Draft — pending PDPA review. This is a working template aligned to Singapore’s Personal Data Protection Act. It is not yet in force and does not constitute legal advice.

Privacy Policy

Draft template

What we collect

• Account: your email and authentication state, via our identity provider.
• Subscription: billing and subscription status, via our payment processor (we do not store card numbers).
• Personalization: saved projects and preferences you create.
• Usage: limited technical logs for security, rate limiting and reliability.

How we use it

To operate your account, provide Free/Pro features, process payments, secure the service, and meet legal obligations. We do not sell personal data.

Disclosure to processors

We use third-party processors for authentication, payments, error monitoring and hosting. They process data on our behalf under their terms; underlying market data sources are separate and governed by their own licences.

Retention and deletion

You may request account deletion from your account settings. On deletion we first delete your identity record, which blocks future sign-ins and invalidates refresh sessions. We then cancel any active subscription and remove your personalization data. An already-issued session ends when its short-lived access token expires. A minimal record may be retained where required for billing, fraud prevention and audit.

Your PDPA rights

Subject to the PDPA, you may request access to or correction of your personal data and may withdraw consent. Requests are handled through the contact channel below.

Security and location

Access is protected by authentication, second-factor for owner access, least-privilege database roles and disclosure controls. Data is hosted in the Singapore region where practicable.

Placeholder for PDPA review. The data-protection officer contact, processor list, international-transfer basis and retention periods must be finalised and reviewed before publication.