Legal
Privacy Policy
Version 2.0 · Effective 12 November 2026 · Replaces version 1.0 of 20 March 2026
GuideBuoy AI SG Pte Ltd ("GuideBuoy", "we"), UEN 202545875C, of 51 Goldhill Plaza #07-10/11, Singapore 308900, is the organisation responsible for your personal data under Singapore's Personal Data Protection Act 2012 (PDPA). This policy explains what we collect, why, who we share it with, how long we keep it, and your rights. Our Data Protection Officer can be reached at info@guidebuoyai.sg.
1. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, sign-in method, account settings | You, via Clerk sign-in |
| Your case | Your story, your answers to our questions, the facts you confirm and your notes on them | You |
| Documents you upload | Bank statements and letters, screenshots, police reports, emails | You. These often contain financial details and may contain identity numbers and other people's names |
| Outputs | The evaluation and packs we generate, and the record of which facts they used | Generated by us from your case |
| Payments | Purchase, amount, date and Stripe's reference. Card numbers are entered on Stripe's page and never reach us | Stripe |
| Interest and bookings | Your request to be told when a pack is available; consultation bookings | You |
| Technical data | Device and browser type, IP address, pages visited, error logs, security events | Automatically |
Scam and fraud cases involve financial information. We treat all case data as sensitive. Please block out identity numbers (NRIC, FIN, passport) in documents unless your case needs them, and share other people's details only where necessary.
2. Why we use it
We collect and use personal data for these purposes, with your consent given when you create an account and use the service, or where the PDPA otherwise permits:
- to create and secure your account and sign you in;
- to save your case, check your facts for consistency and generate the evaluation and packs you ask for;
- to take payment and grant access to what you bought;
- to send service messages: confirmations, receipts, availability notices you asked for, security alerts;
- to answer your questions and handle complaints, access and deletion requests;
- to keep the service secure, detect misuse and fix faults;
- to improve the service, using aggregated or de-identified information where we can;
- to meet legal obligations, including record-keeping and responding to lawful requests.
We do not sell personal data. We do not use your case data to train artificial-intelligence models, and our AI providers are contractually barred from doing so. We send marketing only if you opt in, and you can opt out at any time.
3. Who we share it with
We share personal data only with providers that process it for us under contract, and only as needed to run the service:
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Clerk | Sign-in and account security | United States |
| Supabase | Database and file storage for cases and documents | Singapore |
| Render | Hosting of the website and background processing | Singapore |
| Stripe | Payment processing | United States and other countries |
| Google Workspace | Email we send you | Global |
| OpenAI and Google (Gemini) | AI models that read your story, answers and documents to extract facts and draft outputs | United States and other countries |
| Cloudflare | Website security and performance | Global |
We may also disclose personal data where the law requires it, to protect the rights or safety of users or others, or to a buyer if GuideBuoy's business is sold, in which case this policy continues to apply.
We never share your case with any bank, FIDReC, the police or any other body. You decide what to download and send, and to whom.
4. Transfers outside Singapore
Some providers above process data outside Singapore. Where that happens, we transfer data only under written contracts that require the recipient to protect it to a standard comparable to the PDPA, as the PDPA's transfer limitation obligation requires. The AI providers we use process your data only to provide the service to us and do not keep it to train their models.
5. How we protect it
Access to case data is restricted by account: our database applies row-level rules so that each user can see only their own cases. Data is encrypted in transit and at rest by our providers. Staff access is limited to what support and security require, and is logged. Payment card details never reach our systems. No system is perfectly secure; if we discover a breach that is likely to cause significant harm, we will notify the Personal Data Protection Commission and affected users as the PDPA requires.
6. How long we keep it
| Record | Kept for | Why |
|---|---|---|
| Your account and open cases | While your account is active | To provide the service (PDPA retention limitation obligation: kept only while needed) |
| Case data after you close your account or delete a case | 30 days, then deleted, unless we must keep it for a legal or security reason | Allows recovery of accidental deletion |
| Purchase and payment records | 5 years from the end of the financial year | Companies Act 1967 and Income Tax Act record-keeping requirements |
| Security and technical logs | 12 months | Investigating security incidents and misuse |
| Availability and marketing requests | Until you withdraw or we have sent the notice you asked for | PDPA consent obligation |
When data is no longer needed for the purpose it was collected for, or for a legal requirement, we delete or anonymise it.
7. Your rights
Under the PDPA you may ask us to:
- access the personal data we hold about you and how we have used it in the past year;
- correct an error or omission;
- export your case (you can also download your outputs at any time from your case page);
- delete your account or a case;
- withdraw consent to a use of your data. We will explain the consequences, which may include closing your account.
Email info@guidebuoyai.sg. We will check your identity, respond within 30 days, and tell you if we need longer. We may charge a reasonable fee for access requests, and will tell you the amount first. Deletion is currently handled manually: we confirm the request by email, then delete the data within the periods in section 6, except where the law requires us to keep it (for example purchase records).
8. Cookies and analytics
We use strictly necessary cookies for sign-in and security, and browser storage that keeps an unfinished story while the browser tab is open, so reloading the page or signing in doesn't lose it; it is deleted when you close the tab. We record how the service is used (for example which steps are completed) in our own systems, to improve it; this first-party usage data is not shared with advertisers. We don't use advertising or third-party tracking cookies.
9. Children
The service is for adults. We don't knowingly collect data from anyone under 18. If you think a child has given us data, email us and we will delete it.
10. Changes to this policy
We will publish any new version here with its effective date and tell account holders by email about material changes.
11. Contact
Data Protection Officer, GuideBuoy AI SG Pte Ltd (UEN 202545875C), 51 Goldhill Plaza #07-10/11, Singapore 308900. Email: info@guidebuoyai.sg. Telephone: +65 6690 9262 (main) · +65 9072 7915 (direct). If you are not satisfied with our response, you may complain to the Personal Data Protection Commission (pdpc.gov.sg).