Privacy Policy

01Who we are and who this policy covers

SME AI Office ("we", "us", "our") is run by Alpha Digital Technologies Pte. Ltd., a company registered in Singapore (UEN 202348992K). We are the organisation responsible for the personal data described in this policy, under Singapore's Personal Data Protection Act 2012 (PDPA).

This policy covers:

• Business owners and their teams who use SME AI Office: the back office, each Business app, and the websites it runs.
• Visitors to smeaio.com, including anyone who uses the chat on our website or contacts us.

A business that uses SME AI Office also keeps details of its own customers, members, students and staff in it. For those people, the business is the organisation responsible for their data, and we look after it on the business's behalf. Section 06 explains how. Every website we run for a business has that business's own privacy policy, linked at the bottom of its pages.

We have appointed a Data Protection Officer. For any data protection question or request, contact our DPO at [email protected].

02What we collect

We never collect or store full card numbers: card payments are taken by the payment provider on its own secure page. We do not ask for your own NRIC or passport number to open an account.

03How we use it

• To provide SME AI Office and the features you choose to use
• To send you emails and alerts about your account, such as sign-in codes, receipts for your plan, new orders and bookings
• To send you a small number of emails about SME AI Office itself. Each one has an unsubscribe link, and unsubscribing never stops your account emails
• To answer your questions, and to set up your account when you ask us to
• To keep accounts and payments safe, for example by confirming your email and WhatsApp number before your account can send emails or take payments
• To find and fix faults, and to understand which features are useful
• To meet our legal obligations

We never sell your data. We never use your business records, or the details of your customers or staff, for advertising. We never use any of it to train an AI model.

04When we use AI, and what is sent

On the Free plan, nothing in your account is sent to an AI service. The features below are part of our paid plans and are offered in Singapore only. On the Free plan, and on every account outside Singapore, they are switched off, so they never run. The one exception is free setup, and only when you ask for it.

Where we use AI, it is Claude, made by Anthropic, through Anthropic's paid service for businesses. Each feature sends only what it needs, and only at the moment you (or, for website chat, your visitor) use it:

Anthropic does not use what we send to train its models. It keeps it only for a short period to keep its service safe, and then deletes it. Anthropic processes data in the United States. AI never changes your records on its own: scanned receipts and suggestions wait for you to check them.

Two more places use AI, and neither involves your account's records:

• The chat on smeaio.com answers visitors' questions about SME AI Office. What you type there is sent to Claude to write the answer. Please do not type anything private into it.
• Connecting Claude yourself. On any plan, you can choose to connect your account to your own Claude account. That is your choice and is explained in section 10.

If we add AI to any other feature, we will add it to this section before it goes live.

05Who we share data with

We do not sell personal data. We share it only with the companies that help us run the service, and each receives only what its job needs:

Each of these companies handles data on our behalf, and we choose them because they protect it to a standard comparable to the PDPA. Some of them process data outside Singapore, mainly in the United States. We remain responsible for how they handle your data.

Partners. Some links in SME AI Office, such as opening a HitPay or Aspire account, are partner links and we may earn a referral fee. We never pass your details to a partner. You sign up with them yourself, and we introduce you to any other partner only when you ask us to.

The law. We may disclose data to government authorities or law enforcement where Singapore law requires it.

06Data about your customers and staff

When you keep details of your customers, members, students, their parents or your staff in SME AI Office, you are the organisation responsible for that data under the PDPA, and we are your data intermediary. That means:

• We use it only to provide the features you use, and as you instruct.
• We never contact your customers to market SME AI Office, and we never sell or share their details. The emails we send them, such as order confirmations, booking reminders, receipts and review requests, are sent for you, in your business's name.
• Review requests and other promotional emails carry an unsubscribe link. Someone who unsubscribes still receives their receipts, bookings and invoices.
• You are responsible for having your customers' and staff's consent where the PDPA needs it, and for answering their requests to see or correct their data. We help you do this.
• Your website has its own Terms and Privacy policy, written from your business details, which you can edit. Please make sure they suit your business.

07Who at SME AI Office can see your data

Our team can see the account details needed to run the service and support you: your name, email, WhatsApp number, business name, plan and how you signed up.

We open your business records, including your customers' and staff's details, only:

• when you ask us to, for example a support request or free setup;
• to find and fix a fault, or to protect the service and its users from misuse; or
• when the law requires it.

We use what we see only for that purpose.

08Connecting your Google Calendar

Bookings can connect to your Google Calendar. This is optional, is off unless you switch it on, and you can disconnect at any time from inside your account.

What we ask Google for. Three permissions, and nothing wider:

• Create one calendar of our own in your Google account, named “SME AI Office Bookings”, and manage only the entries we put into it.
• See when you are busy.
• See the names of your calendars, so that you can choose which of them close your booking page.

What we can see. Only the times you are busy, and the names and identifiers of your calendars. We cannot see the title, description, location, guests or any other content of your calendar entries, and that content is never sent to us. We cannot read, change or delete any entry we did not create ourselves.

What we store. The times you are busy, stored as blocked-out periods against your account so that your booking page can close them; the identifiers of the calendars you chose; the email address of the Google account you connected; and an encrypted key that lets us keep reading your availability until you disconnect. We do not store the contents of your calendar entries, because we never receive them.

What we use it for. Only the function you connected it for: writing your bookings into your Google Calendar, and closing your booking page during the times you are busy. We do not use it for any other purpose, we do not sell it, we do not use it for advertising, and we do not use it to train any AI model.

Disconnecting. Disconnecting withdraws our access and deletes the stored key. Time that was blocked out because of Google goes back on sale on your booking page. The “SME AI Office Bookings” calendar and the entries in it remain in your Google account until you delete them yourself.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

09Connecting your Aspire account

You can connect a business account you hold with Aspire, so that an order or booking marks itself as paid when your customer’s PayNow payment arrives. This is optional, is off unless you connect it, and you can disconnect at any time from Payments inside your account. Only the account owner or a co-owner can connect or disconnect it.

What you give us. A client ID and an API key that you create yourself in Aspire. We ask you to create the key with permission to read transactions and nothing else. We only ever read with it: nothing in SME AI Office can make a payment, move money or change anything in your Aspire account.

What we can see. Your recent transactions, which is what Aspire returns to a key with that permission. For each transaction this includes the date and time, the amount, whether money came in or went out, the payment reference, the name Aspire shows for the other party, and the account balance. We read at most the last 7 days at a time, and only while a payment is waiting, or when you connect the key or ask us to check that it works.

What we store. Your client ID and API key, encrypted, and the time the connection was last checked. When a payment matches, we store Aspire’s identifier and bank reference for that one payment against the order or booking. We do not store any of your other transactions: they are held in memory for a few seconds while we look for a match and then discarded, and they are not shown on any screen.

What we use it for. Only to tell whether something has been paid. When a payment’s reference and amount both match exactly, it is confirmed on your behalf in the same way as if you had confirmed it yourself. We do not use your Aspire data for any other purpose, we do not sell it, we do not use it for advertising, and we do not use it to train any AI model.

Other people in your transactions. Your transactions may name people and businesses who pay you or whom you pay. In reading them we act on your behalf, as your data intermediary under the PDPA, and only for the purpose described above.

Disconnecting. Disconnecting deletes the stored key immediately, and payments go back to you confirming them yourself. You can also revoke the key in Aspire at any time, which ends our access at once. The identifier and reference already stored against confirmed payments stay as part of your records. Deleting your account deletes the key along with everything else.

10Connecting Claude yourself

This is separate from the features in section 04. You can connect SME AI Office to your own account with Claude, the AI assistant made by Anthropic, so that Claude can read your business records and answer your questions about them. This is optional, nothing is connected unless you connect it, and you can disconnect at any time from Settings → Claude inside your account, or from Claude’s own connector settings.

How it is connected. You add SME AI Office in Claude, sign in to SME AI Office, and choose Allow. The connection belongs to you and to the one company that was open in your account when you allowed it. We give Claude a key that lasts one hour and a renewal key that lasts up to 60 days. We store only a one-way fingerprint of each key, never the key itself.

What Claude can read. Only the parts of SME AI Office your own access to that company includes, which may cover its profit and loss and the entries behind it, balance sheet, GST figures, invoices, payroll and staff costs, contacts, bookings, shop orders, stock and company compliance records. Contacts’ email addresses and mobile numbers are sent only when Claude asks for them. By default Claude can only read.

Letting Claude suggest entries (beta). If you turn this on for a connection, which is off unless you choose it, Claude can also send suggestions to a “From Claude” list in your account: a new expense, income or asset, a new contact, or a draft invoice, and the receipt file for an entry if you choose to send it. Nothing is added to your records until you, or someone in your team with edit access, approves it, and Claude cannot change or delete anything already in SME AI Office. Suggestions are kept in your account with the rest of your records, and a receipt file you send is stored in the same way as one you upload yourself.

Where the data goes. What Claude reads is sent to Claude under your own Claude account, at your request, and is handled by Anthropic under the terms and privacy policy you agreed with them, not under this policy. Anthropic is not our service provider for this feature; you are directing us to send your records to a service you chose. Your records may include personal data about other people, such as your customers and staff. In sending it at your direction we act on your behalf, and you are responsible for having the right to share it with Claude.

What we store. The app that connected, which account and company it is for, whether it may suggest entries, when it was connected and when it was last used. We do not store the questions you ask Claude or its answers.

Disconnecting. Disconnecting ends Claude’s access immediately and deletes its keys. The connection also ends by itself if you are removed from the company or your account is deleted. Anything Claude has already read stays in your Claude account until you delete it there.

11How we protect your data

Our application runs on Amazon Web Services in Singapore, and your data is stored on Supabase, also hosted by Amazon Web Services in Singapore (ap-southeast-1). We protect it in these ways:

• All traffic is encrypted in transit (HTTPS / TLS), and the database is encrypted at rest.
• Sensitive fields, including staff NRIC / FIN, bank details and salaries, and your customers' and contacts' names, phone numbers and emails, are also encrypted one by one (AES-256).
• Database rules keep each business's records to that business, so one account cannot read another's.
• Passwords are stored only as a one-way hash, and you can turn on two-step sign-in.
• Your team members see only the parts of the account you give them.
• Uploaded files are kept in private storage and opened through links that expire.
• Your Telegram chat ID is stored only as a one-way hash.

No security system is perfect, and we cannot guarantee absolute security. If a data breach affects your personal data, we will assess it promptly under the PDPA. If it is notifiable, we will tell the Personal Data Protection Commission within the required time, and tell the people affected where there is likely to be significant harm.

12How long we keep your data

We keep your data for as long as your account is open. You can delete your account at any time from Settings → Delete Account. Your account, your records and your uploaded receipts and payslips are deleted straight away. Other files you uploaded, such as product photos, staff documents and free-setup files, are deleted within 30 days.

Our nightly backups are kept for 7 days and then permanently deleted, so deleted data is gone from them within 7 days. We may keep certain records for longer where Singapore law requires it, for example for tax.

13Your rights

Under the PDPA, you can:

• ask for a copy of the personal data we hold about you
• ask us to correct it
• withdraw your consent to our using it (which may mean we can no longer provide the service)
• delete your account and its data

You can delete your account yourself from Settings → Delete Account, with no email needed. For anything else, email [email protected] and we will reply within 10 business days. If you are a customer of a business that uses SME AI Office, please contact that business first; we will help it answer you.

14Cookies and analytics

We use Google Analytics and Microsoft Clarity to understand how our website and app are used. They may use cookies or browser storage. Clarity records clicks and scrolling. Inside the app it is set to hide all text, numbers and typing on the screen, so it never sees your figures or your customers' or staff's details.

We advertise on Facebook and Instagram, so our public website also uses the Meta Pixel. It tells Meta which pages were visited, when someone taps our WhatsApp link, and when a new account is created, so we can see which ads work. Meta handles this under its own privacy policy. The Meta Pixel never runs inside the app, so it never sees your business data. You can limit ad tracking in your browser or in your Facebook ad settings.

When you are signed in, we also keep our own record of which app pages you opened, when, and how long you were signed in. It records page names and times only, never the figures, documents or customer details on those pages.

The websites we run for businesses use only the cookies and storage they need to work, such as remembering a shopping bag or keeping a customer signed in.

15Children

You must be 18 or over to open an SME AI Office account. A business such as a learning centre may keep details of children in its records, given by their parents. That is the business's data, covered by section 06 and the business's own privacy policy.

16Changes to this policy

We may update this policy from time to time. When we do, we change the date at the top of this page, and we email you if the change is important. Continuing to use SME AI Office after a change takes effect means you accept the updated policy.