Privacy notice.

This notice describes how Malai handles the small amount of information visitors can send us, and the anonymous usage measurement we run. It covers both the marketing site on this domain and the demo webapp at app.malaibank.com. The demo webapp runs entirely on synthetic data and never receives information about real people.

If you send us a message through the contact link, we receive your name, your email address, and the message text. We do not ask for, and do not retain, any financial information, identity documents, or banking credentials.

Separately, both the marketing site and the demo webapp count page views using Plausible Analytics. That measurement is anonymous and aggregate: it tells us which pages get read and which demo surfaces get explored, and nothing about who read them. We run no advertising scripts and no session-replay tools.

The demo webapp shown elsewhere on this project is a reference customer journey populated with generated data. Every account holder, balance, transaction, and audit event you see inside it is synthetic. No real banking data is, has been, or will be loaded into it. Opening an account inside the webapp creates a synthetic profile only — it never becomes a real customer record anywhere.

Contact submissions are used only to reply to your message and to keep a short audit trail of the exchange. We do not sell, rent, share with marketers, or otherwise disclose the information you send. It is read by the project maintainer and is not exposed to third parties beyond the email-delivery provider routing the reply.

Contact submissions are retained for up to twelve months from the date of the last exchange in the conversation, then deleted. You can ask for earlier deletion at any time using the contact link.

You can ask us to confirm what information we hold about you, request a copy, correct anything inaccurate, or ask for it to be deleted. Send the request through the contact link; we will respond within thirty days. If you believe we have mishandled your information, you can also raise a complaint with the UK Information Commissioner's Office.

Neither the marketing site nor the demo webapp sets a tracking cookie. Plausible, our analytics provider, is cookieless by design: it records the page address, the site that referred you, and coarse browser and country information worked out from your request, without storing an identifier that follows you between visits or across to other websites. Because nothing is stored on your device and no profile is built, there is no cookie banner to dismiss.

Inside the demo webapp a recorded page address can include a synthetic account or case reference. Those refer to generated records, so they identify nobody.

The demo webapp does use a session cookie, strictly for keeping a synthetic visitor signed in to their synthetic account — it carries no personal data and is not used for advertising.

This notice may change as the project evolves. The date below shows the last revision. Material changes will be flagged on the site rather than applied silently.