1. About this Policy
This Privacy Policy explains how EasyBiz Cloud collects, uses, shares, and protects personal information. It covers our websites, the Console, Point of Sale, our mobile apps, the customer websites and online stores we publish for businesses, and every other part of the Services.
We are based in Singapore and this Policy is written around the Personal Data Protection Act 2012 (the “PDPA”). Where we serve businesses in Malaysia, we also observe the record-keeping and data protection requirements that apply there.
If we change our privacy practices we will update this Policy and change the date shown at the top of this page. If a change is significant, we will tell you — for example through the Console or by email.
2. Who we are and how to reach us
EasyBiz Cloud is operated by TrustyTech Pte. Ltd., a company incorporated in Singapore with UEN 201807539R and its registered office at 3A Pasir Ris Drive 6, #03-29, Singapore 519422.
We have appointed a Data Protection Officer, who is responsible for overseeing questions about this Policy and about how we handle personal data. To contact the Data Protection Officer — including to make an access, correction, or deletion request, or to raise a concern — write to hi@easybizcloud.com and mark your message for the attention of the Data Protection Officer.
If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore.
3. Our two roles
EasyBiz Cloud acts in two different capacities, and which one applies determines who decides what happens to the data.
Data we hold on behalf of a business
When a business uses EasyBiz Cloud to run its operations, the records it puts into the system — its customers, orders, payments, staff, and website content — belong to that business. It decides what to collect and why. We act as its data intermediary under the PDPA, processing that information on its instructions to deliver the service it configured.
If you are a customer of a business that uses EasyBiz Cloud and you want to see, correct, or delete your information, contact that business directly. It is responsible for answering you, and we will support it in doing so. Section 13 explains how this works.
Data we hold about our own users and visitors
When you sign up for EasyBiz Cloud, visit our website, contact us, or use our AI assistant on our own site, we decide how that information is used, and we are responsible for it. That includes account and billing details, support conversations, and the technical information described in section 4.
It also covers the way we use interactions with our AI features to evaluate and improve them, described in section 6. For that purpose we act on our own behalf rather than on a business's instructions, and we are responsible for it.
4. Information we collect
We try to limit what we collect to what we actually need to run the Services. The categories below describe what that means in practice.
Information you give us
Account and business details such as your name, business name, email address, phone number, and the address of your locations. Billing details, including the payment method you register and the invoices and receipts we issue. Anything you send us in a support request, a demo request, or a message to our team.
Business records you put into the Services
The customer, order, payment, product, staff, and scheduling records your business creates while using EasyBiz Cloud, together with any images or documents you upload. These are held under the role described in section 3.
Information collected automatically
Device and technical information such as IP address, browser and operating system, device identifiers, and app version. Usage information about which features are used and when, and error and diagnostic reports when something fails. Where you enable location-based features such as delivery routing, the location data those features need in order to work.
Website AI Assistant and other AI conversations
When you use the Website AI Assistant or another EasyBiz AI assistant, we store and retain chat transcripts in order to answer your questions, prevent abuse, and review answer quality, including for staff follow-up when you ask them to. We request contact details only when you explicitly choose a support or demo handoff; if you provide them, we keep those details with the related conversation for that follow-up.
5. How and why we use information
We use information to provide and operate the Services you have subscribed to, to create and maintain your account, and to authenticate the people who sign in.
We use it to bill you, to collect payment, and to keep the accounting and tax records the law requires us to keep.
We use it to provide support, to answer your enquiries, and to send service messages about outages, security, billing, and changes to the Services. These are not marketing and you cannot opt out of them while you hold an account.
We use it to secure the Services — detecting and preventing fraud, abuse, and unauthorised access — and to diagnose and fix faults.
We use aggregated and usage information to understand how the Services are used and to improve them, including the AI features described in section 6.
We send marketing about our own products only where you have asked to receive it or where the law otherwise allows, and every marketing message carries an unsubscribe link.
We process information where it is necessary to perform our contract with you, to meet a legal obligation, to pursue our legitimate interests in running and securing our business, or with your consent where consent is required.
6. AI features and your data
The Services include AI features that answer questions, draft replies and content, summarise records, and — where a business enables an AI agent — carry out actions in its workspace. To do that, the relevant content is sent to the AI model providers named in section 7.
We do not use your content to train those providers' artificial intelligence models, and our agreements with them do not permit them to use it for that purpose.
We do use interactions with our AI features — conversation transcripts, the knowledge content the assistant searches, quality ratings, and automated answer scoring — to operate, secure, evaluate, and improve our own Services. That is how we find wrong answers and fix them.
AI features can be turned off, and the scope of an AI agent can be limited, from the Console.
7. Who processes information for us
We use a small number of service providers to run EasyBiz Cloud. They may access personal information only to perform services for us, under contract, and they may not use it for their own purposes. We name them here so you can see exactly who is involved and where they are.
Hosting and infrastructure
Google Cloud, including Firebase (Singapore). Hosts the application, the database that holds your business records, and uploaded files.
Cloudflare (global network with a Singapore point of presence). Stores and delivers published customer websites and site assets, and provides the Turnstile check that protects our forms from automated abuse.
Vercel (United States). Hosts and serves customer websites published on our earlier platform generation, and registers the custom domains those sites use. Sites published on the current platform are served by Cloudflare instead.
Payments
Stripe (Singapore, United States, and Ireland). Processes your subscription payments to us and holds the card details you register for billing. We do not store full card numbers.
Email and messaging
Twilio SendGrid (United States). Delivers transactional and notification email that we send on your behalf and our own.
Meta Platforms (United States and Singapore). Delivers WhatsApp Business messages sent through the Services.
AI model providers
MiniMax (Singapore and China). Powers the customer-facing assistant and the in-Console assistant. It receives the conversation content and the business context needed to answer.
DeepSeek (China). Powers internal tool-use, the automated scoring we use to check answer quality, and the fallback used when the primary provider is unavailable.
OpenAI (United States). Converts knowledge content and the text used to search it into the numeric vectors that make assistant search work. It is used for that purpose only.
Support and customer communication
Slack Technologies (United States). Our support team receives and works on tickets in Slack. A ticket carries the name of the person who raised it, their business, the page they were on, the subject and message they wrote, and links to any files they attached.
Intercom (United States). Provides the in-app support messenger. It receives an identifier for the signed-in user so a conversation can be matched to the right account, together with the messages exchanged in that conversation.
Professional and operational advisers
Our accountants, auditors, insurers, and legal advisers, where they need access to perform their services for us.
8. Services you connect yourself
Separately from the providers in section 7, a business can connect its own third-party accounts to EasyBiz Cloud. These are chosen and controlled by that business, using its own credentials, and each provider handles data under its own terms and privacy policy.
They commonly include Stripe, for taking card payments from your own customers through your own connected account; Meta's WhatsApp Business Platform, using your own business number; SMS gateways such as Vonage or MACROKIOSK, using your own account with them; and Xero or QuickBooks Online, for syncing invoices and payments to your own accounting organisation.
When you connect one of these services, you authorise us to exchange data with it so the integration works. We are not responsible for what a connected provider does with data once it reaches them.
9. Sending information outside Singapore
We are a Singapore company and your business records are held in Google Cloud's Singapore region. Some of the providers in section 7 operate from other countries, so certain information is transferred outside Singapore — in particular to the United States and, for the AI model providers we use, to China.
Where we transfer personal data outside Singapore we take steps required by the PDPA's Transfer Limitation Obligation, including contractual commitments requiring the recipient to protect the data to a standard comparable to the PDPA.
If you would rather your business did not use providers outside Singapore, AI features can be turned off from the Console, and you can contact us at hi@easybizcloud.com to discuss the rest.
10. How long we keep information
We keep your information for as long as your account is active or as needed to provide the Services. If a subscription is cancelled, business data is retained for at least 24 months so the account can be reactivated, and transaction records may be retained for up to 7 years where record-keeping laws (such as those of Singapore and Malaysia) require it. After the applicable retention period, data is deleted or anonymized.
The account owner may request earlier deletion of the account's data. We honor verified requests within 30 days, except for records we are legally required to keep.
AI conversation transcripts are kept for the purposes described in section 6 and are deleted or anonymized when they are no longer needed for them.
11. How we protect information
Our websites and service endpoints are served over HTTPS, so information is encrypted while it travels between your device and EasyBiz Cloud.
Each business's records are stored under its own isolated account scope, and every request is checked against the signed-in account before it can reach any record. Access is enforced by the system, not by hiding controls in the interface.
Inside your workspace, the seats and permissions you assign determine what each member of your team can see. On our side, access to production systems is limited to authorised operators and privileged actions are authenticated and logged.
No method of transmission or storage is completely secure, and we cannot guarantee absolute protection. Keeping your own credentials safe, and exporting copies of records you cannot afford to lose, remain important.
12. Your rights
You may ask us for access to the personal data we hold about you and information about how it has been used. You may ask us to correct it if it is inaccurate or incomplete.
You may ask us to delete personal data we hold about you, and you may withdraw a consent you have given us — although withdrawing consent may mean we can no longer provide part of the Services. We will tell you if that is the case.
You may ask for a copy of information you provided to us in a commonly used electronic format, and while your account is active you can export your business data yourself from the Console at any time.
Send any of these requests to hi@easybizcloud.com. We will verify who you are before acting, and will respond within 30 days. If we cannot act on a request — for example where a record must be kept to meet a legal obligation — we will explain why.
13. Requests from your customers
If you are a customer of a business that uses EasyBiz Cloud, that business holds your information and is responsible for answering your access, correction, and deletion requests. Please contact it directly.
If you send such a request to us, we will pass it to the business concerned rather than act on it ourselves, because the data is theirs and we are not entitled to decide what happens to it.
Many of the businesses using EasyBiz Cloud do not have a dedicated privacy team, and helping them meet their obligations matters to us. The Console includes the tools they need to find, export, correct, and delete a customer's records.
If a third party asks us for personal data held on behalf of a business, we will refuse to share it unless that business permits it or we are legally required to disclose it. We do not sell personal data.
14. Cookies and similar technologies
Our marketing website does not use advertising cookies and does not run third-party analytics or tracking. The Cloudflare Turnstile check on our forms may set a short-lived token to confirm a submission is not automated.
The Console and our other signed-in applications use browser storage and cookies that are strictly necessary to run — keeping you signed in between visits and remembering interface preferences such as your colour mode. Blocking them will stop the applications from working correctly.
A customer website we publish for a business may use cookies that the business has configured for its own site. That is the business's choice and its own notice applies.
15. If there is a data breach
If we become aware of a data breach, we will act without undue delay to contain it and to establish what was affected.
Where the breach affects a business's own records, that business is the organisation responsible under the PDPA and we are its data intermediary. We will notify it without undue delay and give it the information and assistance it needs to make its own assessment. Deciding whether the breach is notifiable, and notifying the Personal Data Protection Commission and the affected individuals, remain that business's responsibility rather than ours. We will file a notification on its behalf only where it expressly asks us to.
Where the breach affects personal data for which we are the organisation — the data described in section 3 — we carry out that assessment ourselves. If the breach is notifiable, we will notify the Personal Data Protection Commission as soon as practicable and in any case no later than 3 calendar days after completing the assessment, and we will notify affected individuals where the PDPA requires it.
To report a suspected security issue or a breach affecting your account, write to hi@easybizcloud.com.
16. Children
The Services are business tools and are not directed at children. We do not knowingly collect personal data from a child in order to provide our own services. If you believe a child's data has reached us in that way, contact us at hi@easybizcloud.com and we will delete it.
17. Changes to this Policy
We may update this Policy as the Services develop or the law changes. The date at the top of this page shows when it was last updated, and we will tell you through the Console or by email if a change is significant.
Adding a new service provider to section 7 is a change of this kind, and we will publish it here before that provider begins processing data for us.
18. Contact
If you have any questions about this Privacy Policy, or wish to contact our Data Protection Officer, please write to: hi@easybizcloud.com.