Privacy Policy

1. Introduction

Welcome to Kolektiq. This Privacy Policy explains how KOLEKTIQ PTE. LTD. (UEN 202625566D), a company incorporated in Singapore and the provider of the Kolektiq platform ("Kolektiq", "we", "us", "our"), collects, uses, discloses, and protects your personal information when you use our platform, website, and services (collectively, the "Services").

We are committed to protecting your privacy and ensuring the security of your personal data. This policy is designed to comply with the Personal Data Protection Act 2012 of Singapore (PDPA), and, where applicable, the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

The Services are intended for business and professional use. We act in two different roles. For personal data we collect about account holders and website visitors to operate our business (such as your registration and billing details), we are the controlling organisation (a "controller" under the GDPR). For personal data contained in the content you and your Authorized Users submit to a Workspace ("Customer Content"), you (or your organization) are responsible as the controlling organisation, and we process that data on your behalf as a data intermediary under the PDPA (a "processor" under the GDPR), in accordance with our Terms of Service and any applicable Data Processing Addendum. If you submit personal data of others to the Services, you are responsible for obtaining the required consents and providing the required notifications.

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you provide when you:

• Create an account (name, email address, workspace name)
• Use our Services (messages, files, AI conversations, settings, preferences)
• Make payments (billing information, processed securely by third-party payment processors)
• Contact our support team (support tickets, correspondence)
• Participate in surveys or provide feedback

2.2 Information Collected Automatically

When you use our Services, we automatically collect:

• Device information (IP address, browser type, operating system, device identifiers)
• Usage data (features used, pages visited, time spent, interaction patterns)
• Log data (access times, error logs, performance metrics)
• Cookies and similar tracking technologies (see our Cookie Policy below)
• Location data (approximate location based on IP address)

2.3 Information from Third Parties

We may receive information from:

• Authentication providers (if you sign in via OAuth)
• Payment processors (transaction confirmations, payment status)
• Third-party integrations you connect to your workspace
• AI model providers (solely for processing your requests, not for training)

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our Services
• Process your transactions and manage your account
• Communicate with you about your account, updates, and support
• Personalize your experience and provide relevant content
• Monitor and analyze usage patterns to improve performance
• Detect, prevent, and address technical issues, fraud, and security threats
• Moderate content and enforce our Acceptable Use Policy, including using automated and manual systems to scan, review, and detect illegal or prohibited material (such as child sexual abuse material), abuse, and other violations
• Comply with legal obligations and enforce our Terms of Service
• Send you marketing communications (with your consent, and you can opt out anytime)
• Conduct research and development to enhance our Services

Important: We never use your conversations, messages, or files to train AI models. Your data remains private and is used solely to provide Services to you.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on:

• Contract performance: Processing necessary to provide Services you requested
• Legitimate interests: Improving Services, security, fraud prevention, analytics
• Legal compliance: Meeting legal and regulatory requirements
• Consent: Marketing communications and optional features (you can withdraw consent anytime)

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

5.1 Service Providers

We share data with trusted third-party service providers who assist us in:

• Cloud infrastructure and hosting (data storage, server management)
• Payment processing (credit card processors, billing systems)
• AI model providers (OpenAI, Anthropic, Google, xAI, etc.) - to process your requests; they are contractually prohibited from training on your data, though some may briefly retain inputs and outputs to monitor for abuse and safety
• Analytics and monitoring tools
• Customer support platforms
• Email delivery services

These providers are contractually obligated to protect your data and use it only for specified purposes.

5.2 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or if necessary to:

• Comply with legal processes or enforceable government requests
• Enforce our Terms of Service and investigate violations
• Detect, prevent, or address fraud, security, or technical issues
• Report illegal content or activity (such as child sexual abuse material) to law enforcement or the relevant authorities, where required or permitted by law
• Protect the rights, property, or safety of our users or the public

5.3 Business Transfers

If we are involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred to the successor entity. We will notify you before your information is transferred and becomes subject to a different privacy policy.

5.4 With Your Consent

We may share your information with other parties when you explicitly consent to such sharing.

6. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access controls: Strict authentication and authorization mechanisms
• Workspace isolation: Complete data segregation between different workspaces
• Regular security audits: Ongoing monitoring and vulnerability assessments
• DDoS protection: Cloudflare-backed protection and Web Application Firewall (WAF)
• Employee training: All staff undergo security and privacy training
• Incident response: Established procedures for security breach notification

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to enhance our security measures.

7. Data Retention

We retain your personal information for as long as necessary to:

• Provide our Services to you
• Comply with legal, accounting, or reporting requirements
• Resolve disputes and enforce our agreements
• Maintain business records and backups

Specifically:

• Active accounts: Data retained as long as your account is active
• Deleted accounts: Personal data deleted within 30 days after account deletion, except where legal retention is required
• Backups: Data in backups deleted within 90 days
• Logs and analytics: Typically retained for 12-24 months
• Financial records: Retained for 7 years to comply with tax and accounting regulations

8. Your Rights and Choices

8.1 Access and Portability

You have the right to access your personal data and request a copy in a portable format (e.g., JSON, CSV).

8.2 Correction and Updates

You can update your account information anytime through your account settings. Contact us if you need assistance.

8.3 Deletion and Erasure

You have the right to request deletion of your account and personal data. Visit our Account Deletion Request page or contact us at [email protected].

8.4 Restriction and Objection

You may request to restrict processing of your data or object to certain types of processing (e.g., marketing).

8.5 Withdraw Consent

Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

8.6 Marketing Opt-Out

You can unsubscribe from marketing emails by clicking the "unsubscribe" link in any marketing email or updating your preferences in account settings.

8.7 Do Not Track

Our Services do not currently respond to "Do Not Track" signals, but we respect your privacy choices as outlined in this policy.

8.8 Complaints

If you believe we have violated your privacy rights, you may lodge a complaint with the relevant authority. In Singapore, this is the Personal Data Protection Commission (PDPC). If you are in the EEA, UK, or Switzerland, you may lodge a complaint with your local data protection authority. We ask that you contact us first so we can try to resolve your concern.

To exercise any of these rights, please contact us at [email protected].

9. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know: Request information about the categories and specific pieces of personal information we collect, use, and disclose
• Right to delete: Request deletion of your personal information
• Right to opt-out: We do not sell personal information, but you can opt out of certain data sharing
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise these rights, contact us at [email protected]. We will verify your identity before processing requests.

10. International Data Transfers

Our Services are operated from Singapore. If you are located outside Singapore, your information will be transferred to and processed in Singapore and other countries where our service providers operate.

We ensure appropriate safeguards are in place for international transfers, including:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions by relevant data protection authorities
• Your explicit consent where required

11. Children's Privacy

Our Services are intended for business use and are not directed to, nor may they be used by, individuals under the age of 18. We do not knowingly collect personal information from individuals under 18. If you believe someone under 18 has provided us with personal information, please contact us at [email protected], and we will delete such information.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain your session and keep you logged in
• Remember your preferences and settings
• Analyze usage patterns and improve Services
• Provide relevant content and recommendations

You can control cookies through your browser settings. Disabling cookies may limit certain features of our Services.

Types of cookies we use:

• Essential cookies: Required for the Services to function (authentication, security)
• Performance cookies: Help us understand how users interact with our Services
• Functional cookies: Remember your preferences and settings
• Analytics cookies: Collect aggregated usage statistics

13. Third-Party Links and Services

Our Services may contain links to third-party websites, integrations, or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice in our Services

Your continued use of our Services after the effective date of changes constitutes acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

KOLEKTIQ PTE. LTD.
UEN 202625566D
160 Robinson Road, #14-04
Singapore Business Federation Center
Singapore 068914
Email: [email protected]
Privacy inquiries: [email protected]

We will respond to your inquiry within 30 days.

16. Data Protection Officer

For matters related to data protection and privacy compliance, you may contact our Data Protection Officer at:

Email: [email protected]