Privacy Policy

Our commitment to data protection principles

We are responsible for the processing of your personal data. In order to protect your personal data in connection with your use of the Service, we are committed to adhering to the principles below.

Every individual working for us must also adhere to these principles in performing his or her day-to-day duties. We will therefore make sure that your personal data is:

• processed lawfully, fairly and in a transparent manner (lawfulness, fairness and transparency);
• collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation);
• adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed (data minimisation);
• accurate and, where necessary, kept up to date; every reasonable step will be taken to ensure that your personal data that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay (accuracy);
• kept in a form which permits your identification for no longer than is necessary for the purposes for which personal data is processed (storage limitation); and
• processed in a manner that ensures appropriate security of your personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality).

The controller of your personal data is TZ APAC Pte. Ltd. If you have any questions, you can reach out to [email protected].

Personal Data We Collect

“Personal data” means any information that relates to an identifiable natural person. The personal data we collect depends on how you interact with the Service.

2.1 Website visitors (Website only)

If you visit the Website for informational purposes only and do not submit any forms, we collect only the technical data that is automatically transferred by your browser to our server. This includes your IP address, browser type, operating system, referring URL, pages viewed, and time of access. This data is technically necessary for us to display the Website and ensure its security and stability. It is not used to identify you personally and is not linked to any other personal data we hold.

We may evaluate IP addresses together with other data in cases of suspected attacks on our infrastructure or unauthorised or abusive use of the Website, for the purpose of protection and, where appropriate, for use in legal proceedings against the relevant users. This is based on our legitimate interest in protecting the Website and our users.

2.2 Website Early Access Form (Website only)

If you submit the early access form on our Website, we collect your email address. You provide this voluntarily. We use it solely to send you the communications you have opted in to receive. You may unsubscribe at any time using the unsubscribe link included in every email we send or by replying to the sender.

2.3 Analytics data

We use analytics tools to understand how users interact with the Service. On the Website, we use Google Analytics (see Section 6). This data may include anonymised or aggregated usage metrics.

3. Why We Collect Your Personal Data

We use personal data collected through the Service for the following purposes:

• to send you communications you have opted in to receive (Website Early Access Form)
• to monitor performance, diagnose technical issues, and ensure stability;
• to comply with our legal and regulatory obligations; and
• to enforce our Terms of Service and protect the rights, property, or safety of TZ APAC, our users, or others.

4. Lawful basis for processing

We process your personal data in accordance with the Personal Data Protection Act 2012 of Singapore (PDPA) and where applicable, the General Data Protection Regulation (GDPR) and other applicable data protection laws. Under the PDPA, we collect, use and disclose personal data with consent, deemed consent, or where otherwise required or authorised by applicable law.

• Consent: where you have given us explicit consent to process your data. This applies to analytics cookies placed on the Website.
• Performance of a contract: where processing is necessary to provide the Service under the Terms of Service.
• Legitimate interests: where processing is necessary for our legitimate interests and those interests are not overridden by your rights. This applies to Website hosting and security, fraud and abuse prevention, and IP address evaluation in cases of suspected misuse.
• Legal obligation: where processing is required to comply with applicable law. This applies to: responding to lawful requests from regulators or law enforcement; data breach notifications; and retention of records required by tax, accounting, or financial regulations.

5. Disclosure and Transfer of Your Personal Data

We do not sell your personal data. We may share personal data with the following categories of third parties, each of whom is subject to strict confidentiality obligations and required to protect data privacy to a standard consistent with this Privacy Policy:

• IT service providers: including website hosting providers, cloud infrastructure providers, and analytics providers. These may be located in Singapore, the United States, or other jurisdictions.
• Email service providers: who facilitate our mailing list and transactional email communications. The current provider is via the Keystone Lab email domain. Their privacy practices are available at https://www.cloudflare.com/policies/privacy/.
• Affiliated entity: our affiliated entity, TZ APAC Pte. Ltd., where necessary for operational or administrative purposes.
• Legal and regulatory authorities: we will not share your personal data with government authorities except where required to comply with a binding and enforceable legal obligation or to protect against fraud, abuse, or threats to security. Where we receive a request to disclose personal data to a government authority, we will carefully assess the request and will only comply where it is legally binding and issued in full compliance with applicable law.

In the event of a merger, acquisition, or sale of all or a material part of our assets, your personal data may be transferred to the acquiring entity, provided that entity agrees to be bound by terms consistent with this Privacy Policy.

6. Google Analytics (Website only)

On the Website, we use Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies to collect anonymised information about how visitors use the Website. This information is used to compile reports and to help us improve the Website.

Google Analytics uses IP addresses at the point of collection to derive coarse location information and for technical purposes. In Google Analytics 4, IP addresses are not logged or stored by Google Analytics and are discarded before data is logged. Google may process other device, browser and usage information in accordance with its applicable privacy terms and settings.

Analytics cookies are only placed on your device after you provide consent through our cookie consent mechanism. You may withdraw consent at any time through your browser settings or by using the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout.

Google may transfer analytics data to servers in the United States. For further information on how Google processes data, see Google's Privacy Policy at https://policies.google.com/privacy.

7. Cookies (Website only)

Our Website uses cookies, which are small text files stored on your device. We use the following categories of cookies:

• Strictly necessary cookies: required for the Website to function properly. These cannot be disabled.
• Analytics cookies: used by Google Analytics (see Section 6) to collect anonymised usage data. These are only placed on your device with your consent.

You can manage or disable cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website. The App does not use browser cookies.

8. Securing your data

We implement appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include encryption of data in transit and at rest, access controls, environment separation, and system monitoring.

We have contractual arrangements with all IT and third-party service providers that require them to implement equivalent security measures. We impose strict confidentiality obligations on all personnel with access to personal data.

Where data is stored locally on your device, the security of that data depends in part on your own device security, including your passcode, biometric lock, and operating system protections. You are responsible for securing your device and promptly notifying us at [email protected] if you suspect any unauthorised access to your account.

No security measure is completely infallible. We do not guarantee that the Service will be immune from unauthorised access, data loss, or security incidents. In the event of a personal data breach, we will respond as described in Section 9.

9. Data Breach Response

If we become aware of a personal data breach, we will take prompt steps to investigate, contain, and remediate the incident. Where legally required, we will notify the relevant supervisory authority within the applicable timeframe:

• under Singapore's PDPA, we will notify the Personal Data Protection Commission (PDPC) within 3 calendar days where the breach is notifiable;
• under the GDPR, where applicable, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours.

Where a breach is likely to result in a high risk to affected individuals, we will notify those individuals without undue delay through the email address associated with their account and, where practicable, through in-app notification.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

• Website technical data: retained for as long as necessary for security and operational purposes, typically in accordance with our hosting provider's standard retention settings.
• Website subscription email addresses: retained for as long as you remain subscribed to our communications. Upon unsubscribing, your email address will be removed from our mailing list promptly.
• App account data: retained for the duration of your account. When you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law or for legitimate security, fraud prevention, dispute resolution, or compliance purposes.
• Usage and analytics data: may be retained in anonymised or aggregated form for up to 24 months.

Deleted content may temporarily remain in backups, logs, or disaster recovery systems for a limited period before being securely deleted or overwritten.

11. Cross-Border Data Transfers

Because the Service involves cloud infrastructure, analytics systems, and other service providers, your data may be transferred to, stored in, or processed in countries outside Singapore. These countries may have data protection laws that differ from those in your jurisdiction.

Where required, we use appropriate safeguards for international data transfers, including contractual protections, data processing agreements, Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms recognised under applicable law.

12. Your rights in connection with your data

You have the following rights in connection with your personal data, subject to applicable law:

• Access: you may request confirmation of whether we hold personal data about you and a copy of that data.
• Correction: you may request that we correct inaccurate or incomplete personal data we hold about you.
• Erasure: you may request deletion of your personal data stored on our servers.
• Data portability: you may request a copy of personal data you have provided to us in a structured, commonly used, and machine-readable format.
• Objection: you may object to our processing of your personal data, including processing based on legitimate interests or for direct marketing purposes.
• Withdrawal of consent: where processing is based on consent, you may withdraw that consent at any time or request erasure by contacting [email protected].
• Complaint: you have the right to lodge a complaint with a data protection supervisory authority. In Singapore, this is the Personal Data Protection Commission (PDPC) at https://www.pdpc.gov.sg. Before doing so, we ask that you contact us first so we can attempt to resolve your concern.

To exercise any of these rights, please contact us using the details in Section 15 below. We will respond within the timeframe required by applicable law. We may request verification of your identity before processing your request.

Please note that these rights may be subject to limitations under applicable law, and in certain circumstances we may be entitled to refuse a request.

13. Children and Minors

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If you believe that we have inadvertently collected personal data from a minor, please contact us at [email protected] and we will take prompt steps to delete that data.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable laws. We will post the updated version on this page and revise the “Last Updated” date. We encourage you to review this Privacy Policy periodically.

15. Contact

If you would like to exercise your rights listed in Section 12, have a question about this Privacy Policy, or have a concern about how we handle your personal data, please contact us:

For data protection or privacy-specific requests, please include “Privacy Request” in the subject line of your email.

Where you are located in a jurisdiction with a designated data protection supervisory authority, you also have the right to lodge a complaint with that authority. In Singapore, complaints may be directed to the Personal Data Protection Commission (PDPC) at https://www.pdpc.gov.sg.