Privacy Policy

1. Who we are

This policy is issued by Vitall Pte Ltd ("Vitall", "we", "us"), a company incorporated in Singapore with Unique Entity Number 202501111C, registered office at 7 Temasek Boulevard #12-07 Suntec Tower One, Singapore 038987.

We are the organisation responsible for the personal data described in this policy under Singapore's Personal Data Protection Act 2012 ("PDPA"). Where data protection laws of other jurisdictions apply, we act as the data controller.

2. Scope

This policy applies to personal data we collect through:

• our website at vitall.ai and its subdomains;
• email, phone and in-person contact with us;
• our official pages and accounts on Meta platforms (Facebook, Instagram, WhatsApp) and other social or messaging platforms, including any business messaging we conduct through them;
• our commercial relationships with clients, prospective clients, suppliers and partners.

It does not cover data processed inside AI or robotics systems we build under contract for a client. That processing is governed by the contract with, and the privacy policy of, that client.

3. Data we collect

3.1 Data you give us

• Contact details — name, email address, phone number, company, job title.
• Correspondence — the content of messages you send us by email, through a contact form, or through a messaging platform such as WhatsApp or Facebook Messenger, together with the date and time.
• Commercial information — details needed to scope, quote, contract and deliver a project, and to invoice and pay.

3.2 Data collected automatically

• Server logs — when you visit vitall.ai our web server records your IP address, browser type, requested page, referring page and timestamp. These logs are used only for security and to keep the site running.
• Platform data — when you interact with our pages on Meta platforms, Meta provides us with the information its own policies allow, such as your public profile name, handle and the content of your interaction with our page. Meta's collection is governed by Meta's privacy policy, not this one.

3.3 Data we do not collect

The vitall.ai website does not use advertising trackers, does not run analytics, and does not set cookies of its own. We do not collect payment card data on the website.

4. How we use it

• to respond to enquiries and communicate with you;
• to scope, propose, contract, deliver and support projects;
• to invoice, collect payment and keep accounting records;
• to operate, secure and improve our website and accounts;
• to comply with legal, regulatory and audit obligations;
• with your consent, to send you information about our services. You can withdraw that consent at any time.

We do not sell personal data and we do not use it for automated decisions that have legal or similarly significant effects on you.

5. Legal basis

Under the PDPA we collect, use and disclose personal data with your consent, including consent that is deemed given when you voluntarily provide data for a purpose that is reasonable in the circumstances (for example, emailing us to ask about a project). We also rely on the PDPA's legitimate interests and business improvement exceptions where they apply, and on legal obligations where the law requires us to keep records.

Where the GDPR or UK GDPR applies, our legal bases are performance of a contract, our legitimate interests in running and promoting our business, compliance with legal obligations, and consent where we ask for it.

6. Cookies and third-party services

vitall.ai sets no cookies. The site loads web fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When your browser fetches these fonts, Google receives your IP address and browser details. Google's handling of that data is described in Google's privacy policy.

If we add analytics, embedded media or other third-party services in future, we will update this section and, where required, ask for your consent first.

7. Who we share it with

• Service providers that host our website, email and business systems, acting on our instructions and under contract.
• Platform operators such as Meta, when you choose to contact us through their services. They process the data under their own terms.
• Professional advisers — accountants, auditors, lawyers and insurers, where needed.
• Authorities where we are legally required to disclose, or to protect our rights, property or safety.
• A successor if we merge with, are acquired by or transfer our business to another organisation.

8. International transfers

Our service providers may store or process data outside Singapore. When we transfer personal data overseas we take steps required by the PDPA to ensure the recipient provides a standard of protection comparable to the PDPA, such as contractual obligations.

9. Retention

We keep personal data only as long as it is needed for the purposes above or as required by law. As a guide: enquiry correspondence for up to 2 years after our last contact; contract, invoice and accounting records for 5 years after the end of the financial year to which they relate, as required by Singapore law; server logs for up to 90 days. When data is no longer needed we delete it or anonymise it.

10. Security

We protect personal data with reasonable technical and organisational measures appropriate to its sensitivity, including access controls, encrypted transport, and limiting access to staff who need it. No system is perfectly secure; if a breach affecting you is likely to cause significant harm, we will notify you and the Personal Data Protection Commission as the PDPA requires.

11. Your rights

Under the PDPA you may ask us for access to the personal data we hold about you and how we have used or disclosed it in the past year, ask us to correct an error or omission, and withdraw any consent you have given. Depending on where you live you may have further rights, such as erasure, restriction, portability and objection, and the right to complain to a supervisory authority.

To exercise any right, contact us using the details in section 15. We will respond within 30 days. We may need to verify your identity before acting on a request.

12. Data deletion requests

You can ask us to delete the personal data we hold about you, including data obtained through a Meta platform, at any time:

1. Email hi@vitall.ai with the subject line "Data deletion request".
2. Tell us the email address, phone number or platform account you used to contact us, so we can find your records.
3. We will confirm receipt, verify the request, delete the data within 30 days, and confirm when it is done.

We may retain limited data where the law requires it (for example invoices) or where it is needed to establish or defend legal claims. We will tell you if that applies.

13. Children

Our services are for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes

We may update this policy from time to time. The effective date and version at the top of this page show the current version. Material changes will be announced on this page before they take effect.

15. Contact and Data Protection Officer

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.