Legal

Privacy Policy

How we collect, use, disclose and protect personal data, in line with Singapore's Personal Data Protection Act 2012 (PDPA).

Effective 4 November 2026

1. Scope

This policy applies to the tuas.ai website and the Tuas AI Model API (the “Service”). It explains how Tuas AI (“we”, “us”) handles personal data of website visitors, customers and their authorised users.

2. Personal data we collect

  • Contact and account details you give us, such as your name, company, work email and billing details.
  • Service metadata needed to run, bill and secure the Service, such as API key identifiers, request timestamps, model used, token counts, IP addresses and error logs.
  • Correspondence you send us, for example to [email protected] or [email protected].
  • Website connection data handled by Cloudflare, our content delivery and security provider, when you visit the tuas.ai website, such as your IP address, the pages you request and your approximate location.
  • Website usage data collected through Google Analytics and Contentsquare when you visit the tuas.ai website, such as the pages you view, how you move through and interact with them, and your device, browser and approximate location, read and stored using cookies.
  • Website diagnostics collected through Sentry when the website fails, and for a sample of requests to measure performance, such as error details, the page address without its query string, your browser and operating system, and an approximate location.
  • Short-link click statistics we record ourselves when someone follows a tuas.ai/l/ link: the time, the referring page without its query string, browser, operating system, device type and language, a country code where Cloudflare supplies one, and a pseudonymised visitor hash derived from the IP address and browser details. We do not store the raw IP address.

3. Prompts, inputs and outputs

The content you send to the API (prompts, context, files) and the outputs the models return are processed in memory on our own GPU infrastructure in Singapore, only for the duration of the request or session.

  • We do not retain prompt or output content after the session ends.
  • We do not use prompt or output content, or any session data or context, to train or fine-tune any model.
  • We do not sell, share or disclose prompt or output content to model vendors or other third parties.

4. How we use personal data

  • To provide, operate and maintain the Service, and to authenticate users.
  • To calculate usage and bill for it.
  • To detect, investigate and prevent fraud, abuse and security incidents.
  • To respond to enquiries and send service notices.
  • To measure how the website and our short links are used, and to find and fix website errors.
  • To meet our legal and regulatory obligations.

We collect, use and disclose personal data with your consent, or as otherwise permitted or required under the PDPA.

5. Disclosure

We do not sell personal data. We disclose it only to service providers who help us run our business (for example payment processing or email, and on the website Cloudflare for content delivery and security, Google Analytics for usage measurement, Contentsquare for behaviour analytics and Sentry for error diagnostics), under contracts that require them to protect it; or where required by law, court order or a lawful request from a public authority.

6. Where data is processed

Inference runs on hardware owned and operated by Tuas AI in Singapore. If any personal data must be transferred outside Singapore (for example by a service provider), we will make sure it receives a standard of protection comparable to the PDPA.

Cloudflare handles all traffic to the tuas.ai website and may process it, including IP addresses, outside Singapore, under that same protection.

Google Analytics, Contentsquare and Sentry may process website data outside Singapore, under that same protection. These tools run only on the tuas.ai website. They are not part of the API and never see API prompts or outputs, which stay on our own infrastructure in Singapore as described in section 3.

7. Retention

We keep account, billing and service metadata only for as long as we need it for the purposes above, or as the law requires, and then delete or anonymise it. The same applies to website usage data and error diagnostics. Short-link click statistics are deleted automatically 24 months after the click, in batches that run as new clicks are recorded, so some can remain longer during a quiet period. Prompt and output content is not retained after the session.

8. Security

We protect personal data with reasonable administrative, physical and technical safeguards, including access controls, encryption in transit and physical control of our own infrastructure.

9. Cookies and website analytics

This website uses the following tools. None of them are used for advertising, and we do not use advertising cookies.

  • Google Analytics measures how the website is used, such as visits and page views. It uses cookies.
  • Contentsquare provides behaviour analytics, including heatmaps and session recordings of how visitors move through and interact with our pages. It uses cookies.
  • Sentry reports website errors and samples performance so that we can diagnose and fix problems. We configure it not to collect cookies, authorisation headers, IP addresses, query strings or request bodies. Sentry may still record an approximate location, such as country and city, worked out from the connection.
  • Short-link click statistics are stored on our own systems, as described in section 2. Google Analytics and Contentsquare do not load on short links.

To opt out, you can block or delete cookies in your browser settings, including Contentsquare’s, and install Google’s opt-out browser add-on for Google Analytics. You can also withdraw your consent as described in section 10. More about Contentsquare’s handling of data is in its privacy center.

10. Your rights

You may ask to access or correct your personal data, or withdraw your consent to its collection, use or disclosure. Withdrawing consent may mean we can no longer provide the Service to you. Send requests to our Data Protection Officer at [email protected]. We will respond within the time frames set by the PDPA.

11. Data breaches

If a data breach occurs, we will assess it and notify the Personal Data Protection Commission and affected individuals where the PDPA requires.

12. Changes

We may update this policy. The effective date above shows when it last changed.

Who we are

Tuas AI (UEN 202635139W) is a company registered in Singapore. Registered address: 1 Kaki Bukit View, #02-10, Techview, Singapore 415941. Email [email protected] for privacy and data protection matters, or [email protected] to report misuse. We do not offer support by phone.