Privacy policy

1. Who this covers and our role

This policy concerns three groups of people: businesses that sign up for the Service and their team members ("customers" or "merchants"); people who chat with a merchant's AI assistant or support team ("shoppers"); and visitors to our website.

For customer accounts, billing information and website visits, we decide why and how the data is processed, so we are the controller (an "organisation" under Singapore's Personal Data Protection Act 2012, the PDPA).

For content merchants upload and for shoppers' conversations, the merchant is the controller and we process the data on the merchant's behalf (a "data intermediary" under the PDPA and a "processor" under the GDPR), only on the merchant's instructions and under our Data processing agreement. Merchants are responsible for informing their shoppers and obtaining any consent required.

2. Information we collect

Account and team: name, email, company or store name, password (stored only as an irreversible hash), member roles, and sign-in and activity records.

Content customers upload: knowledge base documents, FAQs, product data (such as name, price, stock, image links and descriptions), assistant settings, welcome messages and quick-reply buttons, and channel configuration. Channel secrets and callback signing secrets are stored encrypted; API keys are stored only as hashes.

Conversations: messages between shoppers, the AI assistant and human agents, with timestamps; shopper identifiers the merchant passes to us (such as a member ID, nickname or email); conversation language; the country inferred from the IP address; and conversation ratings and comments. We look up the IP address in a geolocation database on our own servers to determine the country and default language, and we do not store shoppers' full IP addresses.

AI-assisted ordering: the products, variants, quantities, quotes and discounts a shopper confirms in the conversation, and the order number and payment link returned by the merchant's system. Payment takes place on the merchant's own page; we never receive shoppers' payment details and we do not store the merchant's order records.

Billing: plans purchased, balance transactions and payment status. Card and wallet details are handled directly by payment service providers; we never see or store them.

Device and usage data: access times, browser and device type, language, API call records and error logs.

Information you give us: what you send when you contact us by email, live chat or otherwise.

3. How we use information and our legal bases

To provide the Service (performance of contract): generating AI answers, searching the knowledge base and products, handing conversations to human agents, sending webhooks, looking up orders in the merchant's system or creating a payment link after the shopper confirms, and sending notification emails.

Billing (performance of contract, legal obligation): counting AI replies, charging, issuing receipts and keeping financial records.

Security and abuse prevention (legitimate interests): authentication, risk control, preventing fraud and abuse, and troubleshooting. Our staff look at a customer's data only when needed to fix a problem or handle that customer's request, and every such access is recorded in an audit log.

Improving the Service (legitimate interests): using aggregated, de-identified usage statistics. We do not profile individuals based on conversation content.

Communicating with you (performance of contract, legitimate interests; marketing emails only with your consent): service notices, billing and security alerts, and product updates. You can unsubscribe from marketing emails at any time; service notices are not optional.

Complying with law (legal obligation): responding to lawful requests and keeping records the law requires.

We do not sell personal information. Only if you agree through our cookie banner do we use Google Ads on our website and consoles to measure sign-ups and purchases that come from our ads (see section 7 and the Cookie notice); you can withdraw that consent at any time.

4. How AI processing works

The Service uses third-party large language model providers to generate answers and translations. When generating an answer, the conversation together with relevant knowledge base excerpts and product data is sent to these providers. Our agreements with them restrict them to processing the data to provide their service to us; it is not used to train their models.

Embedding of knowledge base and product content (for semantic search) runs on our own servers.

We never use one customer's content to train models, or make it available to other customers.

AI answers are generated automatically and may be inaccurate. The AI does not make legally binding decisions for shoppers: with AI-assisted ordering, an order is sent to the merchant only after the shopper clicks "Confirm order" or replies "confirm".

5. Sharing

Subprocessors: providers of cloud hosting, CDN, email delivery, payments and language models process data on our instructions under contract. See the Subprocessor list for who they are and what they do.

Recipients the merchant chooses: the merchant's webhooks, order lookup endpoint, order callback and messaging channels (such as WeChat). These are operated by the merchant or the channel platform under their own privacy policies.

Legal requirements: to comply with law, court orders or lawful requests from authorities, or to protect the rights, property and safety of us, our customers, shoppers or the public.

Business transfers: in a merger, acquisition or sale of assets, personal data may transfer with the business. We will tell you, and the recipient must continue to honour this policy.

Anything else you agree to.

6. International transfers

We are a Singapore company, and our servers and some subprocessors are located in the United States and other countries. As the PDPA requires, we make sure recipients provide a standard of protection comparable to the PDPA.

For personal data transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum) or another lawful transfer mechanism.

7. Cookies and local storage

Our website uses one cookie to remember the language you choose; the consoles keep your sign-in in your browser's local storage; and the chat widget on a merchant's site keeps a random visitor ID in local storage so conversations can continue. Our CDN may set security cookies. Only if you click “Accept” in our cookie banner do the website and consoles load Google Ads code, which uses advertising cookies to measure sign-ups and purchases from our ads; if you don't choose or you reject, it is not loaded. We use no analytics cookies. See the Cookie notice for details.

8. How long we keep data

Accounts, uploaded content and conversations: for as long as the account exists. When a paid plan ends, the account moves to the free plan and the data is kept. Merchants can delete knowledge base documents and products in the console at any time.

Account closure: we delete or anonymise the account's data within 30 days, except records the law requires us to keep.

Backups: database backups roll over every 14 days and expired copies are deleted automatically.

Billing and financial records: for the period the law requires, generally five years in Singapore.

Audit and security logs: for as long as needed for security and legal purposes.

9. Security

All data is encrypted in transit over HTTPS; passwords and API keys are stored only as hashes and sensitive settings such as channel secrets are encrypted; each customer's data is strictly isolated.

Staff access follows least privilege; platform administrators must sign in with two-factor authentication, and access to customer data is audited.

No system is perfectly secure. If you find a security issue, please email privacy@yinke.ai.

10. Your rights

Everyone: under the PDPA you can ask for the personal data we hold about you and how it has been used and disclosed in the past year, ask us to correct it, and withdraw consent (some features may then stop working).

EEA, UK and Swiss residents: under the GDPR and similar laws you also have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, to withdraw consent at any time (without affecting earlier processing), and to complain to your local data protection authority.

California residents: under the CCPA as amended by the CPRA, you have the right to know the categories and specific pieces of personal information we collect, to request deletion and correction, to opt out of sale or sharing (we do neither), and to limit the use of sensitive personal information (we use it only as needed to provide the Service). We will not discriminate against you for exercising these rights, and you may use an authorised agent.

How to make a request: email privacy@yinke.ai. To protect your data we may first verify your identity. We reply within 30 days; where the law allows an extension, we will tell you why. Reasonable requests are free.

Shoppers: your conversation data is controlled by the merchant you talked to, so please contact that merchant first. If you contact us directly, we will pass your request to the merchant and help them handle it.

11. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect children's personal data, and we delete it promptly if we learn we have. Where a merchant's shoppers include children, the merchant is responsible for obtaining parental consent as the law requires.

12. Data breaches

If a data breach is likely to cause significant harm, we notify affected customers and the relevant authorities as the law requires, for example the Personal Data Protection Commission of Singapore within three calendar days of assessing it. Where a merchant's data is involved, we notify the merchant promptly and help them meet their own notification duties.

13. Changes to this policy

We may update this policy from time to time and will post the new version here with a new "Last updated" date. For material changes we notify customers by email or in the console at least 30 days before they take effect.

14. Contact us

TIMES TECHNOLOGICAL SERVICES PTE. LTD. (UEN 202635650W), registered office: 152 Beach Road, #23-02, Gateway East, Singapore 189721.

Data protection officer: privacy@yinke.ai. General questions: support@yinke.ai.

If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Singapore or, in the EEA, UK or Switzerland, to your local data protection authority.