Privacy Policy

AlphaTok Singapore Pte. Ltd. ("we", "us", "our") operates Globiz, an agentic CRM and marketing growth workspace. This Policy explains how we collect, use, store, share, and protect your personal data.

PDPA 2012 CAN-SPAM Aware GDPR-Aligned Singapore Law B2B + Consumer

Privacy at a Glance — Full details follow in each section below
What we collect	Account details, CRM/contact data you import, usage logs, payment metadata, AI interaction logs, and device identifiers.
Why we collect it	To provide and improve the Service, process payments, send you product updates, comply with law, and protect against fraud and abuse.
Who we share with	Cloud infrastructure providers, payment processors, AI model providers (Anthropic, OpenAI, Google), and social platform APIs — only to the extent needed to deliver the Service.
Your data, your control	You can access, correct, export, or delete your data at any time. CRM contact data belongs to you. We do not sell personal data.
Retention	Account data is held while your account is active plus 30 days post-termination. Legal obligations may require longer retention of financial records (up to 7 years).
Legal basis	Consent, contractual necessity, legitimate interests, and legal obligation — detailed in Section 8.
Contact	sgalphatok@gmail.com — subject line "Privacy Request"

1Policy Overview

Globiz is an Electron-based desktop application that helps B2B teams discover target customers, plan and execute outreach campaigns, capture engagement signals, and progress deals through AI-assisted workflows. In delivering these capabilities, we necessarily handle personal data — both yours as a user and data about the business contacts you manage within the platform.

This Privacy Policy applies to all data processing activities carried out by AlphaTok Singapore Pte. Ltd. in connection with the Globiz desktop application, our website, and any APIs or integrations we offer. It is written to comply with the Singapore Personal Data Protection Act 2012 (PDPA) and, where applicable, to align with the principles of the EU/UK General Data Protection Regulation (GDPR) and the United States CAN-SPAM Act.

We do not sell your personal data. We do not sell, rent, or trade personal data to data brokers, advertisers, or other third parties for their own marketing use.

2Scope & Application

This Policy applies to:

Registered users of the Globiz desktop application, whether on a free trial, paid subscription, or enterprise plan;
Business contacts whose personal data is imported or generated within the platform by Globiz users;
Visitors to our website and marketing pages; and
Prospective customers who contact us about our products.

This Policy does not apply to the privacy practices of third-party platforms integrated with Globiz (e.g., LinkedIn, Twitter/X, WhatsApp). Those platforms have their own privacy policies, which you should review independently.

Note for EU/UK users: Where you access Globiz from within the European Economic Area or United Kingdom, we apply GDPR-equivalent protections in addition to our PDPA obligations. The relevant lawful bases and your enhanced rights are detailed in Section 8 and Section 13.

3Our Role as Data Controller and Data Processor

When we are the Data Controller

We act as the data controller for personal data we collect directly from you — such as your account registration details, billing information, usage analytics, and customer support communications. We determine the purposes and means of processing this data.

When we are the Data Processor

We act as a data processor for the personal data of third-party contacts (leads, customers, prospects) that you import or create within Globiz's CRM. In this capacity, we process that data solely on your instructions and in accordance with our Data Processing Agreement. You, the Globiz user, are the data controller for those contacts and are responsible for ensuring you have a lawful basis to process and store their personal data.

Your responsibility: Before importing third-party contact data into Globiz (e.g., from a spreadsheet, LinkedIn export, or third-party tool), you must ensure you have a valid lawful basis to hold and process that data under applicable law, including the PDPA and any laws in your contacts' jurisdictions.

4Data We Collect — Account & Profile

When you register for and use Globiz, we collect the following categories of personal data directly from you:

Category	Examples	Source	Required?
Identity	Name, username, profile photo	You (registration)	Yes
Contact	Email address	You (registration)	Yes
Organisation	Company name, job title, industry	You (optional onboarding)	No
Credentials	Hashed password, OAuth tokens for third-party integrations	You / Third-party OAuth	Yes
Preferences	Notification settings, UI preferences, language	You (in-app settings)	No

5Data We Collect — CRM & Contact Data

As part of providing CRM functionality, Globiz processes data about the business contacts you manage. This data is controlled by you (the Globiz user), and we process it as your data processor.

Category	Examples	Who Provides It
Contact identity	Name, email, phone, LinkedIn URL, social handles	You (manual entry or import)
Company data	Company name, industry, size, website, location	You or AI enrichment
Deal & pipeline data	Deal stage, deal value, close date, notes	You
Engagement history	Email opens, clicks, replies, social interactions	Third-party APIs, tracking pixels you enable
Outreach content	Emails sent, messages composed, campaign sequences	You (authored or AI-assisted)
Enrichment data	Publicly available professional data sourced via AI agents	AI agents acting on your instructions

Your CRM data is stored in a local SQLite database at ~/.globizwork/globizwork.sqlite on your device and, where cloud sync is enabled, in encrypted cloud storage infrastructure we operate.

6Data We Collect — Usage & Log Data

We automatically collect certain technical data when you use the Service to help us improve reliability, debug issues, and understand how features are used.

Type	Details	Retention
Application logs	Feature interactions, workflow completions, error events (no CRM content)	90 days
Crash reports	Stack traces, OS version, app version, device type	30 days
Performance telemetry	Response times, sync durations, agent latency	90 days
Feature usage	Aggregate, anonymised counts of feature activations	24 months (anonymised)

Usage logs are aggregated and do not include the content of your CRM records or outreach messages. You may opt out of non-essential telemetry in Settings → Privacy.

7Data We Collect — Device & Local Storage

Globiz is a desktop application that stores data locally on your device. The following data resides in ~/.globizwork/:

Main database (globizwork.sqlite) — CRM records, campaigns, pipeline data;
Thread checkpoints (threads/) — AI agent state and conversation history for resumability;
API credentials (.env) — your third-party API keys (Anthropic, OpenAI, Google, etc.); and
OAuth state (linkedin-state.json, similar files) — authentication tokens for connected social platforms.

You are responsible for the physical and logical security of your device and local storage. We recommend encrypting your device's hard drive and using strong system-level authentication.

8Data We Collect — Communications Data

When you communicate with us directly (e.g., by emailing support or submitting a bug report), we collect:

Your name and email address;
The content of your message; and
Any attachments or screenshots you voluntarily share.

We use this data solely to respond to your enquiry and improve the Service. Support communications are retained for up to 2 years.

9Data We Collect — Payment Data

Subscription payments are processed by a third-party payment processor (e.g., Stripe). We do not store your full card number, CVV, or bank account details. We retain:

Billing name and address;
Last four digits of card (for display only);
Transaction IDs and amounts; and
Subscription status and history.

Payment data is retained for at least 7 years to meet Singapore accounting and tax record obligations.

10Data We Collect — AI Interaction Data

Globiz routes certain inputs to large language model (LLM) providers (Anthropic Claude, OpenAI GPT, Google Gemini) to power AI features. The following data may be transmitted to and processed by those providers:

Prompts and instructions you enter into the AI agent chat;
CRM context snippets used to ground AI responses (e.g., contact name, company, deal stage); and
Drafted outreach content submitted for AI editing or generation.

Important: Do not submit sensitive personal data (e.g., health information, government ID numbers, financial account numbers) to the AI agent interface. LLM providers process inputs on their own infrastructure under their own privacy policies. See Section 12 for details.

AI interaction logs (prompts and responses) are stored locally as part of the thread checkpoint system at ~/.globizwork/threads/. We retain server-side AI usage metadata (token counts, model used, latency) for billing and performance monitoring.

AI Model Provider Data Practices

Provider	Model	Data Retention Policy
Anthropic	Claude	API inputs/outputs are not used to train models by default (see Anthropic's API Privacy Policy)
OpenAI	GPT-4 and later	API data not used for training by default; retained up to 30 days for safety monitoring
Google	Gemini	Subject to Google Cloud API data processing terms

11How We Use Your Data

Purpose	Data Categories Used	Legal Basis
Provide and operate the Service	Account, CRM, AI interaction, device	Contract
Process payments and manage subscriptions	Payment, account	Contract / Legal obligation
Send transactional communications (receipts, security alerts, service updates)	Contact (email)	Contract
Send product marketing emails	Contact (email), usage	Legitimate interests / Consent
Improve the Service (analytics, A/B testing, feature prioritisation)	Usage (aggregated/anonymised)	Legitimate interests
Provide customer support	Communications, account	Contract / Legitimate interests
Detect fraud, abuse, and security incidents	Account, usage, device	Legitimate interests / Legal obligation
Comply with legal obligations (tax records, court orders, regulatory requests)	All relevant categories	Legal obligation
Enforce our Terms and Conditions	Account, usage	Legitimate interests / Contract
Conduct research and development	Aggregated, de-identified data only	Legitimate interests

12Legal Bases for Processing (PDPA)

Under the Singapore PDPA, we rely on the following bases to collect, use, and disclose personal data:

Consent

Where you have given us explicit, voluntary consent — for example, when opting in to marketing communications or enabling optional telemetry features. You may withdraw consent at any time without affecting processing carried out before withdrawal.

Contractual Necessity

Processing necessary to perform the contract we have with you — delivering the Globiz Service, processing your subscription, and providing customer support.

Legitimate Interests

We process certain data for our legitimate business interests where those interests are not overridden by your rights and freedoms. This includes fraud prevention, security monitoring, product analytics (using anonymised data), and communicating service improvements. We conduct balancing tests to ensure this basis is appropriate.

Legal Obligation

Processing required to comply with applicable laws — including Singapore tax and accounting law, anti-money laundering regulations, and lawful requests from regulators or courts.

13Who We Share Your Data With

We share personal data only as described below. We do not sell personal data.

Service Providers (Sub-processors)

We engage trusted third-party companies to help us deliver the Service. These sub-processors are contractually bound to process data only on our instructions and to implement appropriate security measures.

Sub-processor Category	Purpose	Location
Cloud infrastructure	Database hosting, storage, and CDN	Singapore / Asia-Pacific
Payment processing	Subscription billing and payment handling	USA (Stripe)
AI model providers	Powering AI assistant features	USA (Anthropic, OpenAI, Google)
Email delivery	Transactional and marketing emails to you	USA / EU
Analytics (anonymised)	Product usage analytics (no personal data)	EU / USA
Error monitoring	Crash reporting and debugging	USA / EU

Legal Disclosures

We may disclose personal data to government authorities, regulators, or courts when required by Singapore law, valid legal process, or to protect the rights, property, or safety of AlphaTok Singapore Pte. Ltd., our users, or others. Where legally permissible, we will notify you before complying with such requests.

Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring involving AlphaTok Singapore Pte. Ltd., personal data may be transferred to the acquiring entity. We will notify you of any such transfer and your options, and will require the acquirer to honour this Policy or provide you with equivalent protections.

With Your Consent

We may share data with third parties in other ways with your explicit consent.

14Third-Party Integrations

Globiz integrates with the following categories of external platforms to deliver its features. When you connect a third-party account, you authorise us to exchange data with that platform on your behalf, as directed by you. Each platform's own privacy policy governs how they process data on their side.

Platform Type	Examples	Data Exchanged
Professional social	LinkedIn	Profile data, connection lists, messages (via OAuth)
Social media	Twitter/X, Facebook, Instagram	Post content, engagement metrics, direct messages
Messaging	WhatsApp, Telegram, Discord, Slack	Messages sent/received via connected accounts
AI model providers	Anthropic (Claude), OpenAI (GPT), Google (Gemini)	Prompts, context snippets (see Section 10)
Email	Any IMAP/SMTP provider you connect	Email metadata and content for CRM sync

You can disconnect any third-party integration at any time in Settings → Integrations. Disconnecting revokes our access token but does not delete data already synced; use the data deletion tools in the application to remove synced records.

15International Data Transfers

Some sub-processors and AI model providers are located outside Singapore (primarily in the United States and European Union). When we transfer personal data internationally, we take steps to ensure adequate protection is in place, including:

Entering into contractual clauses that require recipients to protect personal data in accordance with the PDPA;
Ensuring AI providers operate under their own binding corporate rules or equivalent data protection commitments; and
Reviewing the data protection standards of recipient countries before transferring.

EU/UK users: where transfers occur to countries without an EU adequacy decision, we rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms.

16Data Retention

Data Category	Retention Period	Reason
Account & profile data	Duration of account + 30 days post-termination	Service provision; brief grace period for reactivation
CRM / contact data	Duration of account + 30 days post-termination	You control this; deletion on request at any time
Payment records	7 years from transaction date	Singapore Income Tax Act and accounting law
Application logs	90 days	Debugging and security monitoring
Support communications	2 years from last correspondence	Quality assurance and dispute resolution
Anonymised analytics	Up to 24 months	Product improvement (no personal identifiers)
Legal hold data	Duration of legal proceedings	Legal obligation

At the end of each retention period, data is securely deleted or irreversibly anonymised. You may request early deletion of your account and associated data at any time (subject to legal hold obligations) — see Section 18.

17Security Measures

We implement a multi-layered approach to data security:

Technical Controls

Encryption in transit using TLS 1.2 or higher for all data exchanged with our servers;
Encryption at rest for databases held on our cloud infrastructure;
API keys and OAuth tokens stored locally are handled by Electron secure storage mechanisms;
Regular security patching and dependency vulnerability scanning; and
Access controls and authentication enforced across our infrastructure.

Organisational Controls

Access to production systems is limited to authorised personnel on a need-to-know basis;
Staff are trained on data protection and security practices; and
We conduct periodic security assessments of our systems and sub-processors.

Breach Notification

In the event of a data breach affecting your personal data, we will notify the Singapore Personal Data Protection Commission (PDPC) within 3 calendar days if the breach is notifiable under the PDPA. We will notify affected individuals without undue delay where the breach is likely to result in significant harm to them.

Your device security matters too. Because Globiz stores data locally at ~/.globizwork/, your device's physical and logical security is critical. We strongly recommend enabling full-disk encryption and using a strong system password. We cannot be responsible for breaches resulting from unauthorized access to your local device.

18Your Rights Under PDPA (and GDPR)

Under the Singapore PDPA, you have the following rights in relation to your personal data. EU/UK users hold equivalent rights under the GDPR, which may be broader in certain respects.

🔍

Access

Request a copy of the personal data we hold about you and information on how it is used.

✏️

Correction

Request correction of inaccurate or incomplete personal data we hold about you.

🗑️

Deletion

Request deletion of your account and associated personal data (subject to legal retention obligations).

📦

Data Portability

Export your CRM and account data in a structured, machine-readable format (CSV/JSON).

🚫

Withdraw Consent

Withdraw consent for marketing communications or optional telemetry at any time.

⚠️

Object

Object to processing based on legitimate interests where your rights override our interests (GDPR).

⏸️

Restriction

Request restriction of processing while a correction or objection request is assessed (GDPR).

🤖

Automated Decisions

Request human review of any significant decision made about you solely by automated means.

How to Exercise Your Rights

Submit your request to sgalphatok@gmail.com with the subject line "Privacy Request — [Right Type]". Please include your account email so we can verify your identity. We will respond within:

PDPA (Singapore): 10 business days to acknowledge; 30 calendar days to fulfil (or advise of extensions).
GDPR (EU/UK): One calendar month, with a possible two-month extension for complex requests.

Complaints

If you are not satisfied with our response, you have the right to lodge a complaint with the Singapore Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg. EU/UK users may also contact their local supervisory authority.

19Marketing Communications & Opt-Out

We may send you product news, feature updates, tips, and promotional offers by email. We will only do so where you have consented or where we have a legitimate interest in reaching you as an existing customer about similar products and services.

You can opt out of marketing emails at any time by:

Clicking the Unsubscribe link in any marketing email; or
Emailing sgalphatok@gmail.com with the subject "Unsubscribe".

Opting out of marketing does not affect transactional communications (receipts, security alerts, critical service notices), which we must send to maintain your account.

20Children's Privacy

Globiz is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a person under 18, we will delete it promptly.

If you believe we may have collected data from a child, please contact us at sgalphatok@gmail.com.

21Cookies & Tracking Technologies

Desktop Application

The Globiz desktop application does not use browser cookies. Electron-based application state and session data are managed via local storage on your device (~/.globizwork/).

Marketing Website

Our marketing website may use the following types of cookies:

Cookie Type	Purpose	Duration
Strictly Necessary	Core website functionality, security, session management	Session
Analytics	Aggregate traffic measurement to understand website usage	Up to 24 months
Functional	Remembering preferences (language, theme)	12 months
Marketing	Measuring campaign effectiveness (only with consent)	Up to 12 months

You can manage cookie preferences via the cookie banner on our website or through your browser settings. Disabling cookies may affect certain website functionality.

22Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or new features. When we make material changes, we will:

Update the "Last Updated" date at the top of this page;
Display a prominent notice in the Globiz application; and
Send an email notification to the address associated with your account at least 14 days before the changes take effect.

Your continued use of the Service after the effective date of the updated Policy constitutes acceptance of the changes. If you do not agree with any update, you should stop using the Service and may request deletion of your account and data.

23Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

Entity	AlphaTok Singapore Pte. Ltd.
Product	Globiz
Privacy enquiries	sgalphatok@gmail.com
Subject line	"Privacy Request" or "PDPA Request"
Jurisdiction	Republic of Singapore
Regulator	Personal Data Protection Commission (PDPC)

Response commitment: We acknowledge all privacy requests within 3 business days and aim to fully resolve them within 30 calendar days. Complex requests may take up to 60 days; we will inform you if this is the case.