プライバシーポリシー

1. Who we are

easySales is provided by Sharker Technology Pte. Ltd. (“SharkerTech”, “we”, “us”), a company incorporated in Singapore (UEN 201432236W). This policy explains how we collect, use, disclose and protect personal data in connection with the easySales website, applications and related services (the “Service”).

We handle personal data in line with Singapore’s Personal Data Protection Act 2012 (PDPA) and, where they apply, the data protection laws of the other countries where our customers operate. Words defined in our Terms of Service, such as “Your Data” and “Usage Data”, have the same meaning here.

2. Our role

Information we control. For the personal data we collect to run our business, such as details of website visitors, people who contact us, and customers’ Users, Administrators and billing contacts, we decide how the data is used and are responsible for it under this policy.
Business data you store in easySales. For personal data in Your Data, such as information about your own customers, contacts and their transactions, our customer decides what goes in and how it is used. We act as a data intermediary (processor): we process that data on the customer’s behalf, only to provide the Service, on the customer’s instructions and in line with our Terms of Service. The customer is responsible for having the right to collect and use that data and for giving any notices it requires. Business customers can request a data processing agreement by email to [email protected].

3. What we collect

Account details: your company name, your name, business email address and role, and the details of Users an Administrator invites.
Sign-up verification data: the mobile number you enter when you sign up for a free trial, the one-time codes we send to your e-mail address and mobile number (kept only in a form we can check but not read back), and a record of verification attempts, such as when a code was sent and how many tries were made.
Billing details (once you subscribe): your Plan, billing period and number of Users; your billing contact’s e-mail address; the brand, last four digits and expiry date of your payment card; and a record of your invoices, payments, refunds, coupons and account credit. Card payments are processed by Stripe, which collects your card and billing details directly; we never receive or store your full card number or security code. We do not keep your billing name, billing address or tax registration number; they stay with Stripe and appear on your invoices.
Business data: customers, contacts, quotations, invoices, payments, credit notes, attachments and templates that Users create or upload.
Usage and device information: sign-in activity, feature usage, IP address, browser and device type, the Access Tokens a User creates and when they are used, audit records of changes, and error and performance logs.
AI interactions: the instructions Users give AI features, the data those features read to answer them, and the results they return.
Communications: messages you send us, including through our contact form, and our replies.
Website visits: pages viewed, referring page, browser type and approximate location derived from the connection, collected without cookies as described in section 12.

We collect this information from you directly, from your organisation’s Administrators when they invite you, and automatically when you use the Service or visit our website.

4. How we use it

To provide, operate, maintain and support the Service, including the features Users choose to use.
To verify, when someone signs up, that the e-mail address and mobile number belong to them, and to prevent fraud and abuse of the free trial. We send a one-time verification code by text message (SMS) to the mobile number for this purpose only, not for marketing.
To set up and manage subscriptions, charge and invoice customers, show their billing history and next charge, warn them of an expiring card or a failed payment, and keep accounting and tax records.
To keep the Service secure, detect and prevent fraud, abuse and unauthorised access, and keep an audit trail of changes.
To understand how the Service is used, fix problems and develop and improve it, using aggregated or de-identified information wherever possible.
To respond to enquiries and requests, and to send service notices, such as security alerts, billing messages and changes to our terms.
To send marketing where the law allows, as described in section 13.
To comply with legal obligations, respond to lawful requests from authorities, and establish, exercise or defend legal claims.

We do not sell, rent or trade personal data. We use personal data in Your Data only as described in section 2, not for our own marketing.

We collect, use and disclose personal data with your consent, or where the PDPA treats you as having consented, for example when you give us information for a purpose you know about, or when it is needed to provide the Service your organisation signed up for. Where the PDPA permits, we also rely on its exceptions, such as legitimate interests and business improvement.
You can withdraw your consent at any time by email to [email protected] or through our contact form. We will tell you the likely consequences, and will act on your request within a reasonable time. Withdrawing consent may mean we can no longer provide some or all of the Service, and it does not affect uses the law allows without consent.

6. AI features

When a User uses an AI feature, the User’s instructions and the business data needed to answer them may be processed by our service providers, including providers of AI processing, only to produce the result the User asked for.
AI features work within the User’s permissions: they only read and act on data the signed-in User is allowed to access, and changes they make are recorded under that User’s name.
We do not use Your Data to train AI models, and we take steps so that the AI processing providers we use do not use it to train their models.
If a User connects an AI tool or other application to easySales with an Access Token, the data that application reads is disclosed at the User’s direction and handled under that application’s own terms and privacy policy.

We share personal data only as described here:

Service providers that process data for us, in these categories: cloud hosting and storage; content delivery, network security and website analytics; email delivery; text-message (SMS) delivery, for which we use Amazon Web Services (AWS End User Messaging); AI processing; form and communication tools; and payment processing. They may use the data only to provide their services to us and must protect it. A list of our main service providers is available on request by email to [email protected].
Text messages. No mobile numbers will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except the providers that deliver our text messages and where the law requires it. Our verification messages are delivered through AWS Notify; AWS does not share end user phone numbers with third parties for marketing or promotional purposes.
Payment processor. Stripe processes card payments for subscriptions on our behalf as our payment processor. We share with Stripe the billing contact’s e-mail address and the details of the subscription needed to charge and invoice you. Stripe also uses card and payment data for fraud prevention and to meet its own legal obligations, under its own privacy policy (stripe.com/privacy).
Your organisation. Your organisation’s Administrators can see and manage information about your account and activity in the Service, including audit records.
Professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality.
Legal and safety reasons, where required by law or legal process, or where we believe in good faith that disclosure is needed to protect rights, property or safety, or to investigate fraud or security incidents.
Business transfers, to a buyer, successor or investor, and their advisers, in connection with a merger, acquisition, financing, reorganisation or sale of all or part of our business, under confidentiality obligations. We will notify you before your data becomes subject to a different privacy policy.
With your consent or at your direction, including to applications you connect to the Service.

8. Where data is stored

The Service and its data are hosted primarily in Singapore. Our content delivery and security network handles website and application traffic at locations close to the visitor, and some of our service providers, including AI processing providers, may process data in other countries. Where we transfer personal data outside Singapore, we take appropriate steps, such as contractual safeguards, to make sure it receives a standard of protection comparable to that under the PDPA. Stripe may process payment data in other countries, under its own safeguards for international transfers.

9. How long we keep it

We keep personal data only for as long as it is needed for the purposes described in this policy, or as required or allowed by law.
We keep account and business data while the account is active. When an account is closed, we keep its data for 180 days, so that it can be exported or the account reopened, and then delete it from our active systems. We e-mail the Administrators before the deletion, normally 30 days and 7 days before it, and always at least 7 days before it. To export the data before then, an Administrator can contact us and we will reopen the account in a suspended state, so that Administrators can sign in and export it. Copies in backups are removed as those backups expire on their regular cycle. Records we must keep for accounting and tax purposes are kept as described below.
If a sign-up is not completed, we delete the e-mail address, mobile number and verification records from that attempt within 7 days after the sign-up request expires. If it is completed, the mobile number is kept as part of the account administrator’s details for as long as the account is active, and under the rules above after it closes. We may keep a one-way record of a mobile number and e-mail address that have already had a free trial, so that the trial is not repeated.
We keep records of invoices, payments, refunds and account credit for 5 years, as accounting and tax records, even after an account is closed or deleted. The billing contact’s e-mail address and the card details we display are deleted with the account’s other data under the rules above.
We may keep limited records for longer where the law requires or permits it, for example records needed to resolve disputes, prevent abuse or enforce our agreements.
We may keep aggregated or de-identified information that no longer identifies anyone.

10. How we protect it

We make reasonable security arrangements to protect personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal and loss. They include encryption in transit, separation of each customer’s data, role-based and record-level access controls, and audit logging. Access to customer business data is restricted to our personnel who need it to provide support you request, to keep the Service secure, or to meet legal obligations.

No system is completely secure. If we become aware of a data breach, we will assess it promptly. Where it affects personal data we control and is notifiable, we will notify the Personal Data Protection Commission and affected individuals as the law requires. Where it affects personal data in Your Data, we will notify the affected customer without undue delay and help it meet its own obligations.

11. Your rights and choices

You can ask for access to the personal data we hold about you and information about how it has been used or disclosed in the past year, and ask us to correct it. Account Administrators can update most details directly in easySales.
You can withdraw consent as described in section 5.
Administrators can export their business data and close their account.
If you are a customer or contact of an easySales customer, please contact that business first; it controls that data. If you contact us, we will pass your request to the business and help it respond.

To make a request, email [email protected] or use our contact form. We may need to verify your identity, and may charge a reasonable fee for access requests where the law allows; we will tell you the fee first. We will respond as soon as reasonably possible and within the timeframes required by law. If we cannot respond within 30 days, we will tell you when we will. If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Singapore or the data protection authority where you live.

12. Cookies and analytics

The easySales application uses essential cookies and similar browser storage to keep you signed in, remember your preferences and secure the Service. The Service does not work without them.
This website uses a privacy-focused web analytics service provided by our content delivery network. It measures visits without cookies and without tracking you across other websites.
Our content delivery and security network may set cookies needed to protect the website against bots and attacks.
Our contact form is provided by a third-party form service, which may set its own cookies under its own privacy policy.
If we introduce optional cookies, such as advertising cookies, we will update this policy and ask for your consent where the law requires.

13. Marketing

We send marketing messages only where the law allows, for example to business contacts who have asked about easySales or used it, and every message includes a way to unsubscribe. We will act on an unsubscribe request within the time the law requires. Service notices, such as billing, security and legal messages, are not marketing and will continue while you have an account. We do not use the mobile number you give when signing up, or the verification messages, for marketing. Invoices, receipts and billing notices are service messages, not marketing.

When you sign up, we record where your visit came from: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the name of the website that linked to us, to learn which of our marketing works. We do not record your IP address for this, or the full address of the page you came from. Your browser keeps this for up to 90 days until you sign up; after that we keep it with your company’s account and delete it with the account (an unfinished sign-up’s is deleted with it).

14. Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please email [email protected] and we will delete it.

15. Other websites and applications

Our website and the Service may link to, or let you connect, websites and applications run by others. Their own privacy policies apply to them, and we are not responsible for how they handle personal data.

16. Contact us

Our Data Protection Officer oversees how we handle personal data. To contact the Data Protection Officer, make a request or raise a concern about your personal data, email [email protected]. You can also use our contact form and address your message to the Data Protection Officer.

17. Changes to this policy

We may update this policy from time to time. If we make a significant change to how personal data is used, we will notify your Administrators by email or in the Service before the change takes effect. The date at the top shows when it was last updated.

Privacy Policy