Privacy Policy
DRAFT — for legal review. This document is a working draft. It has not yet been reviewed by a Singapore-qualified solicitor or PDPA practitioner. Do not rely on it as legal advice. Have a lawyer review it before publishing.
This policy explains what personal data evercom.ai collects when you use this website or engage us for Sleepwell services, and how we protect it. We follow the Singapore Personal Data Protection Act 2012 (PDPA).
1. What we collect
- Enquiry details: your name, work email and business name, submitted through our form.
- Engagement communications: emails, call notes and the contact details of people you nominate.
- AWS account information: during a scan, our read-only role reads your account ID, resource names, tags, configuration settings, and cost and usage data. It is not designed to read the contents of your files, databases or applications. Resource names and tags can sometimes contain personal data, which we then handle under this policy.
- Payment details: if you pay us, we keep invoice records. We do not store card numbers.
2. Why we use it
- To reply to your enquiry and set up your engagement;
- To produce your report and carry out the work you approve;
- To bill you and keep the records the law requires;
- To keep our services secure and improve them.
We do not sell your data or use it for advertising.
3. Who we share it with
- Amazon Web Services (AWS) hosts this website and our systems.
- Authorities, only where the law requires it.
Your reports and findings are shared only with the contacts you nominate.
4. Where it is stored
Enquiry form submissions are processed in the AWS US East (N. Virginia) region. Reports and scan data are stored in AWS, and we will confirm the region at the start of your engagement. Where data leaves Singapore, we protect it to a standard comparable to the PDPA.
5. How long we keep it
- Enquiries with no engagement: 12 months, then deleted.
- Scan data and reports: for the engagement (or while your Keep-up subscription runs), plus 90 days, then deleted. You may ask us to delete them sooner.
- Invoices: as long as Singapore tax law requires.
- Technical logs: typically 90 days.
6. Your rights
You can ask to access or correct your personal data, or withdraw consent and have it deleted (subject to records we must keep by law). Email evercomai01@gmail.com and we will reply within 30 days. If you are not satisfied, you can complain to the Personal Data Protection Commission.
7. Security
- Encryption in transit (HTTPS/TLS) and at rest;
- Least-privilege, read-only access roles for scans;
- Access to customer data limited to the evercom team.
No system is perfectly secure. If a data breach affects you, we will notify you and the PDPC as the law requires.
8. Cookies
This website does not use cookies, analytics trackers or advertising tools.
9. Changes
If we change this policy in a meaningful way, we will update the date above and tell active customers by email.
10. Contact
Privacy questions or requests: evercomai01@gmail.com.