AIMSify Privacy Policy
Effective date: 10-Apr-2026 Last updated: 10-Apr-2026
AIMSify is a product of Artan Consulting Pte Ltd, a company incorporated in Singapore ("Artan Consulting", "we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you access or use the AIMSify platform at aimsify.ai and related services (the "Service").
We take privacy seriously because of what the Service is: AIMSify is a governance, risk and compliance ("GRC") platform, and the information our customers entrust to it is often sensitive. This policy is written to comply with Singapore's Personal Data Protection Act 2012 ("PDPA") and, where applicable, the EU/UK General Data Protection Regulation ("GDPR").
1. Who we are and how to contact us
The data controller responsible for your personal data is:
Artan Consulting Pte Ltd Singapore Email: rajesh@artanconsulting.com Phone: +65-8606-2966
If you have questions about this policy, wish to exercise your rights, or want to raise a privacy concern, contact us using the details above.
2. Scope of this policy
This policy applies to:
- Visitors to aimsify.ai;
- Account users of the AIMSify platform (the individuals at our customer organisations who log in and use the Service); and
- Other individuals whose personal data we may process in the course of providing the Service.
This policy describes how we handle personal data for which we act as the controller — primarily account, identity and usage data. Where our customers upload data into AIMSify (including compliance evidence, registers and other governance content) we generally act as a data processor / data intermediary on their behalf, and our handling of that data is governed by our customer agreement (Terms & Conditions) and any applicable Data Processing Agreement, not solely by this policy. See Section 4.3.
3. The personal data we collect
3.1 Account and identity data
When an account is created for you, we collect your name, work email address, organisation, role/job title, and authentication credentials. Authentication is handled by our identity provider (see Section 7).
3.2 Usage and technical data
When you use the Service we automatically collect technical and usage information, including IP address, device and browser type, log data, pages and features accessed, actions taken, timestamps, and similar telemetry. We use this to operate, secure and improve the Service.
3.3 Customer Content (data you upload into AIMSify)
The Service is designed for customers to store and manage governance, risk and compliance information. This Customer Content may include risk registers, policies, controls, audit and assessment records, evidence files, supplier information, and related records. Customer Content may contain personal data about your employees, contractors or other individuals (for example, control owners or risk owners named in a register).
For Customer Content, the customer organisation is the controller and Artan Consulting acts as the processor / data intermediary. We process Customer Content only to provide the Service and on the customer's documented instructions, as set out in our Terms & Conditions and any Data Processing Agreement.
3.4 Communications
If you contact us by email, phone or through the Service, we keep a record of that correspondence.
3.5 Cookies and similar technologies
See Section 13.
We do not intentionally collect special categories of personal data (such as health, race or political opinions) about visitors or account users for our own purposes. Customer Content is controlled by the customer.
4. How we use personal data and our legal basis
We use personal data for the following purposes:
| Purpose | Examples | Legal basis (PDPA / GDPR) |
|---|---|---|
| Provide and operate the Service | Authenticate users, deliver features, store Customer Content | Performance of contract; PDPA consent / legitimate interest |
| Secure the Service | Monitoring, abuse and fraud prevention, audit logging | Legitimate interests (GDPR Art. 6(1)(f)); PDPA legitimate interest |
| Support and communicate with you | Respond to queries, send service notices | Performance of contract; legitimate interests |
| Improve the Service | Analyse usage, fix bugs, develop features | Legitimate interests |
| Billing and administration | Manage subscriptions, invoicing | Performance of contract; legal obligation |
| Comply with law | Respond to lawful requests, meet regulatory obligations | Legal obligation |
We do not sell personal data, and we do not use Customer Content to train our own or third parties' AI models. See Section 6.
5. AI processing
AIMSify is an AI-native platform. Certain features use third-party large language model services (currently Anthropic) to help generate, summarise or analyse content. When such a feature is used, relevant inputs may be transmitted to that provider to return a result.
- We use providers that offer enterprise terms with no-training and limited-retention commitments where available, so your inputs are not used to train their models.
- AI-generated output may be inaccurate or incomplete and is intended to assist, not replace, professional judgement. The Service surfaces such output for human review.
6. How we share and disclose personal data
We do not sell personal data. We disclose personal data only as follows:
6.1 Sub-processors / service providers
We rely on trusted third parties to operate the Service. Each is bound by contractual confidentiality and data-protection obligations and processes data only on our instructions:
| Sub-processor | Function | Processing location |
|---|---|---|
| Neon | Managed PostgreSQL database hosting | Singapore |
| Vercel | Application hosting and delivery | Refer to provider's terms |
| Clerk | User authentication and identity | Refer to provider's terms |
| Anthropic | AI / large language model features | Refer to provider's terms |
6.2 Legal and regulatory
We may disclose personal data where required by law, regulation, court order, or lawful request by a public authority.
6.3 Corporate transactions
If Artan Consulting is involved in a merger, acquisition or asset sale, personal data may be transferred as part of that transaction, subject to this policy.
6.4 With your consent
We may share personal data for other purposes with your consent.
7. Where your data is stored and international transfers
The primary AIMSify production database is hosted with Neon in Singapore. Some sub-processors (Section 6.1) may process limited data outside Singapore. Where personal data is transferred internationally, we take steps to ensure it receives a standard of protection comparable to that under the PDPA, and — where the GDPR applies — we rely on an appropriate transfer mechanism (such as Standard Contractual Clauses).
8. Data retention
We retain personal data for as long as necessary to provide the Service, to comply with legal, accounting or regulatory obligations, to resolve disputes, and to enforce our agreements. Customer Content is retained for the duration of the customer's subscription and returned or deleted following termination in accordance with the Terms & Conditions / DPA. When personal data is no longer required, we securely delete or anonymise it.
9. How we protect your data
We implement reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the data, including encryption in transit, access controls and role-based permissions, audit logging, multi-tenant data isolation, and the use of reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your rights
Subject to applicable law, you may:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete personal data;
- Withdraw consent to processing (this may affect our ability to provide the Service); and
- where the GDPR applies, additionally request erasure, restriction, data portability, and object to certain processing.
To exercise any right, contact us using the details in Section 1. We will respond within the timeframe required by applicable law. Where you have uploaded Customer Content controlled by your organisation, please direct rights requests to that organisation; we will assist them as their processor.
11. Cookies and similar technologies
We use cookies and similar technologies that are strictly necessary to operate the Service (for example, to keep you logged in), and may use analytics cookies to understand and improve usage. You can control non-essential cookies through your browser settings or any cookie banner we provide.
12. Children
The Service is a business tool intended for use by organisations and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children.
13. Data breach notification
If we become aware of a data breach affecting personal data, we will assess it and, where required by the PDPA, GDPR or other applicable law, notify the relevant supervisory authority and affected individuals or customers within the legally required timeframes. Where we act as a processor, we will notify the affected customer (controller) without undue delay.
14. Third-party links
The Service or our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites; please review their policies.
15. Changes to this policy
We may update this policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, take additional steps to notify you.
16. Contact
Questions, requests or complaints about this policy or your personal data:
Artan Consulting Pte Ltd Email: rajesh@artanconsulting.com Phone: +65-8606-2966
If you are in Singapore and are not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC). If the GDPR applies to you, you may also lodge a complaint with your local data-protection authority.
AIMSify is a product of Artan Consulting Pte Ltd, Singapore.