Privacy Policy

1. Introduction

CANLAH AI Pte. Ltd. ("CANLAH AI", "we", "us", or "our") operates the canlah.ai website and the Canlah client console (canlah.ai/app). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

2. Information We Collect

3. How We Use Your Information

• • To provide and maintain our AI marketing services
• • To train your brand-specific Style Genome™ model (your data is never used to train models for other customers)
• • To process transactions and send billing communications
• • To improve our platform and develop new features
• • To communicate product updates and relevant information
• • To comply with legal obligations

4. Data Security

We implement SOC 2-grade security measures to protect your information:

• ✓ Data isolation — each customer's brand data is stored in isolated environments
• ✓ Encryption at rest and in transit (AES-256 / TLS 1.3)
• ✓ Regular security audits and penetration testing
• ✓ SSO and audit logs available for Enterprise customers
• ✓ Data residency options for compliance requirements

5. Data Sharing

We do not sell your personal information. We may share data with trusted third-party service providers who assist us in operating our platform (cloud infrastructure, payment processing, analytics). All third parties are bound by data processing agreements. We may also disclose information when required by law.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• • Access and receive a copy of your personal data
• • Rectify inaccurate data
• • Request deletion of your data
• • Object to or restrict processing
• • Data portability
• • Withdraw consent at any time

7. Cookies

We use essential cookies to ensure the proper functioning of our website and services. We may use analytics cookies to understand how visitors interact with our site. You can control cookie preferences through your browser settings.

8. Audit Lead Capture & Retention

When you submit your email through the audit-report unlock form, we store the following in Cloudflare D1 (our database, encrypted at rest): email address, your stated role and industry, the URL you audited, your audit score and status, and Cal.com booking details if you book a consultation. This data is used solely to deliver the audit you requested and for direct sales follow-up from the Canlah team. We do not resell or share with third parties.

Retention: lead records are kept for 90 days from your last interaction (audit submission or meeting). After 90 days they are deleted unless you have an active commercial relationship with us.

Sub-processors: Cloudflare (database hosting + edge compute), Google LLC (Gmail API, transactional email), and Cal.com (booking software). Each operates under their own data processing agreement.

Your rights (PDPA / GDPR): access, correction, deletion, and withdrawal of consent. Email privacy@canlah.ai and we will action within 30 days. Our designated Data Protection Officer is Haoyang Pang.

Marketing email & unsubscribe: we only send research updates to addresses that explicitly opted in. Every such message carries a one-click unsubscribe link (and the RFC 8058 List-Unsubscribe headers, so your mail client can unsubscribe you without opening the message). Unsubscribe links do not expire, and we stop sending within 10 business days — the requirements of Singapore's Spam Control Act, Second Schedule. Transactional messages you asked for — the whitepaper PDF, an audit report, a booking confirmation — are not marketing and are unaffected.

Data breach notification: if a breach is likely to result in significant harm or affects 500 or more individuals, we notify Singapore's PDPC as soon as practicable and in any case within 3 calendar days of assessing it as notifiable, and notify affected individuals at the same time — PDPA Part 6A. Where GDPR applies, the lead supervisory authority is notified within 72 hours. Report a suspected breach to privacy@canlah.ai.

9. Google Analytics (GA4) Data Access via Google OAuth

When you choose to connect your Google Analytics 4 (GA4) property, CANLAH AI uses Google OAuth 2.0 to request read-only access to your Google Analytics data (scope https://www.googleapis.com/auth/analytics.readonly). This connection is optional and initiated by you.

What we access: aggregated report data for the GA4 property you authorize — such as sessions, page views, engagement duration, landing pages, traffic sources, and event counts. We use it solely to enrich on-site behavior signals for lead-quality (HQL) scoring and reporting that we provide back to you. We do not access, request, or store Google Ads data, and we do not attempt to re-identify individual end users.

How we store it: your OAuth refresh token is encrypted at rest and used only to fetch the data you authorized. We never store your Google account password. You can revoke access at any time from your Google Account → Security → Third-party apps & services, or by emailing privacy@canlah.ai; revocation immediately stops all further data access.

Limited Use: CANLAH AI's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising, and do not transfer or disclose it to third parties except as necessary to provide the service you requested or as required by law.

10. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at admin@canlah.ai (general) or privacy@canlah.ai (data requests).