed in after a password sign-in	Until you sign out or the sign-in expires
NextAuth cookies (next-auth.session-token and two helper cookies)	Cookies	Keep you signed in after a Google sign-in, and protect that sign-in	Until you sign out or the session expires
cartToken	Local storage	Identifies the cart of a shopper who is not signed in	Deleted when you sign in and the carts merge
nimo-reader-theme, nimo-reader-layout	Local storage	Remember how you like the book reader to look	Until you clear your browser
nimo:learning-seen	Session storage	Avoids showing you the same short learning note twice	Until you close the tab
payment-qr-<order number>	Session storage	Passes the payment QR code between two checkout pages	Until you close the tab

Staff accounts also store display preferences for the admin panel (nimo-admin-theme, nimo.admin.columns.*) and an unsaved draft in the editor (nimo.mdxEditor.autoSave).

Loaded from other companies: our Contact page shows a Google map, so opening that page sends your IP address and browser to Google, which may set its own cookies. Our images are loaded from Cloudinary, which sees your IP address and browser. If a page fails, an error report may be sent to Sentry with the page address (without anything after "?"), the error and the browser type — never what you typed, your IP address or your account.

What we do not use: no analytics tools (including Google Analytics), and no tracking pixels or tags from advertising or social networks. We send no marketing email — only receipts, password-reset links, job-application confirmations and messages about your orders and refund cases — and we have switched off open-tracking in our email service.

A7. Why we collect it, and how long we keep it

Data	Purpose	Basis	Kept for
Account, sign-up agreement, devices, password resets, wishlist, notifications (A1)	To let you sign in, enforce the two-device limit, show what you saved	Performance of the contract	As long as your account exists
Learning (A2)	To make the learning features work	Performance of the contract	As long as your account exists
Watermark (A2)	To deter redistribution of paid content	Legitimate interest	Not stored separately
Orders, invoices, payment records (A3)	Payment and invoicing as the law requires	Contract + legal obligation	At least 10 years from the end of the tax year of the sale
Refund requests (A3)	To handle your request and keep a record of it	Contract + legal obligation	With the order they belong to
Consent evidence, first-use records (A3)	To show what you agreed to and settle disputes	Legitimate interest	As long as your account exists
Contact messages (A4)	To answer your question	Your request	24 months after the last update, or sooner if you ask
AI Check answers (A4)	To understand who uses AI Check and improve it	Legitimate interest	24 months after the last update, or sooner if you ask
AI Check contact request (A4)	To call or message you about your check	Your request	24 months after the last update, or sooner if you ask
Job applications and CVs (A5)	To consider your application	Your request	Until we permanently delete the job posting
Browser storage (A6)	To keep you signed in and remember your cart	Necessary for the service	As in the table in A6

Backups. We back up the whole website database every night at 02:30 Phnom Penh time and keep the 30 most recent backups — normally about one month. They are made by a separate system and held on a separate storage service, and we have restored one in a test, successfully. After your account is deleted, your data can remain in those backups until they are replaced.

A8. Your rights on the website

Much of it you can do yourself:

Content	Edit	Delete
Lesson notes	Yes	Yes
Bookmarks	—	Yes
Book annotations (including the highlighted text)	Yes	Yes
Product reviews	Yes	Yes
Lesson comments	No	Yes
Wishlist	—	Yes
Signed-in devices	—	Sign out (the device record stays until your account is deleted)
Progress and quiz results	No	No
Name and language	Yes	—

A review hidden by moderation is not deleted — your words remain, and you can still delete it yourself.

Deleting your account. Write to contact@nimogroups.com from the account's own email address. Before we act, we tell you two things plainly: closing an account carries no refund, and the access you bought ends permanently.

What is deleted: profile (name, avatar, Google identifier), sign-up agreement record, notes, annotations, bookmarks, progress, quiz results, comments, reviews, wishlist, notifications, cart, device records, password-reset records, access rights, first-use records and the consent evidence from your purchases.

What stays: everything in section 6, and contact-form messages, AI Check records and job applications, because they were never linked to the account — ask for those separately and we delete them too.

One thing to know before you ask — it does not work in your favour, but it is true. Deleting your account also deletes the evidence: the record of whether you used a product, and the confirmations you ticked when you bought. After deletion, a new refund request has no data left to settle it against — not for us, and not for you either. If a refund is on your mind, do that first.

A9. How we protect it

We list specific measures rather than making a general claim:

• passwords are stored hashed with bcrypt, never as readable text;
• an account can be signed in on at most two devices at once; a third sign-in signs out the device that has gone longest without being used, and you can see and sign out your devices yourself;
• signing out really ends the session on our server, rather than only forgetting it in your browser;
• our system supports two-factor authentication for staff accounts; turning it on or off ends every existing session;
• no public file link is ever handed to your browser — every byte of paid content passes an access check again, and video plays through a short-lived token;
• blocking an account takes effect immediately on every request;
• a password-reset link works once and expires after one hour, and using it signs out every device;
• administrator actions on accounts, access, orders and refunds are logged.

No system is completely secure, and we do not claim otherwise.

---

PART B — FACEBOOK PAGE, MESSENGER AND CUSTOMER CARE

B1. What we collect

When you message our Facebook Page we receive and keep:

• your Messenger identifier — a code Facebook gives you for our Page only (a "Page-scoped ID"), so we recognise you when you write again;
• your public Facebook name, as Facebook provides it to our Page;
• the conversation — the text you send us and our replies, with the date and time of each;
• the type of any attachment you send (for example "image" or "file"). We do not download or keep the attachment itself — it stays on Messenger;
• which of our Facebook ads you came from, if you started from one (the ad's identifier);
• anything you choose to tell us in the conversation — for example your phone number, email, company or business needs.

Please do not send identity-card numbers, bank card details or passwords through Messenger.

When you visit or interact with our Facebook Page, Meta also collects information under its own privacy policy, and gives us only overall statistics about our Page (Page Insights), which do not identify you.

Your customer record. When you first message us — or when you contact us through our sales page or our Telegram assistant — we create a customer record in our internal customer system so the right member of our team can follow up. It can hold: your name, phone, email, Telegram and Facebook contact, company and industry; what you are interested in and the package and price we proposed; your biggest challenge, the result you want and your concerns, as you described them; our internal notes and our estimate of how likely you are to buy; payment status; when we plan to contact you next; your preferred channel and time; and every time we contacted you, by which channel, and whether you replied. Documents we prepare for you, such as quotations, can be attached to it.

B2. Why we collect it

Data	Purpose	Basis
Facebook Page messages	To answer you, follow up on your request, and prepare quotations if you decide to buy	Your request
Customer record and contact history	To follow up with you and look after you as a customer	Legitimate interest

How we follow up. We contact you at most 3 times in 7 days unless you ask us to call back at a different time; after 3 contacts without a reply we pause. Tell us to stop and we will stop contacting you.

B3. Who receives it, and where it is held

See section 3 (rows marked B) and section 4. In short: Meta delivers the messages; our internal system runs on Railway outside Cambodia; Telegram carries short alerts to our team; Google translates text for staff who read another language; Anthropic and Voyage AI power the assistant our staff use; Cloudinary holds attached documents.

B4. Copies inside our systems

So that you know exactly where your conversation goes inside NiMo:

• an alert with your name and a short excerpt of your message is posted in our team's internal Telegram group;
• a raw copy of each incoming message is kept briefly so it can be processed again if something fails;
• when staff translate your messages or record, the translation is stored so it need not be repeated;
• the AI assistant our staff use keeps its conversation history and notes, which may mention you;
• before maintenance, staff may take a copy of the database onto a company computer.

B5. How long we keep it

• Facebook Page conversations — 12 months after the last message in the conversation (yours or ours), then deleted automatically.
• Raw copies of incoming messages — normally deleted after 30 days; one that failed to process is kept up to 90 days, or until the fault is fixed.
• Your customer record and contact history — until you ask us to delete them.
• Translations, assistant notes, team-group alerts and maintenance copies — until they are deleted, and in any case when you ask us to delete your data (B6).

B6. Deleting your Messenger and customer-care data

You can ask in either way:

1. On Messenger: send "Delete my data" or «សូមលុបទិន្នន័យរបស់ខ្ញុំ» to our Facebook Page. Because the request comes from the same Messenger account, we can find your conversation without asking you for anything else.
2. By email: write to contact@nimogroups.com with the subject "Delete my data", including the name you use on Facebook and any phone number or email you shared with us.

Within 30 days we delete: the conversation and its messages; your customer record and contact history; the stored translations of them; the alerts about you in our team's Telegram group; what our AI assistant noted about you; your row in our sales Google Sheet (so it is not copied back); and any maintenance copy that contains them.

We reply on Messenger to say we have received your request. Messenger only lets a business reply within 24 hours of your last message, so we confirm that the deletion is complete by email if you gave us one, or on Messenger if you write to us again.

What stays: anything listed in section 6, if you bought from us. Deleting your data from our systems does not delete the conversation from your own Messenger app — you can delete it there yourself.

---

PART C — TELEGRAM SALES ASSISTANT (@NiMoBizAgent_bot)

C1. What we collect

• When you start the assistant: your Telegram name, username and chat identifier. We record these in our sales sheet as soon as you start, before you write anything.
• Your conversation with the assistant, and your chosen language.
• When you order: your name, phone number, email address and the package you choose.
• Your payment receipt: the photo of the bank transfer you send. We read from it the reference number, amount, date and time, and the names of the sender and the recipient. We also match it against our bank's payment notification, which shows the payer's name.
• What you tell us about your business: the assistant notes, from your own words, what you sell, your main problem and how ready you are to buy. It does not guess — anything you did not say is left empty.
• Feedback — if you tell the assistant it answered wrongly, we keep the question and the answer.

C2. Why we collect it

Data	Purpose	Basis
Telegram identity and conversation	To answer your questions	Your request
Order details	To sell and deliver your order, and email you its confirmation	Performance of the contract
Payment receipt and payer name	To confirm that your payment arrived and is yours	Performance of the contract
Business notes	To give advice that fits your business, and to follow up	Legitimate interest
Sales-sheet row from the first message	To follow up with people who showed interest	Legitimate interest

C3. How the assistant works

The assistant is an AI, and says so if you ask. To answer you it sends your messages to Anthropic; to check your payment it sends the receipt photo to Anthropic. When the payment matches, it delivers your purchase automatically and emails a confirmation from our company Gmail. If it cannot match your payment, a member of staff checks it. Whenever you ask to talk to a person, your name, phone (if you gave it) and a short excerpt of your message are posted in our team's internal Telegram group, and a person replies through the assistant.

C4. Who receives it, and where it is held

See section 3 (rows marked C) and section 4: Telegram, Anthropic, Google (our sales sheet and Gmail) and Railway (the assistant's working memory).

C5. How long we keep it

• Your row in our sales sheet — until you ask us to delete it.
• The assistant's working memory (your latest messages, order and receipt details) — until you ask us to delete it.
• Payment records in our accounting book (amount, date, package, order number — no name) — at least 10 years.

C6. Deleting your Telegram assistant data

Write to contact@nimogroups.com , or ask the assistant to talk to a person and tell them you want your data deleted. Within 30 days we delete your row in our sales sheet, the assistant's memory of you, our team-group messages about you, and your customer record if one was created (B6). What stays is listed in section 6. Deleting does not remove the chat from your own Telegram app — you can delete it there yourself.