Marvel Integration Technology Pte. Ltd. (UEN 202516331R) (operating under the brand Mobitech) ("Mobitech," "we," "us," "our"), of 391B Orchard Road, #2200, Ngee Ann City Tower B, Singapore 238874, provides the Mobitech omnichannel customer engagement platform and related products and services.
In this policy those products and services are called the "Service", which has the meaning given to it in our Terms of Service (the "Terms"). This policy explains what personal data we handle, why, who we share it with, how long we keep it, and what you can ask us to do about it. It covers the Service, our websites, our marketing and sales activity, and any new product or brand we launch or acquire unless we publish a separate notice for it. It does not cover the third-party websites, apps and messaging platforms you connect, which are governed by their own privacy policies.
We handle personal data in accordance with the Singapore Personal Data Protection Act 2012 (the "PDPA") as our home framework. Other data protection laws may apply depending on where you are and how you use the Service, and where they do we comply with them in relation to that processing; this policy does not claim to satisfy the law of every country. Capitalised terms used but not defined here have the meaning given to them in the Terms.
1. Who We Are and What This Policy Covers
2. Our Two Roles
Controller. For our business customers and their Users, we decide why and how we handle account, billing, product usage and support data (together, "Account Data"), and the data we collect from our website and marketing ("Website and Marketing Data"). Section 4 sets out our purposes and bases.
Processor. When a business uses the Service to message and manage its own customers and Contacts, that business decides what data enters the Service, why, and for how long. We call that data "Customer Contact Data" — the personal data within the "Customer Data" defined in the Terms and we handle it only on that business's instructions, as a data intermediary under the PDPA and, where those laws apply to the relevant individuals, a processor under laws such as the EU or UK GDPR. Our processing of your Customer Contact Data is governed by our Data Processing Agreement (the "DPA") available on request by contacting [email protected].
If you're a contact/end-customer messaged through the platform by one of our business customers, that business is the controller of your data, and you should direct privacy requests to them.
As the Terms and the DPA set out, our customers remain responsible for having a valid basis to use their Contacts' personal data, for the privacy notice, marketing and opt-out rules their local law requires, for what they store in the Service and for how long, for what they submit to AI Features, and for complying with the terms of the channels they connect.
3. Personal Data We Handle
3.1 Account Data — we are the controller
| Category | What it includes |
|---|---|
| Identity and contact | Name, work email address, phone number, job title, company name |
| Account and access | Login credentials, authentication metadata, user role and permissions, team membership, account settings, subscription and plan information |
| Billing | Billing address, company details, tax identification number, invoices and transaction records. Card and bank details are held by our payment processor, not by us. We use tax identification numbers only to invoice you, calculate taxes and meet tax reporting obligations |
| Product usage | Features used, actions taken, login times, message and contact volumes, performance and error data |
| Device and technical | IP address, browser and operating system, device type, approximate location derived from IP address, request identifiers |
| Support and sales | Your enquiries, support tickets, demo requests and our correspondence with you |
| AI usage telemetry | Which AI Feature and model were used, token counts, estimated cost and the provider's response identifier. Prompt and response content is not Account Data: it is Customer Contact Data that we log only for a limited period for security and abuse prevention |
- Billing and transaction details needed to provide paid plans and process payments
3.2 Customer Contact Data — we are a processor
This is the data our business customers bring into the Service, and we do not choose what it contains. It typically includes contact records and custom fields; message content, attachments and channel metadata from the channels they connect; CRM, ticketing and workflow records; files and media; AI agent instructions and knowledge sources; the prompts submitted to and responses generated by AI Features, which we also log for a short period for security and abuse prevention as described in section 8; voice notes, call audio and the transcripts and audio our AI Features generate from them; and audit records of who changed what and when.
- Messages and metadata from connected channels (WhatsApp, Instagram, Facebook, TikTok, Telegram, Gmail, X, Threads, LinkedIn, YouTube, Google Business, web widget)
- CRM records our customers create (contact names, phone numbers, emails, deal/ticket history)
- Any data our business customers choose to input into automations or the AI agent builder
3.3 Website and Marketing Data — we are the controller
- Cookies and similar technologies used on mobitech.ai, as described in our Cookie Policy
- Analytics data about how the website is used, including pages visited and referral source
- Contact form and "talk to sales" submissions
- Marketing preferences and whether you have opened or clicked our messages
4. Why We Use Personal Data, and on What Basis
The table below covers Account Data and Website and Marketing Data, where we are the controller; for Customer Contact Data our customer determines the purpose and the basis and we act on its instructions. Where we give a basis under the GDPR and similar laws, the position under the PDPA is consent including deemed consent where the processing is reasonably necessary to perform our contract with you or the statutory exception noted.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Provide and maintain the Service | Account Data, Customer Contact Data | Contract necessity |
| Billing and payment processing | Account Data (billing details) | Contract necessity |
| Customer support | Account Data, relevant Customer Contact Data | Contract necessity / legitimate interest |
| Product improvement, analytics | Usage data (aggregated where possible) | Legitimate interest |
| Security, fraud prevention | Account Data, usage logs | Legitimate interest / legal obligation |
| Marketing communications (to prospects/customers) | Contact form data, business email | Consent / legitimate interest (opt-out available) |
| AI feature functionality | Customer Contact Data, as configured by our business customers | Contract necessity (processed on customer's instructions) |
We do not use Customer Contact Data to train AI models shared across customers without explicit agreement; any AI processing of a customer's data is scoped to that customer's own account unless otherwise disclosed in a DPA.
5. AI Features
5.1 What They Do
Where you enable them, the "AI Features" defined in the Terms can draft and suggest replies, answer common questions, classify and route conversations, extract information from messages, run the automations you build and, where voice features are enabled, transcribe voice notes and call audio and generate spoken audio in reply. When an AI Feature runs we send the model provider only what the task requires, typically the recent messages in that conversation, the relevant contact record and the relevant part of your knowledge base — not your full contact list or conversations the feature is not handling.
5.2 Which Model Providers We Use
We use third-party large language model providers to deliver AI Features. As at the date of this policy, our AI Features are delivered using OpenAI models accessed through Azure OpenAI Service enterprise endpoints hosted in the United States, configured so that submitted data is not retained by the provider and is not used to train its models. A current list of our model providers and their processing locations is available to business customers on request. Where a provider processes personal data outside Singapore, section 7 applies.
5.3 We Do Not Train AI Models on Customer Contact Data
We do not use Customer Contact Data, including message content, conversation history, AI prompts and responses, contact records, uploaded files or knowledge sources, to train, develop or improve general purpose or foundation AI models, whether ours or a third party's. Data received through Meta channels or Google services is never used to create, train or improve AI models in any form.
5.4 Human Involvement
AI Features assist your team; they do not replace it. Your team configures what an AI agent may do and can review, edit or override its output. We do not use automated processing to make decisions about individuals that produce legal effects or similarly significantly affect them, and we do not profile the people our customers communicate with.
5.5 Your Controls
- AI Features are optional. An account administrator enables them, can turn them off, and configures what an AI agent is permitted to do.
- You can review, edit, export and delete the knowledge sources and stored information your AI agents use.
- You control whether a third-party service is connected, and can revoke that connection at any time.
8. How Long We Keep Personal Data
We keep personal data only as long as it serves the purpose it was collected for, or as long as we need it to meet a legal or business requirement.
- Account Data: retained for the life of your account plus 90 days after termination for legal/accounting purposes, unless a longer period is required by law.
- Customer Contact Data: retained per our business customers' configured retention settings, or until 30 days after their account termination, then deleted or anonymized.
- Marketing/website data: cookies expire per the retention periods listed in our Cookie Policy; contact form submissions retained for 12 months unless a business relationship continues.
7. International Transfers
Mobitech is based in Singapore and the Service is available worldwide. Personal data may therefore be transferred to, stored in and accessed from countries other than your own, including our cloud hosting region (currently Singapore, including for backups) and the countries in which our model providers, channel providers and other service providers operate.
Where personal data leaves the country it was collected in, we take the steps the PDPA requires to ensure the recipient is bound by legally enforceable obligations to protect it to a comparable standard, normally by contract. Where the GDPR applies to a transfer from the EEA or the United Kingdom, we rely on an adequacy decision where one applies, and otherwise on the European Commission's Standard Contractual Clauses with the UK Addendum or the UK International Data Transfer Agreement.
10. Your Rights
Depending on where you are and which law applies, you may have the right to (though not every right is available under every law — for example, data portability is not currently in force under the Singapore PDPA):
- Be told whether we hold personal data about you, and receive a copy of it
- Have inaccurate or incomplete personal data corrected
- Have personal data deleted
- Receive personal data in a portable format, or have it transmitted to another provider
- Object to processing, or ask us to restrict it
- Withdraw consent where we rely on it, on reasonable notice; we will tell you the likely consequences first and may continue any processing the law permits without consent
- Opt out of marketing communications
- Object to decisions made solely by automated means, and ask for information about how they were made
- Complain to your data protection authority
10.1 How to Make a Request
Email your request to [email protected]. We may ask for information to verify your identity, and we use it only for that purpose.
We do not normally charge, but we may charge a reasonable fee for repeated or excessive requests and for access requests where the PDPA permits, and we will tell you the fee first. Where an exemption from access applies under the PDPA or equivalent law, we will tell you what we withheld and why. We respond within 30 days under the PDPA, within one month under the GDPR (extendable by two months for complex or numerous requests), and within the period any other applicable law requires. If you are not satisfied, reply to our response and our Data Protection Officer will review it.
10.2 If a Business Messaged You Using the Service
Section 2 applies: that business is responsible for your data and is the right place to send your request. We will not delete or change data in a customer's account except on that customer's instructions or where the law requires us to.
13. Children
The Service is for businesses and is not directed to children. We do not knowingly collect personal data from children, and account holders must be at least 18 years old.
Some of our customers operate schools, tuition centres, childcare, clinics and similar services, and their Contacts may include children. Where that is the case, the customer is responsible for having a valid basis to process a child's personal data, including obtaining verifiable parental or guardian consent where its local law requires it, and we process that data only as its processor, on its instructions.
If you believe a child's personal data has been submitted to us in breach of this policy, contact [email protected] and we will look into it.
9. Security and Data Breaches
We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, restricted and logged access to production systems with multi-factor authentication, separation of customer accounts, monitoring and alerting, and security review of our providers. For Customer Contact Data, our security commitments to business customers are set out in the DPA.
Security is shared: our customers manage their own users and permissions, keep credentials secure, enable available protections, and decide who may connect third-party services or enable AI Features. No method of transmission or storage is completely secure, and we do not represent that our systems cannot be compromised.
If a personal data breach occurs we will assess it promptly and, where it meets the applicable notification threshold, notify the authorities and affected individuals as the law requires: in Singapore, the Personal Data Protection Commission as soon as practicable and no later than 3 calendar days after we determine that the breach is notifiable; in the EEA and the United Kingdom, the competent supervisory authority without undue delay and, where feasible, within 72 hours, and affected individuals where the breach is likely to result in a high risk to their rights and freedoms. Other jurisdictions apply their own periods, several of which are 72 hours or shorter.
Where we act as a processor, we will notify the affected business customer without undue delay, as set out in the DPA, so that it can meet its own obligations.
11. Marketing Communications
If you sign up for a Mobitech account, we may send you marketing about our products on the basis of our existing business relationship, where the law allows it. Where the law requires consent, we ask for it separately from signup.
You can opt out at any time by emailing [email protected] or, where our marketing messages include one, by using the unsubscribe link in the message. Opting out does not stop service communications about your account, billing, security or changes to the Service.
We do not currently send marketing by call or text message to telephone numbers. If we do, we will comply with the Do Not Call provisions of the PDPA and, for electronic messages sent in bulk, the Spam Control Act 2007.
Marketing sent by our customers through the Service is theirs, not ours. If you want it to stop, tell that business, and see section 2.
12. Cookies and Similar Technologies
We use cookies and similar technologies on mobitech.ai for essential site functions, to understand how the site is used and to measure our marketing. Our Cookie Policy at mobitech.ai/cookies sets out which cookies we use, what they do, how long they last and who provides them. Inside the product we use them only as necessary to run the Service, maintain your session, store workspace preferences and keep your account secure.
Where the law requires consent for non-essential cookies on our public website, we ask for it before placing them. You can change or withdraw your choices at any time using your cookie preferences, and doing so does not affect your account or the Service you receive.
14. Changes to This Policy
We may update this policy as the Service and the law develop; the "last updated" date shows when we last changed it. Where a change materially affects how we handle your personal data, we will notify account holders by email or in the product at least 14 days before it takes effect, consistent with clause 16.2 of the Terms. Where a change introduces a new purpose for which the law requires your consent, we will ask for that consent rather than rely only on your continued use. Previous versions are available on request.
15. Contact Us
Marvel Integration Technology Pte. Ltd.
391B Orchard Road, #2200, Ngee Ann City Tower B, Singapore 238874
Data Protection Officer and privacy enquiries: [email protected]
Our Data Protection Officer oversees compliance with this policy and is your point of contact for privacy questions, requests and complaints. We keep written data protection agreements in place with our business customers and with the providers who process personal data on our behalf, and we review those providers and their security before engaging them and periodically afterwards. If you are not satisfied with how we handled your request or complaint, you can complain to your data protection authority; in Singapore that is the Personal Data Protection Commission.