Privacy Policy

1. Introduction

AIBYML SG Pte Ltd (UEN: 202506386R) ("AIBYML", "Company", "we", "us", or "our") is committed to protecting the privacy of individuals and organisations that visit this website or use our services.

This privacy policy explains how we handle personal data and confidential information in connection with your use of this website (www.aibyml.sg) and the services and technology products we provide from time to time. It sets out our obligations under the Personal Data Protection Act 2012 (PDPA) of Singapore (No. 26 of 2012) and its subsidiary legislation.

It applies to personal data collected directly from you when you contact us, engage our services, or use any product, platform, application programming interface (API), or AI agent infrastructure that we make available.

2. Scope of This Policy

This policy covers two broad categories of activity:

• Website activity. Information you provide when browsing this site or submitting an enquiry, request, or contact form.
• Service and product activity. Personal data and confidential information that we, or you, process through our AI consulting engagements, AI agent infrastructure, and any technology products or platforms we develop and make available, whether now or in the future.

Where we act as a data intermediary processing personal data on behalf of a client under a separate services agreement, that agreement — together with this policy — governs how such data is handled.

3. Personal Data We May Collect

We collect personal data that you voluntarily provide, and data reasonably necessary to deliver our services. This may include:

• Name, email address, and contact number
• Company or organisation name and role
• Account or login credentials, where you register for a product or platform
• Billing and transaction details, where you procure paid services
• Correspondence, enquiry content, and support requests
• Data you submit to, or generate through, our services, products, or AI agents in the course of an engagement
• Technical data strictly necessary to operate a product you use (e.g. logs required for security, reliability, and troubleshooting)

We do not knowingly collect sensitive personal data (e.g. health data or national identification numbers) unless it is expressly required for a specific engagement and provided with appropriate consent and safeguards.

4. Confidential and Client Information

Processing confidential and client information is a core part of how our services and products work. In the course of providing AI consulting, agent infrastructure, and technology products, we process confidential information — including business data, documents, datasets, prompts, and other content — that you or your organisation submit to, or generate through, our services ("Client Data").

By engaging our services or using our products, you acknowledge that Client Data — which may include personal data relating to you, your personnel, or your own customers — will be processed by us and our sub-processors to deliver those services. Where the Client Data you provide contains personal data of third parties, you are responsible for ensuring you have the necessary consent or lawful basis to share it with us for that purpose.

• Client Data is processed only to provide, operate, maintain, secure, and support the services you have engaged us for, in accordance with your instructions and any applicable services agreement.
• We treat Client Data as confidential and apply access controls so that only authorised personnel and sub-processors may access it on a need-to-know basis.
• We do not use Client Data for any purpose unrelated to delivering the relevant service, and we do not sell or share it for advertising, without your consent.
• Where we act as a data intermediary processing Client Data on your behalf, the applicable services agreement governs the specific processing terms, and this policy applies to the extent not inconsistent with that agreement.

5. Use of Artificial Intelligence and Technology Products

Our services and products use artificial intelligence, machine learning models, and third-party AI infrastructure to process data and generate outputs. Where this applies:

• No training on your data. We do not use your Client Data or personal data to train, fine-tune, or otherwise develop our own AI models or those of any third party. Your data is used only to generate the outputs and deliver the services you have engaged us for, and is not repurposed to improve models for us or for any other party.
• Third-party AI providers. Some features rely on third-party model or cloud providers acting as our sub-processors. These providers are engaged under contractual terms requiring them to process data only on our instructions, to refrain from using it to train their own models, and to apply appropriate protection measures.
• Outputs. AI-generated outputs may be inaccurate or incomplete. You remain responsible for reviewing outputs before relying on them, and we process the underlying data only as needed to generate those outputs.

6. Purposes for Which We Use Your Data

We collect and use personal data and Client Data only for the purposes for which it was provided, which may include:

• Responding to your enquiry or request for information
• Providing, operating, securing, and improving our services and products
• Communicating with you about engagements, updates, and support
• Managing accounts, billing, and contractual obligations
• Complying with applicable legal or regulatory obligations
• Record-keeping for legitimate business purposes

7. Legal Basis and Consent

We collect and process personal data only after obtaining your consent — either expressly (e.g. when you submit a form or enter into an agreement) or by way of deemed consent where the purpose is reasonably apparent from the context of the collection — or on another lawful basis permitted under the PDPA.

You may withdraw your consent at any time by contacting us using the details in Section 12. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Where consent is withdrawn, we will cease processing your data for the relevant purpose unless we are required or entitled to retain it under applicable law or an existing agreement.

8. Disclosure and Sub-Processors

We do not sell, rent, or licence your personal data to data brokers or advertising platforms. We disclose personal data only to:

• Service providers and sub-processors. Third parties engaged to provide services on our behalf (e.g. cloud hosting, AI model providers, email hosting, IT support), who are contractually bound to process data only on our instructions and in line with applicable data protection laws.
• Legal and regulatory authorities. Where required by law, court order, or a competent regulatory authority in Singapore or another applicable jurisdiction.
• Professional advisers such as lawyers, auditors, and insurers in connection with their advisory services.
• A successor entity in the event of a merger, acquisition, or reorganisation, subject to this policy continuing to apply to your data.

9. International Transfers

Some of our service providers and AI infrastructure may store or process data outside Singapore. Where we transfer personal data overseas, we take reasonable steps to ensure the recipient provides a standard of protection comparable to the PDPA, including through contractual safeguards, consistent with the PDPA's obligations on overseas transfers.

10. Retention of Personal Data

We retain personal data and Client Data only for as long as necessary to fulfil the purpose for which it was collected, to provide the relevant service, or as required by law or contract. Once no longer needed, we make reasonable efforts to securely destroy or anonymise it. Specific retention periods for a given service may be set out in the applicable service agreement.

11. Protection of Personal Data

We implement appropriate administrative, physical, and technical security measures — including access controls, encryption where appropriate, and sub-processor obligations — to protect data in our possession or under our control from unauthorised access, use, disclosure, copying, modification, or disposal. While we take reasonable precautions, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

12. Your Rights Under the PDPA

Under the Personal Data Protection Act 2012 (Singapore), you have the following rights in respect of personal data we hold about you:

• Right of access. Request a copy of personal data we hold about you, and information on how it has been used or disclosed within a year before the request.
• Right of correction. Request that we correct an error or omission in your personal data as soon as practicable.
• Right of withdrawal. Withdraw consent to the collection, use, or disclosure of your personal data at any time, subject to legal or contractual restrictions.
• Right to data portability. Request your personal data in a commonly used machine-readable format where technically feasible (where applicable under Part VIA of the PDPA).

To exercise any of these rights, please contact our Data Protection Officer using the details below. We will respond within 30 calendar days or such other period as may be prescribed by the PDPA.

13. Data Protection Officer

In accordance with section 11 of the PDPA, we have appointed a Data Protection Officer (DPO) responsible for ensuring our compliance with the PDPA.

14. Third-Party Links

This website and our products may contain links to third-party websites or services. We have no control over the content or privacy practices of those sites and are not responsible for their policies. We encourage you to review the privacy policy of any third-party site or service you use.

15. Changes to This Policy

We may revise this privacy policy from time to time to reflect changes in law, our practices, or the nature of our website, services, and products. Updates will be posted on this page with a revised effective date. We encourage you to review this page periodically. Continued use of this website, services, or products after any change constitutes acceptance of the revised policy.

16. Governing Law and Jurisdiction

This privacy policy is governed by the laws of Singapore. Any disputes arising in connection with this policy shall be subject to the non-exclusive jurisdiction of the courts of Singapore.

17. Contact Us

If you have any questions, concerns, or feedback about this privacy policy or how we handle your data, please contact our Data Protection Officer at the details set out in Section 13 above. You may also lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.