EFFECTIVE 18 AUGUST 2026 · VERSION 3.0
Privacy, data processing and cookies.
Pints AI sells governed decisioning to regulated institutions. It would be a poor advertisement for that if we were vague about our own data handling, so this page states plainly what we collect, why, how long we keep it, and (the part that matters most for a deployment) how little of your data reaches us at all.
SECTION 1
Privacy notice
This notice is issued by Pints AI Pte. Ltd. (“Pints AI”, “we”), a company incorporated in Singapore, and describes how we handle personal data under the Singapore Personal Data Protection Act 2012 (PDPA). Where we handle the personal data of individuals in the EEA or the UK, we also apply the GDPR standards described below.
What we collect, and why
| Source | Data | Purpose | Retained |
|---|---|---|---|
| Report request | Work email address | To send you the requested research report, once | 24 months, or until you ask us to delete it |
| Talk to us / Book a demo | Name, work email, company, and anything you type into the message field | To answer you and, if it goes further, to run a workshop | 36 months from last contact |
| Workshop and pilot | Names and business contact details of the people in the room | To run the engagement and its follow-up | For the engagement, then 72 months for contractual and audit records |
| This website | Aggregate page counts. No cookies, no cross-site identifiers, no IP addresses stored | To see which pages are read | Aggregates only; nothing that identifies a visitor exists to retain |
The report form, specifically. The email address you give to download the AI Sovereignty report is used to send you that report and nothing else. It does not enter a nurture sequence, it is not scored, it is not passed to a reseller or a data broker, and there is no sales follow-up unless you ask for one. If you would like a conversation, there is a “Talk to us” button on the homepage, and that is the only route that starts one.
Legal basis
Under the PDPA we rely on your consent, given when you submit a form, and on the deemed-consent and legitimate-interests provisions for the ordinary administration of a business relationship. Under the GDPR, where it applies, the bases are consent (Art. 6(1)(a)) for the report and marketing contact, and contract or legitimate interests (Art. 6(1)(b) and (f)) for running an engagement. You can withdraw consent at any time; withdrawal does not affect processing already carried out.
Who else sees it
We do not sell personal data, and we do not share it for anyone else’s marketing. We disclose it only to the service providers that operate our own systems (listed in section 3) and where we are legally required to.
Transfers out of Singapore
Our corporate systems are hosted in Singapore. Where a provider processes data elsewhere, we transfer it only under contractual terms that meet the PDPA Transfer Limitation Obligation, and, for EEA and UK data, under the relevant Standard Contractual Clauses.
Your rights
- Access: ask what personal data of yours we hold and how it has been used in the past year.
- Correction: ask us to correct anything inaccurate.
- Withdrawal of consent: including unsubscribing, which takes effect immediately and permanently.
- Deletion: ask us to erase it, subject to records we are required to keep.
- Portability and objection: where the GDPR applies, in the form it provides for.
Write to our Data Protection Officer at dpo@pints.ai. We acknowledge within 5 business days and respond substantively within 30 days. If you are not satisfied, you may complain to Singapore’s Personal Data Protection Commission, or to your local supervisory authority where the GDPR applies.
SECTION 3
Data processing
The architectural point comes first, because it decides most of this section. Autothought is deployed inside the institution’s own perimeter: on-premise, private cloud or the institution’s VPC. In that configuration the regulated records an agent reads, the documents it indexes and the audit trails it writes stay inside infrastructure the institution controls, and Pints AI is not a processor of them: we never receive them. The institution’s own certifications, controls and retention policy govern that data path.
A data processing addendum on our standard terms is available on request from dpo@pints.ai and is executed alongside the master agreement. It covers the narrow set of cases where we do act as a processor:
- Support access. Named engineers, on request, through the institution’s own access management, for a bounded window. Every session is logged in the institution’s systems, not only in ours.
- Evaluation datasets. Where an institution asks us to help curate its evaluation set (its own settled cases) on the institution’s instruction and, wherever the workflow allows, on de-identified records.
- Engagement records. Contact details of the institution’s staff, as described in section 1.
Terms that come with it
- Processing only on documented instruction, and never for model training. No customer data, no customer document and no audit trail is ever used to train, fine-tune or evaluate a model for any other customer, or for us.
- Subprocessors are listed in the DPA, with 30 days’ written notice of any addition and a right to object.
- Security incidents are notified without undue delay and within 48 hours of confirmation, with what is known at the time rather than after the investigation closes.
- Return and deletion on termination, within 30 days, certified in writing.
- Audit rights, exercisable annually and on any confirmed incident.
SECTION 4
Terms of use
These terms cover this website. They do not govern a deployment: that is the master agreement, and where the two differ, the master agreement wins.
- No advice. Nothing here is legal, regulatory, financial or investment advice, and nothing here creates a professional relationship.
- Illustrative material. Console runs, audit trails and sample exports shown on this site describe fictional cases, chosen to show how the mechanism works. They are not the records of any institution.
- Generated imagery. The ground plates in the footprint band are generated, not photographs, and are labelled as such where they appear.
- Intellectual property. The content, marks and software referenced here belong to Pints AI Pte. Ltd. or its licensors.
- Availability. The site is provided as-is; we do not warrant it will be uninterrupted or error-free.
- Governing law. Singapore law, with the Singapore courts having exclusive jurisdiction.