Privacy Notice

What we collect, and why

Account details: the name, username and email address of each person who signs in, so they can sign in and so we can reach them about the service.

Brand material you upload: reference posts, brand guidelines, knowledge-base documents and notes about your clients. This is the material generation is grounded in — without it the product has nothing to be specific about.

Content the product produces: captions, images and the quality scores attached to them, together with which of your own documents supported each factual claim.

Social platform credentials, where you choose to give them, so the product can publish on your instruction.

Usage records: which posts were generated, approved and handed over, and clicks on tracked links. Link clicks record the channel and the time and nothing about the person clicking.

Where it is held

The primary copy of your data is held on servers in Singapore.

Generating content necessarily sends the relevant brief and brand material outside Singapore, to the recipients named below. This is disclosed because the PDPA's Transfer Limitation Obligation requires it, and because you should know before you upload anything.

What we do not do

We do not sell personal data.

We do not use your material to train models.

We do not use one customer's material to generate another customer's content, and we do not use one brand's material for another brand — even under the same account — unless you deliberately share it.

Your rights under the PDPA

You may ask for access to the personal data we hold about you and how it has been used. The product provides this itself; you do not have to wait on us.

You may ask us to correct data that is wrong.

You may withdraw consent and ask us to delete your account. Deletion removes the records rather than hiding them.

Some records survive deletion where the law requires us to keep them — billing records are the usual case. Where that applies we will say so rather than delete quietly and imply more than we did.

Security, and what happens if it fails

Social platform credentials are encrypted at rest and are never returned by the API to anyone, including the account that supplied them.

Access is scoped so one customer cannot read another's records, and this is asserted by an automated test suite rather than assumed.

If a data breach occurs that is likely to result in significant harm, or that affects 500 or more individuals, we will notify the Personal Data Protection Commission within three calendar days and notify affected individuals, as the PDPA requires.

How long we keep it

We keep your material for as long as your account is open, because it is what the product generates from.

When you delete a client, its campaigns, posts, brand kit, knowledge base and stored credentials are deleted with it.

When you close your account we delete the personal data attached to it, except where the law requires us to retain a record.

Contacting our Data Protection Officer

Write to hello@reluvate.com. The PDPA requires us to name a Data Protection Officer and publish a way to reach them, and that is the address.

If you are not satisfied with our answer you may complain to the Personal Data Protection Commission of Singapore.

Who receives your data outside Singapore