Privacy policy.

Service description: AICRMGenius is an AI-powered customer relationship management platform designed for Singapore professionals, merchants, staff, and their customers. Our platform offers:

• AI CRM tools for client memory and relationship follow-up
• WhatsApp integration for customer conversations
• Voucher management and distribution
• Customer database and insights
• Multi-role access for professionals, merchants, and staff

User categories:

• Merchants: create vouchers, manage locations, staff, and customer relationships
• Professional users: manage client relationships and share approved touchpoints
• Staff members: limited access to manage customer interactions
• Customers: receive and redeem vouchers via WhatsApp

We collect the following depending on your user type:

When you use our platform, we automatically collect:

• Device information (browser, OS, device type)
• IP addresses and geolocation
• Usage analytics (pages visited, features used, time spent)
• Cookies and similar technologies (see Section 9)
• API request logs and error reports

Through our WhatsApp Business API integration, we collect:

• Message content for AI processing and conversation history
• Conversation metadata (timestamps, participants, message status)
• Delivery and read receipts
• Media files shared via WhatsApp (images, documents, etc.)

Our AI systems generate and store:

• AI conversation responses and recommendations
• Customer insights and engagement analytics
• Automated campaign suggestions
• Sentiment analysis and customer behaviour patterns

• Provide CRM functionality and customer management tools
• Process AI-powered conversation handling and responses
• Create, distribute, and manage vouchers and campaigns
• Facilitate WhatsApp integration and messaging
• Enable multi-user collaboration

• Account creation and authentication via Firebase
• Payment processing via Airwallex
• Customer support and technical assistance
• Service improvements and new features
• Performance monitoring and optimisation

• Transactional emails (voucher notifications, campaign updates)
• Marketing communications (with your consent)
• Product updates and service announcements
• Responses to inquiries and support requests

• Analyse platform usage and behaviour
• Train and improve AI models (anonymized data only)
• Generate business intelligence and insights
• Measure campaign effectiveness

• Prevent fraud and ensure platform security
• Comply with Singapore PDPA and other applicable laws
• Respond to legal obligations and government requests
• Resolve disputes and enforce our Terms of Service

We share your personal information with the following third-party service providers to deliver our services.

• OpenAI (GPT-5): AI conversation processing and generation
• Groq: AI conversation processing and inference acceleration

Your conversation data may be processed by these providers to generate AI responses. We have data processing agreements in place. AI-generated responses are automated and may contain inaccuracies. You are responsible for reviewing all AI-generated content before use.

• Firebase (Google): Authentication and user management
• Airwallex: Payment processing
• WhatsApp Business API (Meta): Messaging infrastructure
• Cloudflare: Hosting, CDN, DDoS protection
• Analytics: Usage analytics and performance monitoring

• Comply with court orders, legal processes, or government requests
• Enforce our Terms of Service
• Protect rights, property, or safety of AI Engagement Pte Ltd, our users, or the public
• Investigate fraud, security issues, or technical problems

AICRMGenius is primarily operated from Singapore. Your personal data may be transferred to and processed in countries outside Singapore, including:

• United States: Firebase (Google), Airwallex, OpenAI, Groq
• European Union: Cloudflare CDN infrastructure
• Other regions: where our service providers operate data centers

All international data transfers are protected by:

• Standard Contractual Clauses (SCCs) for transfers to the EU/EEA
• Data Processing Agreements (DPAs) with all providers
• Adequate safeguards as required by Singapore PDPA
• Encryption in transit and at rest for all sensitive data

• Encryption in transit (TLS/SSL)
• Encryption at rest for sensitive data
• Secure password hashing (bcrypt/argon2)
• PIN hashing for staff authentication
• Firebase security rules and access controls
• Regular security audits and vulnerability assessments
• DDoS protection via Cloudflare

• Role-based access controls and least privilege
• Employee training on data protection and privacy
• Incident response and breach notification protocols
• Regular data backups and disaster recovery planning
• Third-party security audits and compliance reviews

No method of transmission over the internet is 100% secure. You are responsible for keeping your account credentials confidential. If you become aware of unauthorised access, contact us at [email protected].

We retain your personal information for as long as necessary to provide our services and comply with legal obligations.

• Active accounts: for the duration of our relationship + 7 years (Singapore tax/audit)
• End user data: until voucher redemption + 1 year
• Transaction records: 7 years (tax/audit compliance)
• Marketing communications: until consent is withdrawn + 30 days
• Logs and analytics: up to 2 years
• AI training data: anonymized data may be retained indefinitely

When you request account deletion, we will delete or anonymize your personal information within 30 days, except where legally required to retain certain information. Some information may persist in backup systems for up to 90 days before permanent deletion.

You may request a copy of the personal data we hold about you. We will provide it in a structured, commonly used, and machine-readable format.

You may request that we correct any inaccurate or incomplete information. Most fields can be updated directly in your account settings.

You may withdraw your consent for marketing or non-essential processing at any time.

You may request deletion of your personal information ("right to be forgotten"), subject to legal retention requirements.

You may request a copy of your data in a portable format to transfer to another service provider.

You may object to certain types of data processing, including automated decision-making and profiling.

• Strictly necessary: required for authentication, security, and session management. Cannot be disabled.
• Functional: store user preferences, language settings, and customisation.
• Analytics: usage patterns and performance.
• Marketing: advertising and retargeting (with consent).

Control cookies through your browser settings. Disabling cookies may affect functionality.

Our service is not directed at children under 13. We do not knowingly collect personal information from children under 13 without parental consent.

If you are a parent or guardian and believe your child has provided us with personal information, contact [email protected] and we will promptly delete it.

For users between 13–18 in applicable jurisdictions, parental consent may be required.

We may update this Privacy Policy from time to time. If we make material changes that significantly affect your privacy rights, we will notify you via:

• Email to your registered address
• Prominent notice on our platform
• In-app notification

Continued use of our service after changes constitutes acceptance of the updated Privacy Policy.

Questions about this Privacy Policy or our data practices? Write to [email protected].