Privacy Notice

04Legal Basis for Processing

4.1 Under the PDPA

• Consent: Where you have given us consent to process your data (for example, for marketing communications). You may withdraw consent at any time by contacting us at support@quilt.ai.
• Contractual necessity: Where processing is necessary to perform our contract with you (for example, to provide the Services).
• Deemed consent: Where processing is reasonably necessary for the performance of a contract to which you are a party (PDPA Section 15).
• Publicly available data: Where personal data has been made publicly available by the individual, we may collect, use and disclose it without consent in reliance on the exception in the First Schedule to the PDPA, provided the purpose would be considered appropriate by a reasonable person.
• Legitimate interests: Where processing is in our legitimate interests and does not override your fundamental rights (for example, security monitoring, fraud prevention).
• Legal obligation: Where processing is required by law (for example, breach notification, responding to regulatory requests).

4.2 Under the GDPR (where applicable)

Where we process personal data of individuals in the EEA or UK, our legal bases include:

• Contract performance (Article 6(1)(b)): Processing necessary to perform our agreement with you.
• Legitimate interests (Article 6(1)(f)): Processing necessary for our legitimate interests, including operating the Service, security monitoring, and processing publicly available data for analytical purposes. Balancing tests ensure that our interests do not override your rights. You may request information about our balancing tests by contacting us.
• Consent (Article 6(1)(a)): Where you have given specific consent (for example, for marketing). You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): Where processing is required by applicable EU or member state law.

05Who We Share Your Data With

We share personal data only where necessary and with appropriate safeguards. Our principal third-party service providers are:

We may also share personal data with:

• Our professional advisors (including lawyers and auditors) under obligations of confidentiality
• Government authorities or law enforcement where required by law or to protect our legal rights
• A prospective purchaser in the event of a sale, merger or reorganisation of our business (under confidentiality obligations)

06International Data Transfers

Quilt.AI operates from Singapore, with offices and service providers in the United States, the United Kingdom, and India. Your personal data may be transferred to and processed in these jurisdictions.

Under the PDPA, we ensure that recipients in other jurisdictions provide a comparable standard of data protection, or that the transfer is covered by contractual arrangements with equivalent safeguards (PDPA Section 26).

Where we transfer personal data out of the EEA, we rely on appropriate safeguards including Standard Contractual Clauses approved by the European Commission. For transfers out of the United Kingdom, we rely on the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, as applicable.

07How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. You may request earlier deletion of your data at any time. Our default retention periods are as follows.

Where a category of data is not listed above, we apply a maximum retention period of three years. You may request earlier deletion of your data at any time (see Section 9).

08How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS) and at rest
• Access controls limiting data access to authorised personnel on a need-to-know basis
• Regular vulnerability scanning and penetration testing
• Security monitoring and incident detection
• Security awareness training for all staff

We are committed to protecting your data using industry-standard measures.

09Your Rights

9.1 Under the PDPA

You have the following rights under the PDPA:

• Access: Request a copy of the personal data we hold about you (Section 21).
• Correction: Request correction of any inaccurate or incomplete personal data (Section 22).
• Withdrawal of consent: Withdraw your consent for any processing based on consent. We will inform you of the likely consequences of withdrawal (Section 16).
• Data portability: Request a copy of your data in a commonly used machine-readable format, or request that we transmit it to another organisation where technically feasible (Sections 26F–26H).

9.2 Under the GDPR (where applicable)

If you are in the EEA or UK, you additionally have the right to:

• Erasure: Request deletion of your personal data in certain circumstances.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Object: Object to processing based on our legitimate interests, including for direct marketing purposes. You have an absolute right to opt out of direct marketing at any time.

9.3 Limits on These Rights

These rights may be limited in certain circumstances — for example, where fulfilling your request would reveal personal data about another individual, would infringe the rights of a third party, or where you ask us to delete information that we are required by law to retain or that we need in order to establish, exercise or defend a legal claim. Relevant exemptions are set out in applicable law, including the PDPA and the GDPR. Where we rely on an exemption, we will tell you which one when we respond to your request.

In particular, when you ask us to delete your data, records held by our payment processor for tax and accounting purposes will be retained for the period required by law, even after your account data has been deleted from our systems.

9.4 How to Exercise Your Rights

To exercise any of these rights, email our Data Protection Officer at angad@quilt.ai with support@quilt.ai on cc. Please provide evidence of your identity and details of your request. We will respond within 30 days. If we need more time (up to an additional 30 days for complex requests), we will let you know.

If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore (www.pdpc.gov.sg), or if applicable, the data protection authority in your jurisdiction.

10Data Breach Notification

In the event of a data breach that is likely to result in significant harm to affected individuals or is of a significant scale, we will notify the Personal Data Protection Commission and affected individuals as required by the PDPA. Where applicable, we will also notify the relevant supervisory authority under the GDPR.

11Cookies and Similar Technologies

We use cookies and similar technologies to recognise your browser, remember your preferences and understand how you use our Website. You can control cookies through your browser settings. Disabling cookies may affect some Website functionality but will not prevent you from using the Service.

For details on the specific cookies we use, please see our Cookie Notice.

12Artificial Intelligence and Automated Processing

Quilt.AI uses artificial intelligence and machine learning to provide its analytical services. This section explains how AI is used in relation to your data:

• Client Data: When you upload data to the Service, it may be processed using AI models for trend analysis, discourse analysis, consumer segmentation and similar purposes. The results are presented to you through the user interface.
• No model training: We do not use your Client Data to train, fine-tune or improve AI models. Your data is processed for analysis only and is not retained in any model.
• Publicly sourced data: Publicly available data is processed through AI models for market analysis and trend identification. Personal data is de-identified in aggregate outputs where practical.
• Human oversight: AI-generated outputs are subject to human review. Automated decisions that would have a significant effect on individuals are not made without human involvement.
• Third-party AI services: We use third-party AI services (including cloud-hosted models) to process data. We select providers whose terms prohibit the use of customer data for model training, and we contract on terms containing such prohibitions where those terms are available.

13Publicly Sourced Data — Additional Information

Because Quilt.AI collects and analyses data that individuals have made publicly available, we want to be transparent about how this works:

• What we collect: Public posts, comments, reviews, profile information and similar content that individuals have chosen to make publicly visible on social media platforms, review sites and other public sources.
• How we collect it: Through platform APIs and data aggregators, in compliance with each platform's terms of service. We do not scrape private or restricted content, circumvent access controls, or create fake accounts.
• Why we collect it: To provide market analysis, trend identification and brand monitoring services to our customers through the Services. Publicly sourced data is not used for direct marketing to the individuals whose data is collected, or for building individual profiles unrelated to our analytical services.
• Your rights: Even though this data was publicly available when collected, your rights under the PDPA and GDPR (where applicable) still apply. If you would like to request access to, correction of, or deletion of your data from our systems, please contact us at support@quilt.ai. We will respond within 30 days.
• Embedded content: Where publicly sourced content is displayed within the Services, we use official embed mechanisms provided by the originating platform. If the original author removes their post, the embedded content is automatically removed from the Services.

14YouTube Data API

The Service uses the YouTube Data API to collect publicly available YouTube content for analysis. This section provides the specific disclosures required by the YouTube API Services Terms of Service.

• What YouTube data we access: We access public YouTube search results, video metadata (titles, descriptions, view counts, publish dates, channel information) and public comments via the YouTube Data API. We do not access private videos, unlisted content, or any data that requires user authentication.
• How we use it: YouTube data is used to provide trend analysis, discourse analysis and market research services to our customers through the Services. We do not use YouTube data for advertising purposes. We do not use YouTube data to train AI models.
• Storage and retention: YouTube API data is stored for as long as necessary to provide the analytical service, with a maximum retention period of 3 years (Section 7). You may request deletion of any YouTube-sourced data relating to you by contacting us at support@quilt.ai.
• Sharing: YouTube API data may be presented to our customers in aggregated or analytical form. We do not sell YouTube API data or share it with third parties for their independent use.

Our use of the YouTube Data API is subject to the YouTube API Services Terms of Service and Google's Privacy Policy. By using features of the Service that incorporate YouTube data, you also agree to be bound by the YouTube Terms of Service.

15Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly. If you believe a child has provided us with their personal data, please contact us at support@quilt.ai.

16Changes to This Notice

We may update this notice from time to time. When we make material changes, we will notify you by email or through a notice on the Service prior to the change becoming effective. The "Last Updated" date at the top of this notice indicates when it was most recently revised.

We encourage you to review this notice periodically. Your continued use of the Service after the updated notice takes effect constitutes your acknowledgement of the changes.

17Contact Us

If you have questions about this privacy notice, wish to exercise your data protection rights, or have a complaint about how we handle your personal data, please contact us:

You also have the right to lodge a complaint with the Personal Data Protection Commission of Singapore (www.pdpc.gov.sg) or, where applicable, the supervisory authority in your jurisdiction.