Privacy Policy & Cookie Policy
This page is the official, current version of this document. Printed or saved copies may be out of date — the latest version is always at gracesoft.dev/legal/privacy. Printed on .
Effective Date: October 16, 2026
Entity: GraceSoft (Singapore)
1. Overview & Commitment
GraceSoft ("Company", "we", "us", or "our") is dedicated to protecting your privacy and managing personal data with transparency. This Privacy Policy & Cookie Policy outlines how we collect, use, process, and safeguard your personal information across our websites, AI-powered SaaS platforms, and software applications, strictly adhering to the Singapore Personal Data Protection Act (PDPA) while maintaining global compliance standards (including GDPR-ready data rights).
2. Personal Data We Collect
We collect personal data that you provide directly, as well as data gathered automatically when you interact with our services:
- Account & Identity Data: Name, email address, billing details, and login credentials.
- Service Usage & Prompts: User inputs, prompts, uploaded files, or data submitted to interact with our AI-powered applications.
- Technical Data: IP address, browser type, device identifiers, operating system, and log metadata collected during your sessions.
3. How We Use Your Data
We process your personal data for the following specific purposes:
- Providing, operating, and maintaining our software and AI SaaS applications.
- Processing payments and managing user accounts.
- Improving platform performance, troubleshooting bugs, and enhancing security.
- Communicating important service updates, security alerts, and administrative notices.
4. AI Data Processing & Model Training Disclosures
- Zero Model Training on User Data: GraceSoft does NOT use your confidential inputs, submitted prompts, or proprietary data to train or fine-tune public AI models.
- Third-Party AI API Processing: When you submit queries to our AI services, data is processed via secure API endpoints provided by our AI infrastructure partners (e.g., Azure OpenAI, Google Vertex AI, Anthropic). These providers are contractually restricted from using your data to train their models.
5. Third-Party Infrastructure & Sub-Processors
To deliver reliable and secure services, GraceSoft shares data with trusted third-party infrastructure and hosting vendors:
| Category | Service Provider | Purpose |
|---|---|---|
| Hosting & Deployment | Laravel Cloud, Vercel, Railway | Application hosting, background job queues, and infrastructure management |
| DNS, CDN & Security | Cloudflare | Content delivery, DDoS protection, DNS management, and optional bot protection (Cloudflare Turnstile) on GraceSoft Capture forms |
| Database & Vector Storage | PostgreSQL (Hosted), Pinecone | Secure relational data storage and vector indexing |
| Email & Communications | Postmark | Transactional email delivery and operational alerts |
| Payments & Billing | Stripe | Subscription billing and payment processing (card details are entered on Stripe and never stored by GraceSoft) |
All sub-processors are evaluated to ensure they maintain strict security standards and cross-border data transfer mechanisms compatible with PDPA requirements. The full, current list is published on our Sub-processors page.
GraceSoft Capture Form Submissions
GraceSoft Capture lets our customers build forms and embed them on their own websites. When you submit a form run by one of our customers, that customer decides what is collected and why, and GraceSoft processes the submission on their behalf as a data intermediary under the GraceSoft Capture Data Processing Agreement. Please direct requests about those submissions to the organisation whose form you filled in; we will help them respond. Capture does not record your IP address or browser details, encrypts submissions at rest, and deletes them automatically once the form's retention period ends.
The contact form on gracesoft.dev also runs on GraceSoft Capture. For messages sent through it, GraceSoft is the organisation responsible for your data: we use your name, email address and message only to reply to your enquiry, and the same protections described above apply.
6. Cookie Policy
We use cookies and similar tracking technologies to ensure our website functions correctly and to analyze usage:
- Essential Cookies: Necessary for core site functionality, authentication, and secure session management.
- Analytical / Performance Cookies: Help us understand how visitors interact with our apps so we can improve usability and performance.
- Managing Cookies: You can control cookie settings via your browser preferences or through our onsite cookie consent banner. Disabling essential cookies may impact platform functionality.
- GraceSoft Capture Forms: Forms embedded through GraceSoft Capture set no cookies and load no third-party trackers. If a form owner enables Cloudflare Turnstile bot protection, Cloudflare processes challenge signals solely to tell people and bots apart.
7. Data Protection, Storage & Security
We implement robust administrative, technical, and physical security measures (including TLS encryption in transit and AES-256 encryption at rest) to prevent unauthorized access, loss, or disclosure. Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or to satisfy legal obligations.
To check that these measures keep working, we may engage independent, qualified security testers to assess our products and infrastructure, including through penetration testing and vulnerability assessments. Testers work under written confidentiality and data protection obligations, use test environments and synthetic data wherever practicable, and may access personal data only where strictly necessary for a test, without copying, keeping, or using it for any other purpose. This applies equally to personal data we process as a data intermediary, including GraceSoft Capture form submissions. See section 8 of our Terms of Service.
8. Your Rights & Data Controls
Under the PDPA (and applicable data protection laws), you have the right to:
- Access & Portability: Request a copy of the personal data we hold about you.
- Correction: Request corrections to inaccurate or incomplete personal data.
- Withdrawal of Consent / Erasure: Withdraw consent for data processing or request the complete deletion of your account and associated data.
To exercise any of these rights, submit a request to our Data Protection Officer at davinaleong@gracesoft.dev.
9. Contacting Our Data Protection Officer (DPO)
If you have any questions, concerns, or complaints regarding our privacy practices or PDPA compliance, please contact our designated Data Protection Officer:
Data Protection Officer
GraceSoft
Email: davinaleong@gracesoft.dev
Location: Singapore
10. Updates to This Policy
We may update this Privacy Policy & Cookie Policy periodically to reflect changes in our legal obligations or software functionality. Updates will be posted on this page with an updated "Effective Date."