Peekai - Peekai Privacy Policy

1. About This Policy

This Privacy Policy ("Policy") describes how BEUSABLE PTE. LTD. ("Peekai", "we", "us"), incorporated in Singapore, collects, uses, discloses, retains, and protects personal data in the course of operating the Peekai AI platform, API, mobile app, and related services (collectively, the "Service").

This Policy is primarily governed by Singapore's Personal Data Protection Act (PDPA) 2012 and PDPC guidelines. For residents of the European Economic Area (EEA) and the United Kingdom, the GDPR additionally applies.

Our Korean affiliate, 4Grit Co., Ltd. (사업자등록번호: 287-87-00326), provides technical and operational support and maintains a separate Korean privacy policy for Korean services.

2. Scope

Applies to:

• All users, developers, enterprise customers, and visitors using the Service

• All personal data collected on the Peekai platform (web, mobile, API)

• All communications with us (support requests, feedback, in-app messages, etc.)

Does not apply to:

• Third-party services connected to our Service (each governed by their own policy)

• Services provided by 4Grit Co., Ltd. within Korea (governed by a separate Korean policy)

• Anonymized or aggregated data from which individuals cannot be identified

3. Key Definitions

Personal Data: Any data that, alone or in combination with other information, can identify an individual (as defined under the PDPA).

Sensitive Data: Information requiring stricter protection, including health and medical information, financial account details, biometric data, race or ethnicity, religious beliefs, and data relating to children.

Client Data: All data submitted when using the Service — prompts, files, images, text, and other inputs used with AI features.

Usage Data: Non-personal or pseudonymized data automatically collected during use of the Service, including API logs, session data, and device information.

DPO: Data Protection Officer. Reachable at peekai@peekai.us.

PDPC: Personal Data Protection Commission of Singapore.

4. Personal Data We Collect

4.1 Information You Provide Directly

• Account information: Full name, email address, company name, phone number, password

• Payment information: Credit card number and billing address (processed by third-party payment processors such as Stripe; Peekai does not store this directly)

• Communications: Support requests, feedback, survey responses

• AI input content: Prompts, text, files, images, audio

• Optional information: Profile photo, preferences and settings

4.2 Automatically Collected Information

• Usage logs: Time of access

4.3 Information from Third Parties

• Partners and resellers: Account information provided by authorized resellers or enterprise customers

5. Purposes of Collection and Legal Bases

5.1 Service Provision (Contract Performance)

• Account creation, management, and identity verification

• Providing AI features (response generation, content analysis, prompt processing)

• Payment processing, invoicing, and fraud prevention

• Sending service-related notifications (account updates, security alerts)

• Customer support and complaint handling

5.2 Legitimate Interests

• Improving service performance and stability, and developing new features

• Detecting and preventing fraud, unauthorized access, and security threats

• Internal analytics and research for usage pattern analysis

• Enforcing terms of service and protecting legal rights

5.3 Consent-Based Processing

• AI model improvement using anonymized and aggregated input/output data (opt-out available)

• Marketing communications and newsletter delivery (with opt-in consent)

5.4 Legal Compliance

• Responding to court orders and legal requests

• Meeting tax, accounting, and anti-fraud obligations

• Cooperating with regulatory authorities such as the PDPC

6. AI Data Use (Important Notice)

As an AI-based service, Peekai processes your Client Data to generate responses and, at your election, may use it to improve AI models. AI-generated content may be inaccurate or biased and does not substitute for professional advice in legal, financial, medical, or other fields. You are responsible for verifying any content.

• Default use: Input and AI output data may be used to improve Peekai's AI models, but only after being anonymized or aggregated so that individuals cannot be identified.

• Right to opt out: You may refuse the use of your data for AI model training at any time by contacting peekai@peekai.us. Opting out will not affect service quality.

• Prohibition on submitting sensitive data: Do not submit sensitive data — such as medical records, financial account numbers, or biometric data — to the Service without appropriate consent and authorization.

• Your responsibility: You are responsible for ensuring the lawfulness of data you submit, obtaining any required third-party consents, and not infringing third-party rights.

7. Cookies and Tracking Technologies

• Essential cookies: Required for login authentication and security. Cannot be disabled.

• Functional cookies: Remember language and other preferences.

8. Disclosure to Third Parties

We do not sell your personal data. We share it with third parties only in the following circumstances and only within the scope of the purposes described in this Policy.

8.1 Service Providers (Data Processors)

• Cloud infrastructure: AWS

• Payment processing: Stripe Inc.

8.2 Affiliate — 4Grit Co., Ltd.

We may share data with our Korean affiliate, 4Grit Co., Ltd., for the purpose of technical maintenance and customer service support. This is done under a data sharing agreement that complies with PDPA cross-border transfer requirements.

8.3 Legal Authorities / Corporate Transfers / Consent-Based Sharing

• Disclosure to government or judicial authorities where required by law, court order, or regulatory request

• Transfer to the relevant acquiring entity in the event of a merger, acquisition, or asset sale (with advance notice)

• Sharing with other third parties where explicit consent has been obtained

9. Cross-Border Transfers of Personal Data

Your personal data may be transferred to, stored in, or processed in countries outside Singapore, including the United States, EU member states, and Korea. Transfers are made only where protection equivalent to the PDPA standard is ensured through one or more of the following mechanisms, as required under Article 26 of the PDPA.

• PDPC international transfer standard contractual clauses (Model Clauses)

• Standard Contractual Clauses (SCC) approved by the European Commission — for data originating from the EEA

• Transfer to a country that has received an adequacy decision

• Your explicit consent

For information about the safeguards applied to cross-border transfers, please contact peekai@peekai.us.

10. Data Security

• Encryption in transit: HTTPS / TLS 1.2 or higher

• Encryption at rest: bcrypt encryption (passwords)

• Access control: Role-Based Access Control (RBAC)

• Security monitoring: Cloud-based intrusion detection, anomaly detection

• Staff training: Annual information security and privacy training

• Penetration testing: Periodic third-party penetration testing

In the event of a personal data breach, we will notify the PDPC and affected users within 3 business days of becoming aware of a notifiable breach, in accordance with Article 26D of the PDPA (within 72 hours where GDPR applies).

11. Data Retention

• Account information: Until account deletion

• Client Data (AI input/output): For the period necessary to provide the Service, or until your request

• Usage data and logs: For the period necessary to provide the Service, or until your request

• Payment records: 7 years, in accordance with IRAS (Inland Revenue Authority of Singapore) guidelines

• Marketing data: Until consent is withdrawn or you unsubscribe

12. Rights of Data Subjects

12.1 Rights Under the PDPA (Singapore)

• Right of access: Request access to personal data held about you and records of use and disclosure over the past year

• Right to correction: Request correction of inaccurate or incomplete personal data

• Right to withdraw consent: Withdraw consent to the collection, use, or disclosure of your personal data at any time

• Right to data portability (effective 1 September 2021): Request transfer of your personal data in a machine-readable format

12.2 Additional Rights Under GDPR (EEA and UK Users)

• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal exceptions

• Right to restriction of processing: Request restriction of processing in certain circumstances

• Right to object: Object to processing based on legitimate interests or for direct marketing purposes

• Right to object to automated decision-making: Request human review of automated processing, including profiling

• Right to lodge a complaint: File a complaint with the competent data protection authority in the event of a violation

12.3 How to Exercise Your Rights

Submit a written request by email to peekai@peekai.us (subject line: "Data Subject Rights Request — [Your Name]"). Requests will be processed after identity verification. No fee is generally charged for access or correction requests, although a reasonable administrative fee may apply to requests that are manifestly unfounded or repetitive.

• PDPA: Response within 30 days (extendable by 30 days for complex requests)

• GDPR: Response within 30 days (extendable to 60 days with prior notice)

13. Protection of Children's Personal Data

The Service is not directed at individuals under the age of 18 ("minors"). We do not knowingly collect personal data from minors. If we become aware that personal data has been collected from a minor, we will immediately delete such data and terminate the account. Parents or guardians may notify us at peekai@peekai.us.

14. Third-Party Services and Links

The Service may integrate with or contain links to third-party services, APIs, or platforms. When you use a third-party service, that service's own policy applies. Peekai is not responsible for the personal data practices of third parties.

15. Singapore PDPA — Special Provisions

• Purpose limitation: Where personal data is to be used for a new purpose not previously notified, we will obtain fresh consent.

• Consent obligation: Consent is obtained at or before the time of collection, except where an exemption under the Second or Third Schedule of the PDPA applies.

• Accuracy obligation: We take reasonable steps to ensure that personal data is accurate and complete for the purposes for which it is used.

• Do Not Call (DNC) registry: We do not send marketing communications to Singapore telephone numbers registered on the DNC registry unless permitted by law or explicit consent has been obtained.

• Mandatory breach notification: In the event of a breach with potential for significant harm, we will notify the PDPC and affected users within 3 business days.

16. GDPR — EEA and UK Special Provisions

Where Peekai processes personal data of individuals located in the EEA or the United Kingdom, it does so as a data controller on the following legal bases.

• Performance of a contract (Art. 6(1)(b)): Processing necessary to perform the service agreement

• Legitimate interests (Art. 6(1)(f)): Service improvement, security, and fraud prevention

• Consent (Art. 6(1)(a)): AI model improvement, marketing communications

• Legal obligation (Art. 6(1)(c)): Compliance with applicable laws and regulatory requests

17. Changes to This Policy

• Minor changes: Take effect upon posting (e.g., typo corrections, clarifications)

• Material changes: Where the manner in which personal data is collected, used, or shared changes, at least 14 days' advance notice will be provided by email or in-app announcement

Continued use of the Service after a revised Policy takes effect constitutes acceptance of the changes.

18. Contact Us

• Data Protection Officer (DPO): biz@peekai.us

• General support: peekai@peekai.us

• Company: BEUSABLE PTE. LTD.

• Registered address: 111 Somerset Road, #06-07B, 111 Somerset, Singapore 238164

• Korean affiliate: 4Grit Co., Ltd. | Business Registration No.: 287-87-00326 | Room 1100, 136 Pangyoyeok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Korea

We aim to provide an initial response to all inquiries within 5 business days. If you are not satisfied with our response, you may file a complaint with the PDPC at pdpc.gov.sg.

BEUSABLE PTE. LTD. · Singapore