Last updated: 22 October 2026
AI Smart Solutions LLP (“AI Smart Solutions”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data in accordance with the Singapore Personal Data Protection Act 2012 (“PDPA”) and other applicable laws.
This Privacy Policy explains how we collect, use, disclose, protect and retain personal data when you visit our website, contact us, participate in our referral programme, purchase our products or engage us to provide services.
Different arrangements may apply depending on the nature of a service. Where you engage us for AI ORCA™ or other business services under a separate service agreement, that agreement and its Data Privacy & Security Schedule govern the detailed processing arrangements for that engagement. This Privacy Policy describes our general practices and should be read together with those documents where applicable.
The personal data we collect depends on your interactions with us and the services involved.
When you submit a contact form, email us or otherwise communicate with us, we may collect information you choose to provide, such as your name, email address, telephone number, company details and the content of your enquiry or communication.
If you purchase a product, attend a course, participate in our referral programme or engage us to provide services, we may collect information reasonably necessary to administer that relationship. This may include contact details, company information, transaction and payment records, service requirements, correspondence and referral information.
Payment information may be processed directly by the relevant payment provider. We do not intentionally collect or retain complete payment-card details where these are processed directly by that provider.
If you engage us for AI ORCA™ or other business automation services, we may access or process business information and personal data as agreed with you. Depending on the configuration, this may include:
We seek to limit access to information reasonably necessary for the agreed services. The exact data and systems involved depend on the engagement and are documented, where applicable, in the relevant service agreement and Data Privacy & Security Schedule.
Where call recording and transcription are expressly included in an AI ORCA™ engagement, a third-party meeting-recording and transcription service may process call audio, recordings, transcripts, summaries, meeting details, participant names and contact details, and information shared during the call.
Calls may contain personal data relating to people other than our direct client. The client is responsible for determining whether a call may lawfully be recorded and transcribed and for providing any required notices and obtaining any consent or other authorisation required by applicable law, professional obligations or confidentiality requirements.
When you visit our website, technical information may be collected through server logs, cookies or similar technologies. This may include your IP address, browser type, device information, pages visited, referring pages and information about how you interact with the website. The information collected depends on the technologies actually enabled on the website.
We may use personal data for the following purposes:
We collect, use and disclose personal data only for purposes that are appropriate in the circumstances and in accordance with applicable legal requirements.
AI ORCA™ may use third-party AI models and software to perform the tasks agreed with a client. The information processed depends on the automation, the connected systems and the instructions given by the client.
When processing personal data on behalf of a client and for the client's purposes, we handle that information in accordance with the applicable service agreement and Data Privacy & Security Schedule. We may also process certain information for our own purposes, such as administering our business relationship, billing, complying with legal obligations or securing our services. The applicable roles and purposes depend on the circumstances.
We do not sell client data or use client personal data to train our own general-purpose AI models. We will not opt in to or enable the use of client personal data to train general-purpose AI models through third-party AI services without the client's prior written authorisation.
Third-party providers may process or retain submitted information for service delivery, security, abuse prevention or other purposes under their applicable terms and privacy documentation. We configure and use such services in accordance with the applicable commercial and privacy settings. We cannot promise that every third-party provider will immediately delete every copy of information it has processed.
AI-generated outputs may be inaccurate, incomplete or inappropriate and may require review. The client remains responsible for decisions made using such outputs and for determining whether the use of personal data and resulting outputs is appropriate and lawful for its business.
Call recording and transcription are optional and are used only where included in the agreed service configuration.
Where these services are provided, we may set up or administer a meeting-recording account in the client's name or company's name. We may access recordings, transcripts and related information only to the extent reasonably necessary to administer, operate, maintain, troubleshoot or support the agreed services, or as otherwise expressly instructed by the client.
The client is responsible for determining which calls may be recorded and transcribed, and for ensuring that required notices, consents or other authorisations are in place. The client must not enable recording where it is prohibited by applicable law, professional obligations, confidentiality requirements or the relevant provider's terms.
As between AI Smart Solutions and the client, recordings, transcripts and summaries generated from the client's calls form part of the client's data, subject to applicable third-party terms and the rights of individuals whose information is included.
Recordings and transcripts may be processed or stored by the third-party provider in countries specified in that provider's documentation. The use of a dedicated client server does not mean that all recording, transcription or AI processing takes place on that server or in Singapore.
We do not sell or rent personal data to third parties.
We may disclose personal data or provide access to it where reasonably necessary for the purposes described in this Policy, including to:
We seek to limit the personal data shared with service providers to what is reasonably necessary for the relevant purpose. Where a provider processes personal data on our behalf, we take reasonable steps to ensure that appropriate safeguards are in place.
The actual third-party services used for an AI ORCA™ engagement are identified in the relevant service documentation, including the Data Privacy & Security Schedule or other applicable sub-processor information.
Third-party providers may also process information under their own terms, privacy policies and data-processing arrangements. We do not control every aspect of a provider's independent processing, retention or security practices.
Some service providers may store or process personal data outside Singapore. The countries involved depend on the provider, service, configuration and applicable terms, and may include countries where the provider or its infrastructure is located.
Where the PDPA requires safeguards for an overseas transfer of personal data, we will take the steps required to ensure that the transferred personal data receives a standard of protection comparable to that required under the PDPA.
A dedicated client virtual private server does not necessarily mean that all personal data remains in Singapore. Data may be transmitted to or processed by third-party AI, meeting, messaging or other connected services in accordance with the applicable service configuration.
We take reasonable administrative, technical and organisational measures to protect personal data in our possession or under our control against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.
Depending on the services involved, safeguards may include access controls, restricted administrative access, authentication, secure handling of credentials and API keys, separation of client application environments, separate application databases and credentials, and measures to monitor and respond to operational or security failures.
For AI ORCA™ services, each client's production application environment is hosted on a separate virtual private server allocated to that client, with separate application databases and application credentials. This is logical and virtual separation; it does not mean that every underlying physical infrastructure component is dedicated exclusively to one client.
Operational failure alerts may be sent to the client and AI Smart Solutions. We aim to limit alerts to information needed to identify and address the failure rather than including client business content or personal data unnecessarily.
No method of electronic storage or transmission can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.
We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected or for other legitimate legal or business purposes. When information is no longer required, we take reasonable steps to delete, destroy or anonymise it, where appropriate.
For AI ORCA™ engagements, the applicable service agreement and Data Privacy & Security Schedule set out the relevant retention and deletion arrangements. Subject to those terms, we generally delete client data held directly under our control, including data on the client's dedicated application environment and temporary local build copies, within 30 days after the engagement ends.
Where backups or snapshots are enabled, they will be deleted within 60 days after the engagement ends. Data in backups may remain until the relevant backup retention cycle permits deletion, and will be protected during that period. We may retain information where required by law or as otherwise permitted under the applicable service agreement.
Data held by third-party providers, including recordings, transcripts and data processed by AI services, is subject to the providers' deletion mechanisms, retention requirements and technical limitations. Where appropriate and technically available, we will request or initiate deletion, but cannot guarantee immediate deletion of all copies held by a third-party provider.
Where a client requests transition or handover before termination, the timing and scope of data return, deletion and any continuing third-party service costs will be handled under the applicable service agreement.
Subject to the PDPA and applicable exceptions, you may contact us to request access to personal data that we hold about you or to request correction of personal data that you believe is inaccurate or incomplete.
We may need to verify your identity and obtain additional information before processing a request. We will respond in accordance with applicable legal requirements.
If your personal data was provided to us by one of our clients in connection with services we provide on that client's behalf, we may need to refer your request to the relevant client or work with that client to respond, depending on our respective roles and applicable legal requirements.
Requests concerning call recordings or transcripts may need to be directed to the client who arranged the call recording, the relevant provider or us, depending on who controls the information and the nature of the request.
If we become aware of a security incident involving personal data, we will assess and manage it in accordance with our procedures and applicable legal requirements.
Where an incident involves personal data processed for an AI ORCA™ client, we will follow the incident notification and assistance arrangements in the applicable service agreement and Data Privacy & Security Schedule. This may include investigating the incident, restricting or revoking access, taking reasonable containment measures and notifying the client without undue delay where required by the contract or applicable law.
Notification to a client does not replace any separate notification obligations that may apply to the client or to us under the PDPA.
Our website may use cookies and similar technologies for website functionality, security, analytics and understanding how visitors use the website.
These technologies may collect technical or usage information such as browser type, device information, IP address and pages visited. The information collected depends on how the website and its analytics tools are configured.
You can control or disable cookies through your browser settings, although doing so may affect some website functionality. Where required by law, we will provide any applicable notice or choice relating to cookies or similar technologies.
We use YouTube API Services to manage comments on our own YouTube channel. Through a tool called AI ORCA™ Comments, which is used by the owner of the channel, we read comments that viewers post on our videos and post replies from our own channel account.
We access comments on our own channel's videos, including the comment text, the commenter's public display name, and the date and video on which the comment was posted. We do not use this tool to access your Google account, private information, watch history or data belonging to other channels.
We use comments to reply to them and, where a comment shows a genuine business enquiry, to follow up with the person. The comment text may be processed by Google Gemini to help draft a reply. We do not use YouTube data to train an artificial intelligence model.
Our use of information received from YouTube APIs is subject to applicable YouTube terms and policies. You can manage your Google account permissions through the relevant Google security settings. You can review Google's Privacy Policy at https://policies.google.com/privacy and manage or revoke third-party access to your Google Account through Google's security settings at https://security.google.com/settings/security/permissions. If you revoke access or request deletion of information associated with your use of our YouTube API Services, we will handle the request in accordance with the applicable YouTube API Services policies. We will delete information subject to those policies within the applicable required time limits.
We may record and transcribe our own Business Optimization Consultations, Business Optimization Blueprint sessions and other business meetings using Fireflies or another AI-assisted recording and transcription service.
We use these recordings and transcripts to prepare meeting notes, summaries and action items; maintain internal task lists and daily summaries; follow up on enquiries and agreed actions; and maintain appropriate business records.
Recordings and transcripts may contain personal data, including participants' names, voices, opinions and other information shared during a meeting. They may be processed by the relevant recording, transcription, cloud hosting and AI service providers in accordance with their applicable terms and privacy documentation. Depending on the provider and its configuration, personal data may be processed or stored outside Singapore. Where required under Singapore's Personal Data Protection Act 2012 (PDPA), we take steps to ensure that personal data transferred overseas receives a standard of protection comparable to that required under the PDPA.
We limit access to recordings and transcripts to what is reasonably necessary for the purposes described above. We do not use them to train our own general-purpose AI models.
We retain recordings and transcripts only for as long as reasonably necessary for these purposes, taking account of operational needs, applicable legal requirements and any relevant disputes. Where appropriate, we may delete recordings while retaining limited meeting notes, action items or business records needed for follow-up or record-keeping.
Where a meeting is to be recorded, we will inform participants before recording begins and obtain consent where required by applicable law. Participants may raise questions or concerns about recording before the meeting begins. Where reasonably practicable, we will discuss alternative arrangements if a participant objects to recording.
If you subscribe to our newsletter, we collect the name and email address you provide so that we can manage your subscription and send you our newsletter.
We use Brevo to manage subscriber information and distribute newsletter emails. Brevo may process or store personal data in accordance with its applicable terms and privacy documentation.
You may unsubscribe at any time using the unsubscribe link included in our emails. We will stop sending newsletter emails after your request has been processed. We may retain limited information where reasonably necessary to record your unsubscribe preference, prevent further unwanted emails or comply with legal requirements.
Where personal data is transferred outside Singapore, we take the steps required under the PDPA to ensure that it receives a standard of protection comparable to that required under the PDPA.
We may review comments and messages posted on our business social media and messaging channels, including Instagram and Telegram, to respond to enquiries and manage our business communications.
Where a comment or message appears to be a genuine business enquiry, we may record relevant information, such as the message, the account's public name or username, the date and relevant context, in our business task lists or customer relationship records so that we can follow up.
We use this information to respond to enquiries, manage business communications and maintain appropriate follow-up records. Where AI tools are used to help classify enquiries, summarize messages or draft responses, relevant message content may be processed by the applicable AI or software provider.
We aim to limit the information recorded to what is reasonably necessary for these purposes. We do not use this information to train our own general-purpose AI models. Instagram, Telegram and any relevant AI or software providers may process information under their own terms and privacy documentation.
If you participate in our “Awesome Introductions” referral programme, we may collect the information you provide through the referral form, including your contact details, the referred business's details and information necessary to assess eligibility, administer referrals and calculate or pay referral fees.
You must ensure that you are authorised to provide another person's business contact details to us. We handle personal data received through the programme in accordance with this Privacy Policy and applicable law. The programme's terms are published on our website under Terms & Conditions.
If you have questions about this Privacy Policy, wish to make a request concerning personal data, or have concerns about how we handle personal data, please contact: [email protected]
You may also contact us through the contact form on our website: https://ai-smart.solutions/
Please provide enough information for us to understand and respond to your enquiry. Do not include passwords, API keys or other sensitive credentials in your request.
We may update this Privacy Policy from time to time to reflect changes to our business, services, technology or applicable legal requirements. The latest version will be published on our website with the applicable “Last updated” date.
Changes to this Privacy Policy do not, by themselves, amend the terms of a separate signed service agreement.