Who we are
NepalConnect operates nepalconnect.tech and the NepalConnect customer support platform. Questions about this policy go to support@nepalconnect.tech.
When an internet service provider runs NepalConnect for its own subscribers, that ISP decides what subscriber data is collected and why, and NepalConnect processes it on the ISP's behalf. If you are a subscriber of such an ISP, contact your ISP first. This policy covers nepalconnect.tech.
What we collect
- When you email us: your email address and what you write.
- When you use the support assistant: your chat messages, and for voice calls the call audio and transcript. The assistant keeps short summaries of past conversations so it can pick up where you left off.
- In a customer account: name, email, phone, city, area and address, plan, invoices and payments, data usage, support tickets, and identity documents uploaded for KYC.
- Technical data: your IP address and browser details with sign-in sessions and password-reset requests, a random device identifier stored in your browser for rate limiting, and server logs.
The guest account is shared. Anything entered while signed in as a guest can be seen by anyone else using it, so don't enter personal details there.
How we use it
To run the service: answer your questions, act on your account when you ask, process payments, send the emails the service needs (such as password resets and receipts), and keep the platform secure through rate limits and audit logs. The only optional email is an announcement when a new plan launches, and every one has an unsubscribe link. We don't sell personal data, show advertising, or use third-party analytics or ad trackers.
Cookies and browser storage
We don't set cookies. Your browser's local storage holds your sign-in tokens (removed when you sign out), your language, the device identifier, and assistant tip preferences.
Who processes data for us
- Hosting and database: FastAPI Cloud and Supabase.
- Cache, job queue, search, and memory: Upstash.
- AI models: Kilo Gateway, Groq, and Google Gemini receive chat messages. Email addresses, phone numbers, ID and card numbers, and similar identifiers are removed first; names and places are not.
- Voice: Vapi and the services it uses (Daily, Deepgram, OpenAI, Cartesia) receive call audio and transcripts, and your name and plan when you are signed in. Vapi keeps call recordings under its own retention.
- Email: AgentMail and Resend.
- Payments: eSewa and Khalti, and FonePay or ConnectIPS where enabled, receive the payment details they need; Khalti also receives your name, email, and phone.
- Loaded by your browser: fonts from Google Fonts, scripts from jsDelivr, unpkg, and esm.sh, and map tiles from OpenStreetMap. These see your IP address.
How long we keep it
- Recent chat context expires one hour after your last message.
- The assistant's conversation summaries are deleted after 90 days.
- An identity document replaced by a newer upload is deleted 30 days after it was uploaded. Your current documents are kept while the account exists.
- Voice transcripts, tickets, and other account records are kept while the account exists.
- When an account is deleted, its profile, chats, call transcripts, identity documents, notifications, and message history are deleted, and tickets and service orders are blanked. Invoices, payments, and wallet records are kept because the law requires it.
- Emails to us are kept as long as needed to deal with them.
Your choices
- In your dashboard profile: download everything we hold about you, delete your account (once your service is cancelled and your bills are paid), update your details, turn plan announcements on or off, and choose how notifications reach you. You can clear your chat history from the support chat.
- By email: for anything else, or if you can't sign in, email support@nepalconnect.tech with "Privacy request" in the subject. We reply within 30 days.
- Unsubscribing: every plan announcement has an unsubscribe link. Emails about your account, such as invoices and receipts, are still sent.
Security
Passwords and sign-in tokens are stored only as hashes, traffic is encrypted with HTTPS, and only operators can open identity documents, with every view recorded. No system is perfectly secure; if you find a problem, see the contact page.
Changes
When this policy changes, the effective date above changes with it.