ZAKI / Compliance
Current controls, without certification theatre.
Effective and last updated July 12, 2026. Policy version 2026-07-12.v4. This page describes current controls and is not a certification.
Operating structure
Nova Nuggets L.L.C is headquartered in Dubai, UAE. The ZAKI hub controls identity, billing, settings, consent, and metering. Core hosting and managed PostgreSQL are on DigitalOcean in the European Union.
Consent records
Password signup records the accepted policy version, timestamp, IP address, user agent, and a consent event. Google signup carries explicit acceptance through signed OAuth state and records the same event. Accounts on an older policy version must re-consent before continuing.
Data boundaries
Agent is the only writer of the personal Brain. Spaces uses a separate workspace store. Requests are user-scoped through the authenticated hub, and connected-account tools are limited to approved scopes and the action requested.
Security controls
Current controls include encryption in transit, least-privilege service identities, role-based internal access, secret isolation, immutable deployment tags, request and audit identifiers, monitoring, and explicit approval boundaries for sensitive Agent actions. No online system can guarantee absolute security.
Privacy operations
Users can request access, correction, export, deletion, restriction, portability, or objection where applicable. Account deletion fans out across the hub and Agent data boundary; limited billing, security, consent, fraud-prevention, and audit records may remain where law or security requires.
Contact and DPA
For compliance, privacy, security incidents, or a DPA request, email support@chatzaki.com with the account email, timestamp, and issue summary.