1. Who we are
Publishfy (UEN 53528256K) is a Singapore sole proprietorship. In this policy, “we”, “us” and “our” mean Publishfy. Personal data means information that can identify a person, either on its own or with other information we can reasonably access.
This policy explains how we handle personal data under Singapore’s Personal Data Protection Act 2012 (PDPA). It covers our website, accounts and services. Any additional rights under laws that apply to you remain available.
We decide how to handle account, billing and service-security data. When we process personal data in your business content only on your organisation’s instructions, we act as its data intermediary. Your organisation is responsible for those instructions and the necessary permissions. We remain responsible for our duties as a data intermediary.
2. Data we collect
We collect data you provide, data from accounts you choose to connect, and technical information created when you use Publishfy:
- Your account: your name, email, workspace, role, sign-in details and account activity.
- Your content: business information, photos, videos, instructions, drafts, approvals and publishing records.
- Connected platforms: account identifiers, access permissions, connection credentials, and content or performance data available through the permissions you grant.
- Payments: billing details, subscription status, transaction references and payment outcomes. Stripe handles payment-card details; Publishfy does not store full card details.
- Service use: IP address, browser and device information, request times, errors and security records. Sign-in cookies help keep you logged in and protect your account.
- Messages: support requests, feedback and other information you send us.
Only upload personal data that is needed for your content or use of the service. Do not include passwords, identity-document numbers or sensitive personal details in prompts or media unless necessary and you have the right to do so.
3. How we use data
We use relevant data to run your account, prepare content, manage approvals, publish to your chosen destinations, show available results, process payments and answer requests. We also use it to fix faults, improve service reliability, prevent misuse, investigate disputes and meet legal duties.
We do not sell or rent personal data, or use your business content for unrelated advertising. Where possible, we use information that no longer identifies individuals to understand service use and improve Publishfy.
4. Permissions and your responsibilities
We obtain consent where the PDPA requires it. In some situations, the law allows consent to be treated as given, or permits processing without consent. We rely on these routes only when their legal conditions are met. Visiting our website alone does not give consent to unrelated uses of your data.
For example, processing to prevent fraud or protect accounts may qualify for the legitimate interests exception. Before relying on it, we must assess the risks, reduce adverse effects and determine that the relevant interests outweigh the remaining adverse effects. You can contact us for information about any reliance on this exception.
If you provide another person’s data, you are responsible for giving any required notices, obtaining necessary consent or other lawful authority, and making sure your instructions are lawful. Keep your information accurate and review posts before approving them. We may ask for evidence of your authority, or pause affected processing while an issue is checked. These responsibilities do not remove our obligations under the PDPA.
5. AI and connected platforms
To prepare or check content, relevant prompts, business information and uploaded media may be sent to our AI providers. A coded safety identifier may also be sent to help detect misuse. Account-specific provider retention, training and regional settings have not been verified; we do not promise zero data retention or immediate deletion of provider copies. AI can produce incorrect information about people, so check the output before using or publishing it.
We send data to AI providers to prepare or check your content. Using personal data for unrelated general-purpose model training requires a separate lawful basis and any notice or consent required by law.
When you approve publication, the content and necessary account information are sent to the selected platforms. Those platforms handle data under their own terms and privacy policies. Disconnecting a platform stops future authorised access through that connection; it does not automatically remove posts or copies already held by the platform or its users.
6. Who receives data
We share relevant data with providers that help us host Publishfy, verify sign-ins, process payments, create content and connect social platforms. Providers processing data on our behalf must be subject to appropriate instructions and safeguards. Support messages pass through email routing and the receiving mailbox. Operational alerts may send limited diagnostic information to Telegram. See our Subprocessors page for these providers, purposes and processing limits.
We may also share data with professional advisers, authorities or other parties when required by law, or when legally permitted and necessary to investigate misuse, resolve a dispute, recover a debt or protect rights. A proposed sale or transfer of the business may involve limited disclosure where the PDPA’s conditions and safeguards are met. Each disclosure must meet the applicable legal conditions.
7. Data outside Singapore
Our providers may store or process data outside Singapore. Where we transfer personal data overseas, we must meet the PDPA’s transfer requirements, including protection comparable to the PDPA through appropriate safeguards or another permitted route. Data is not stored exclusively in Singapore.
8. How long we keep data
We keep personal data while it serves the purpose for which it was collected, or while needed for a legal or business purpose. For example, payment, consent, fraud-prevention and dispute records may need to remain after an account closes. Retention is limited to the records needed for the relevant purpose.
Workspace deletion has a seven-day recovery window. Check the deadline shown for your request. Permanent deletion may take longer where payment disputes, legal duties, security investigations or unfinished provider actions require limited records to remain. We delete or anonymise personal data when it is no longer needed.
Automated account and workspace exports are unavailable. Ordinary content and media downloads are separate from personal-data requests handled through support.
Closing your account does not remove copies already published to third-party platforms. See Data Deletion for how to request deletion.
9. Keeping data safe
We use reasonable safeguards such as access checks, private storage and encrypted connection credentials. No online service is completely secure. Keep your sign-in details private and tell us promptly if you suspect unauthorised access.
If a personal-data breach occurs, we assess it and notify the PDPC and affected individuals where the PDPA requires. Nothing in this policy excludes duties or liability that the law does not allow us to exclude.
10. Your choices and rights
You can ask for access to your personal data and information about how it was used or disclosed during the preceding year, or ask us to correct an error. Email us with enough detail to identify you and the information concerned. We may reasonably verify your identity and authority before disclosing or changing data.
Access and correction are subject to the PDPA’s exceptions. For example, we may need to protect another person’s data or legally privileged information. We explain a refusal where the law requires. For an access request, we may charge a reasonable fee and provide a written estimate before proceeding; correction requests are free. We respond as soon as reasonably possible. If we cannot respond within 30 days, we tell you in writing within that period when to expect a response.
You may withdraw consent on reasonable notice by emailing us. We explain the likely effects: if the data is needed for a feature, we may be unable to continue that feature. We stop the affected processing unless the law permits or requires it to continue. Withdrawal does not undo processing already carried out.
You can also ask us to delete data or raise an objection. We assess what the law and our role allow; Singapore’s PDPA does not provide an unconditional right to erase every record. If we hold data only for a business customer, we may refer your request to that organisation. You can raise concerns with us or with the Personal Data Protection Commission.
11. Children
Publishfy is for business users and is not directed at children. We do not knowingly collect account data from children under 16. If you believe a child has provided personal data without appropriate authority, contact us.
12. Earlier referral or wallet records
If you have records from an earlier referral or wallet programme, we may keep relevant referral details, accepted terms, reward calculations, balances, payment outcomes and fraud checks to settle recorded obligations, handle disputes and meet legal duties. Stripe handles identity verification and payout-account details; Publishfy keeps relevant account references and status, not bank-account details. New referral rewards and withdrawals remain subject to current programme availability and the terms governing any existing entitlement.
13. Changes to this policy
We may update this policy as our service or legal duties change. We will provide notice of material changes where required. A policy update does not by itself authorise a new use of personal data: we obtain any further consent required by law.
14. Contact us
For privacy questions, access, correction, consent withdrawal or complaints, contact our Data Protection Officer at support@publishfy.app. Include your workspace name, what you need and how we can reach you. Do not send passwords, full payment-card details or unnecessary identity documents.