Legal
Privacy Policy
Last updated: 2 October 2026
This document describes our practices based on the current platform. Review by qualified legal counsel is recommended before reliance in regulated contexts.
Who we are
Numeraxia Technologies Pte. Ltd. ("Numeraxia", "we", "us") operates the Numeraxia AI Sales Workforce platform for SMEs in Singapore, Malaysia, and the United States.
Data Protection Contact: privacy@numeraxia.com · 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051.
Singapore & Malaysia data protection
We design platform controls and published policies to support subscribers subject to Singapore's Personal Data Protection Act 2012 (PDPA) and Malaysia's Personal Data Protection Act 2010 (Act 709).
Where you use Numeraxia to process your customers' data, you are typically the data controller (Singapore) / data user (Malaysia) and Numeraxia acts as processor on your instructions under our Data Processing Agreement.
| Jurisdiction | Law | Supervisory authority |
|---|---|---|
| Singapore | PDPA 2012 | Personal Data Protection Commission (PDPC) |
| Malaysia | PDPA 2010 (Act 709) | Department of Personal Data Protection (JPDP) |
Personal data we collect
- Account data: name, username, email, role
- Lead & CRM: contact details, chat messages, interest notes
- Visitor sessions: session token, hashed IP, user agent
- Business configuration: services, FAQs, products
- Billing references via Stripe (no full card numbers stored by us)
- Integration credentials (encrypted at rest)
- Audit and security logs
AI and automated processing
We use OpenAI models (default gpt-4o-mini) for receptionist chat, lead scoring, intent extraction, and workforce tasks. AI outputs may be inaccurate — subscribers must review material decisions.
When configured, message content and business context may be sent to OpenAI for inference. We use store=false where supported to minimise provider retention.
Storage and cross-border transfers
| Component | Location | Notes |
|---|---|---|
| Supabase Postgres | ap-southeast-1 (Singapore) | Primary tenant data |
| OpenAI API | United States | LLM inference |
| Stripe | United States | Payments |
| Vercel | Global edge | Frontend |
Retention
- Lead & CRM: subscription term + up to 90 days
- Visitor sessions: up to 24 months
- Audit logs: up to 24 months
- Export and deletion available via Settings or privacy@numeraxia.com
Security
JWT authentication, RBAC, Fernet encryption for credentials, Postgres RLS lockdown, audit logs, webhook verification, and rate limiting. See our Trust Center for details.
Your rights — Singapore (PDPA 2012)
- Access and correction of personal data we hold about you
- Withdraw consent where processing is consent-based
- Request deletion subject to legal, security, and contractual retention
- Complaints to PDPC if unresolved — we encourage contacting us first at privacy@numeraxia.com
Your rights — Malaysia (PDPA 2010)
- Access and correction of your personal data
- Withdraw consent and opt out of direct marketing
- Limit processing that may cause damage or distress where applicable
- Complaints to JPDP if unresolved — contact privacy@numeraxia.com or your subscribing business first
Consent, marketing & cross-border transfers
- Singapore: telemarketing to Singapore numbers may require DNC Registry checks or valid consent
- Malaysia: direct marketing to individuals generally requires consent; honour opt-outs promptly
- Both: disclose when data is processed outside the country (e.g. OpenAI inference in the United States) and obtain consent or another lawful basis as required
- We target a response to rights requests within 30 days where practicable