Privacy, data processing and cookies.

Pints AI sells governed decisioning to regulated institutions. It would be a poor advertisement for that if we were vague about our own data handling, so this page states plainly what we collect, why, how long we keep it, and (the part that matters most for a deployment) how little of your data reaches us at all.

SECTION 1

Privacy notice

This notice is issued by Pints AI Pte. Ltd. (“Pints AI”, “we”), a company incorporated in Singapore, and describes how we handle personal data under the Singapore Personal Data Protection Act 2012 (PDPA). Where we handle the personal data of individuals in the EEA or the UK, we also apply the GDPR standards described below.

What we collect, and why

Source	Data	Purpose	Retained
Report request	Work email address	To send you the requested research report, once	24 months, or until you ask us to delete it
Talk to us / Book a demo	Name, work email, company, and anything you type into the message field	To answer you and, if it goes further, to run a workshop	36 months from last contact
Workshop and pilot	Names and business contact details of the people in the room	To run the engagement and its follow-up	For the engagement, then 72 months for contractual and audit records
This website	Pages viewed, referrer, device and browser type, approximate location, via Google Analytics, and only if you accept analytics cookies	To see which pages are read	14 months in Google Analytics, then deleted

The report form, specifically. The email address you give to download the AI Sovereignty Report is used to send you that report and nothing else. It does not enter a nurture sequence, it is not scored, it is not passed to a reseller or a data broker, and there is no sales follow-up unless you ask for one. If you would like a conversation, there is a “Talk to us” button on the homepage, and that is the only route that starts one.

Legal basis

Under the PDPA we rely on your consent, given when you submit a form, and on the deemed-consent and legitimate-interests provisions for the ordinary administration of a business relationship. Under the GDPR, where it applies, the bases are consent (Art. 6(1)(a)) for the report and marketing contact, and contract or legitimate interests (Art. 6(1)(b) and (f)) for running an engagement. You can withdraw consent at any time; withdrawal does not affect processing already carried out.

Who else sees it

We do not sell personal data, and we do not share it for anyone else’s marketing. We disclose it only to the service providers that operate our own systems (listed in section 3) and where we are legally required to.

Transfers out of Singapore

Our corporate systems are hosted in Singapore. Where a provider processes data elsewhere, we transfer it only under contractual terms that meet the PDPA Transfer Limitation Obligation, and, for EEA and UK data, under the relevant Standard Contractual Clauses.

Your rights

Access: ask what personal data of yours we hold and how it has been used in the past year.
Correction: ask us to correct anything inaccurate.
Withdrawal of consent: including unsubscribing, which takes effect immediately and permanently.
Deletion: ask us to erase it, subject to records we are required to keep.
Portability and objection: where the GDPR applies, in the form it provides for.

Write to our Data Protection Officer at dpo@pints.ai. We acknowledge within 5 business days and respond substantively within 30 days. If you are not satisfied, you may complain to Singapore’s Personal Data Protection Commission, or to your local supervisory authority where the GDPR applies.

SECTION 2

Cookies and analytics

This site uses Google Analytics 4 to count which pages are read, and only if you accept the cookie banner. Until you do, nothing is requested from Google and no analytics cookie is set. We set no advertising cookies and do not use Google Analytics for advertising, remarketing or personalisation.

Analytics (with your consent). Google Analytics sets the first-party cookies _ga and _ga_<ID>, which last up to two years, and records the pages you view, the referring site, your device and browser type and your approximate location. Google truncates IP addresses and does not store them. Google LLC processes this data as our processor and may transfer it outside Singapore; see Google’s privacy policy.
Your choice. Whether you accepted or declined is stored in your browser’s local storage (pints-consent) so the cookie panel stops opening by itself on every page; the cookie button in the bottom-right corner reopens it. So is the motion on/off switch. Neither is sent to us.
Forms. The contact and RSVP forms send what you type to a Google Apps Script endpoint, which Pints AI uses to receive enquiries. Submitting a form sets no cookie.
Fonts and media. Typefaces, images and video are served from our own origin.

You can change your mind at any time: open cookie settings. Declining clears the Google Analytics cookies from this site. If your browser blocks cookies entirely, every part of this site still works.

SECTION 3

Data processing

The architectural point comes first, because it decides most of this section. Autothought is deployed inside the institution’s own perimeter: on-premise, private cloud or the institution’s VPC. In that configuration the regulated records an agent reads, the documents it indexes and the audit trails it writes stay inside infrastructure the institution controls, and Pints AI is not a processor of them: we never receive them. The institution’s own certifications, controls and retention policy govern that data path.

A data processing addendum on our standard terms is available on request from dpo@pints.ai and is executed alongside the master agreement. It covers the narrow set of cases where we do act as a processor:

Support access. Named engineers, on request, through the institution’s own access management, for a bounded window. Every session is logged in the institution’s systems, not only in ours.
Evaluation datasets. Where an institution asks us to help curate its evaluation set (its own settled cases) on the institution’s instruction and, wherever the workflow allows, on de-identified records.
Engagement records. Contact details of the institution’s staff, as described in section 1.

Terms that come with it

Processing only on documented instruction, and never for model training. No customer data, no customer document and no audit trail is ever used to train, fine-tune or evaluate a model for any other customer, or for us.
Subprocessors are listed in the DPA, with 30 days’ written notice of any addition and a right to object.
Security incidents are notified without undue delay and within 48 hours of confirmation, with what is known at the time rather than after the investigation closes.
Return and deletion on termination, within 30 days, certified in writing.
Audit rights, exercisable annually and on any confirmed incident.

SECTION 4

Terms of use

These terms cover this website. They do not govern a deployment: that is the master agreement, and where the two differ, the master agreement wins.

No advice. Nothing here is legal, regulatory, financial or investment advice, and nothing here creates a professional relationship.
Illustrative material. Console runs, audit trails and sample exports shown on this site describe fictional cases, chosen to show how the mechanism works. They are not the records of any institution.
Generated imagery. The ground plates in the footprint band are generated, not photographs, and are labelled as such where they appear.
Intellectual property. The content, marks and software referenced here belong to Pints AI Pte. Ltd. or its licensors.
Availability. The site is provided as-is; we do not warrant it will be uninterrupted or error-free.
Governing law. Singapore law, with the Singapore courts having exclusive jurisdiction.