Privacy Policy

Effective date: 23 July 2026 | Last updated: 23 July 2026

HumanLed AI operates humanledai.sg. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what you can ask us to do about it. It is written to meet Singapore’s Personal Data Protection Act 2012 (PDPA).

The short version. We collect what you give us through the contact form or the workflow assessment chat. We use it to prepare your summary and to reply. We do not sell it. We keep it for two years, then permanently strip your identity from it. You can ask us for a copy, ask us to correct it, or withdraw consent at any time.

1. Who is responsible

HumanLed AI is the organisation responsible for the personal data described here. Our Data Protection Officer can be reached at dpo@humanledai.sg or +65 8051 4988. Designating a DPO and publishing their business contact information is required under PDPA s11(3) and s11(5).

2. What we collect

When you use the contact form

Name, email address, phone number, company name
What you tell us in the message field
Which type of enquiry you selected
Whether you agreed to receive marketing, recorded separately as a consent record

When you use the workflow assessment chat

The operational areas you select, and anything you type in your own words
Rough figures you give us — hours per week, number of people
Business information relevant to government grant criteria: whether the business is Singapore-registered, whether it is at least 30% locally owned, approximate headcount, whether a project has already commenced, and whether the Enterprise Development Grant has been used before
Your name, email, phone and company at the end, so we can send you the summary

You choose what to type. Please do not enter anything you would not want recorded — in particular, do not enter NRIC or FIN numbers, financial account details, or personal data about your own customers or staff. We do not ask for any of these and do not need them.

Automatically

Pages visited and links clicked
Browser and device type
IP address. Where we store it against a consent record we store a one-way hash of it, not the address itself.

3. Why we use it, and on what basis

Under the PDPA we rely on your consent, which you give explicitly before the form or the chat submits anything. We use your data only for:

Preparing and sending the summary or proposal you asked for
Replying to your enquiry and arranging a workflow assessment
Delivering services you engage us for
Sending occasional updates and tips — only if you separately opted in, and you can stop this at any time without affecting anything else
Meeting legal, tax and record-keeping obligations

We do not sell personal data, and we do not use it to train AI models.

4. Who we share it with

We use the following service providers to run the site and process enquiries. Each receives only what it needs, and processes it on our instructions.

Provider	What it does	Where it processes data
Vercel	Website hosting	Outside Singapore
Supabase	Database for enquiries and consent records	See note below
Bitrix24	Customer relationship management	Outside Singapore
Brevo	Sending email	European Union
Make.com	Passing enquiries between systems	European Union
Alibaba Cloud (Qwen)	Language model behind the assessment chat	Singapore

We may also disclose personal data where the law requires it.

5. Transfers outside Singapore

As the table shows, some of these providers process data outside Singapore. PDPA s26 (the Transfer Limitation Obligation) requires us to take steps so that transferred data receives a standard of protection comparable to the PDPA. We do this through the contractual terms and data processing agreements each provider offers.

The chat assistant runs on Alibaba Cloud’s Singapore endpoint, so that processing stays in region. If we change model provider we will update this policy before doing so.

6. How long we keep it

Two years from your most recent interaction with us. After that, an automated job permanently removes your name, email address, phone number and company name from our records. This is irreversible — we cannot restore it afterwards, and neither can we.

What remains is the anonymous part of the assessment: which operational areas were selected, the rough hours involved, and the resulting analysis. That record can no longer be connected to you or to your business, and we keep it to understand which problems are common.

We anonymise rather than delete because PDPC guidance (Key Concepts 18.10(d)) treats anonymisation as ceasing to retain personal data, while 18.4(b) allows records to be kept for legitimate legal or business purposes. Marking a record hidden while leaving the details in place would not meet PDPA s25 — PDPC 18.11 is explicit on that point.

Consent records are kept separately and for longer, so that we can demonstrate what you agreed to and when. They are keyed to a one-way hash of your email address, not to the address itself.

Where we are required to keep records for tax or contractual reasons, we keep the financial record and remove the identifying details from it.

7. Your rights

Access (PDPA s21). Ask us for a copy of the personal data we hold about you, and how we have used it in the past year.
Correction (PDPA s22). Ask us to correct anything inaccurate or incomplete.
Withdraw consent (PDPA s16). Withdraw at any time. We will tell you what that means in practice before it takes effect, and we will stop processing unless the law requires otherwise.
Unsubscribe. Every marketing email carries an unsubscribe link. Using it does not affect our replies to your enquiries.
Early erasure. Ask us to anonymise your record before the two years are up.

Write to dpo@humanledai.sg. We aim to respond within 30 days. If you are not satisfied with our response you may contact the Personal Data Protection Commission at pdpc.gov.sg.

8. How we protect it

The site is served over HTTPS.
Our database denies access by default. Only our server can read or write to it; there is no path from a browser to the stored records.
Email addresses and IP addresses in consent records are stored as one-way hashes.
Personal data is removed from our application logs.
Access is limited to people who need it to do their work.

No system is perfectly secure. If a data breach occurs that is likely to result in significant harm to you, or affects 500 or more people, we will notify the PDPC and affected individuals as required by PDPA Part 6A.

9. Cookies and analytics

We use only what is needed for the site to function. We do not use advertising or cross-site tracking cookies. If we add website analytics we will use a privacy-preserving, cookie-free tool and update this section before switching it on.

10. Children

This is a business-to-business service. It is not directed at children and we do not knowingly collect their personal data.

11. Changes to this policy

If we change how we handle personal data we will update this page and change the “last updated” date above. Where a change is significant we will seek fresh consent rather than rely on the old one.

12. Contact

Data Protection Officer, HumanLed AI
dpo@humanledai.sg
+65 8051 4988