Privacy Policy.

Scope

This policy applies to every mobile and web application ("App") published by The Direct API Pte. Ltd., a company incorporated in Singapore ("we", "us", "our"), unless an App ships its own policy. It explains what data our Apps handle, what we receive, and the choices you have. We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA) and, where it applies, other data-protection law.

This policy covers our apps only. Our data products, The Beauty API and The Food API, have their own privacy policies on their own websites.

In short

• Our Apps work on your device and, unless section 12 says otherwise for a specific App, send us nothing.
• We never sell personal data, and we do not use it for advertising or third-party marketing.
• We use device features such as the microphone, camera or location only for the feature you are using, and only after you grant permission.
• You can contact us at any time about your data using the details in section 15.

Data an app may handle

Depending on the App and the features you use, the following kinds of data may be processed. Data that stays on your device is handled by the App but never received by us.

• Content you create. Recordings, measurements, notes, images, documents and other content you make in an App. By default this is stored only in the App's private storage on your device.
• Device permissions. Microphone, camera, photo library, location, contacts or notifications, each requested only when a feature needs it and usable only while you allow it. You can withdraw a permission in your device settings at any time.
• Account data. If an App offers accounts, the email address, display name and credentials you provide, and an identifier for your account.
• Purchase data. If an App offers in-app purchases or subscriptions, Apple or Google process the payment. We receive a transaction identifier and product details so we can unlock what you bought. We never receive your card number.
• Diagnostics and usage. If an App includes crash reporting or analytics, section 12 says so. It may then collect crash logs, device model, operating-system version, App version, language, coarse region and anonymous interaction events, used only to fix problems and understand how features are used. Our Apps do not use advertising identifiers or third-party advertising SDKs.
• Support correspondence. What you send us when you contact support, including your email address.

Why we process data

We process data only to provide the App's features, to keep the App secure and working, to respond to your requests, to comply with law, and, where you have agreed, to tell you about updates. The legal bases we rely on are your consent, the performance of our agreement with you, and our legitimate interests in operating and improving the App.

What we do not do

We do not sell personal data. We do not share it with advertisers or data brokers. We do not use personal data collected through our Apps to build profiles of you for purposes unrelated to the App.

Sharing

We do not sell or rent personal data. We share it only with:

• Service providers that process data on our instructions under contract, such as hosting, crash reporting or analytics providers, and only to the extent needed to run the App.
• Apple and Google, which operate the app stores, process purchases, and may collect their own data under their privacy policies when you download or update an App.
• Authorities where the law requires it, or to protect our rights, your safety or the safety of others.
• A successor if we merge with, are acquired by, or sell assets to another organisation, in which case this policy continues to apply.

App stores, backups and third parties

When you download one of our Apps, the app store (Apple App Store or Google Play) collects data under its own privacy policy, which we do not control. Where an App includes a third-party crash-reporting library, section 12 names it; we configure such libraries to collect the minimum required.

Your device's own backup feature, such as iCloud Backup or Google's device backup, may copy an App's files as part of a full device backup according to your device settings. Those backups are managed by Apple or Google under their terms, not by us. Where an App lets you share content to other apps or services, that content is then governed by those services' policies.

Retention

Content stored on your device stays there until you delete it or uninstall the App. Data we hold is kept only as long as needed for the purpose it was collected for, then deleted or anonymised. Crash and analytics data, where an App collects it, is retained for no longer than 14 months. Support correspondence is retained for up to two years.

Security

Where an App transmits data, it uses encrypted connections. Data we hold is protected by access controls and industry-standard safeguards. No system is perfectly secure, so we cannot guarantee absolute security, and you are responsible for protecting your device and any account credentials. If we become aware of a data breach that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as required by law.

International transfers

We are based in Singapore. Where an App sends data to us or to a service provider, it may be processed in Singapore or in countries where our providers operate. We take steps to ensure such transfers are protected to a standard comparable to the PDPA, including contractual safeguards where required.

Your rights

Subject to the law that applies to you, you may ask us to access, correct, delete or port the personal data we hold about you, to restrict or object to its processing, or to withdraw consent. If an App holds your data only on your device, you exercise these rights directly by editing or deleting content in the App or uninstalling it. To make a request, contact us using section 15; we will respond within 30 days and may need to verify your identity first. You may also complain to your data protection authority. In Singapore that is the Personal Data Protection Commission at pdpc.gov.sg.

If you are in the European Economic Area or the United Kingdom, the rights above are those provided under the General Data Protection Regulation. If you are a California resident, you have the rights provided under the California Consumer Privacy Act, and we confirm that we do not sell or share personal information as those terms are defined there.

Our apps

This section states what each App we publish actually does with data. It is updated before an App is released, and before a version changes its data handling.

No App has been released yet. Unless an entry here says otherwise, an App we publish keeps your content in its private storage on your device, uses device features such as the microphone only during a feature you have started, and sends nothing to us or to anyone else: no account, no backend, no analytics and no crash reporting. Deleting the App deletes its data.

Children

Our Apps are not directed at children under 13, or the higher age required by your country, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy. The current version is always published at this address with its effective date. If an App starts handling data in a materially different way, we will update section 12 before that version is released and ask for any consent the law requires.

Contact

Data protection enquiries: [email protected]. The Direct API Pte. Ltd., Singapore.