Draft: this privacy notice is awaiting legal review and is not yet in effect.

Privacy

Your documents, records and files are stored in Singapore.

Your documents, records and files are stored in Singapore. Some services run elsewhere: your account details are held in Sydney, Australia; your sign-in details (name, email address and sign-in method) are held by Google in the United States; and payments are handled by Stripe in the United States.

Where we store your content

We store your documents, records and files in Sydney, Australia. If you told us your business is based in Singapore when you created your workspace, we store them in Singapore instead. If your business is in Singapore but your workspace was created before we offered Singapore storage, it stays in Sydney until you ask us to move it. You can ask from Settings.

Email delivery records

When our products send an email for your workspace, to you or to the people you send documents, invitations or bookings to, our email service keeps a delivery record in Sydney, Australia. It holds the address the email went to, a message reference, which product sent it, and what our email provider reports about it: whether and when it was sent, delivered, delayed, bounced, not sent, or opened; for marketing emails, that a link was clicked; and, if it happens, that the person unsubscribed or reported it as spam. It never holds the subject or contents of the email, which link was clicked, or the person's IP address or device. We delete delivery records after 90 days, and they are gone from our backups within a further 14 weeks. If we must stop emailing an address, we keep a note of that address until the block is cleared, and it is gone from our backups within 14 weeks after that.

Account records

Your account records are held in Sydney, Australia: your profile, your organisation and its team members, your subscription, and a record of the account emails we send you, such as sign-in and billing emails.

Support access

Our team works from Australia. When you ask us for help, or when we look after the service, people on our team in Australia may access your workspace and its content. Your content stays stored in Singapore while they do.

Held or done outside Singapore

This section covers everything held or done outside Singapore: sign-in (United States), payments (United States), sending email (Australia or the United States), email delivery records, account records and Enterprise enquiries (Sydney), and support access (from Australia). AI connectors aren't available for Singapore workspaces at launch.

Your personal data and Singapore's privacy law

Singapore's Personal Data Protection Act 2012 (PDPA) applies to the personal data we handle for Singapore customers. This section explains what we do with it and what you can ask of us.

Who is responsible for what

For your own account details (your sign-in, profile, organisation, team members and billing), we are the organisation responsible for your personal data.

For what you put into our products, such as documents, data rooms and bookings, and for the people you send them to, we handle that data on your behalf. Under the PDPA, we act as your data intermediary. You are responsible for having consent from the people whose data you add or send, and we follow your instructions and protect and delete that data as we've agreed with you. If someone asks us about data you control, we pass the request to you.

Why we collect and use personal data

We use personal data to:

create and run your account, including sign-in, your organisation, team members and subscription;
provide the products you use;
send service emails and keep their delivery records;
bill you and take payment;
help you when you ask for support;
keep our service secure and prevent abuse;
answer Enterprise enquiries and prepare quotes;
meet our legal duties, such as keeping tax records.

We send marketing emails only if you've agreed to them. Every one has an unsubscribe link, and unsubscribing doesn't affect your service.

Seeing and correcting your personal data

You can ask to see the personal data we hold about you, or ask us to correct it, by writing to our privacy contact below. We'll confirm who you are first. We answer within 30 days, and if we can't, we'll tell you within those 30 days when we will. We don't charge for these requests.

You can correct most of your account details yourself in Settings. When we correct your personal data, we also send the correction to any organisation we gave it to in the past year, where they need it.

Withdrawing your consent

You can withdraw your consent by writing to our privacy contact, or stop marketing emails by unsubscribing. Before we act, we'll tell you what withdrawing will mean. We can't run an account without its core details, so withdrawing consent for those means closing your account. Withdrawing consent for marketing changes nothing else. We'll act on your request within 10 business days, and keep only what the law still requires us to keep, such as tax records.

How long we keep personal data

We keep personal data only as long as we need it for the purposes above, or as long as the law requires.

Email delivery records: deleted after 90 days, and gone from our backups within a further 14 weeks.
Billing and tax records: as long as the law requires, currently seven years.
What's stored in a workspace, after the workspace is deleted or its last member closes their account: 30 days, and gone from our backups within a further 14 weeks.
Your MyAndGo account details, after you close your account: To be confirmed before this notice is published.
Cancelling a subscription, letting a trial end without paying, or not using your account doesn't delete anything when it happens.

Personal data handled outside Singapore

The Singapore section above lists what is held or done outside Singapore. Some of it we hold ourselves in Australia, such as account records, email delivery records and Enterprise enquiries. We protect it under our own policies and Australian privacy law (the Privacy Act 1988). Other companies that handle your personal data for us outside Singapore must protect it to a standard comparable to the PDPA, under their contract with us.

Questions and complaints

Write to our privacy contact with any question or complaint. We'll acknowledge it within 5 business days and answer within 30 days. If you're not satisfied with our answer, you can contact Singapore's Personal Data Protection Commission at pdpc.gov.sg.

Privacy contact

Data protection officer: Andy Carey. Contact: privacy@support.myandgo.com.au