Trust Centre · Privacy & PDPA
Designed to support your PDPA obligations.
Compliance with the Personal Data Protection Act is an obligation of the organisation that controls the data — which is you, not us. KrewOS is designed to make discharging it straightforward, and this page maps each obligation to the mechanism that supports it. We do not describe the product as "PDPA compliant", because no tool can be.
Data protection contact: [email protected] · DPA version 2.3, effective 01 Jul 2026
Who is who
Getting the roles right determines who answers a data-subject request and who notifies the PDPC. It is the first question a competent DPO asks.
| Data | You are | wGrow is | Basis |
|---|---|---|---|
| Content your crews process — documents, matters, records | Organisation with control | Data intermediary | DPA, processing only on your documented instructions |
| Knowledge Pack content you upload | Organisation with control | Data intermediary | DPA |
| Evidence records and Correction Records | Organisation with control | Data intermediary | DPA |
| Your users' account data — name, work email, role | Organisation with control | Organisation with control, jointly for platform administration | Contract performance and legitimate interests |
| Support correspondence and billing records | — | Organisation with control | Contract performance and legal obligation |
| Marketing-site enquiries | — | Organisation with control | Consent |
PDPA obligations, and what supports them
The nine obligations, each with the specific product mechanism you would point at during an assessment. The obligation remains yours in every row.
| Obligation | Your responsibility | What KrewOS provides |
|---|---|---|
| Consent | Obtaining and recording consent from your individuals | No collection of personal data from your individuals by us; purpose-scoped Knowledge Packs so content is only retrievable by the crews you authorise |
| Purpose limitation | Defining permitted purposes | Per-project knowledge scoping and access-control lists, plus declared effects so a component cannot quietly use data for something else |
| Notification | Telling individuals what you do | Documented processing description in the DPA you can incorporate into your own notices |
| Access & correction | Responding within statutory timelines | Search across knowledge, runs and evidence by identifier; export in machine-readable form; corrections recorded as append-only Correction Records that supersede without erasing the trail |
| Accuracy | Ensuring data is accurate | Source-attributed retrieval with authority tiers and dated currency, staleness propagation when a source changes, and abstention rather than invention below the evidence floor |
| Protection | Reasonable security arrangements | The full control set on the security page — isolation, encryption, access control, logging, incident response |
| Retention limitation | Setting retention periods | Configurable retention per data class with automatic deletion, plus legal hold on the Regulated tier |
| Transfer limitation | Assessing cross-border transfers | Singapore-only storage and processing; model endpoints constrained to approved in-region jurisdictions by the model profile; subprocessor list published with regions |
| Data breach notification | Assessing and notifying the PDPC and individuals | Notification to you within 24 hours of confirmation, with the facts needed for your assessment, and a written post-mortem within 10 business days |
Retention and deletion
| Data class | Default | Configurable | On termination |
|---|---|---|---|
| Knowledge content | Until deleted | Yes | 30 days, then deleted |
| Run state and artefacts | 12 months | Yes | 30 days, then deleted |
| Evidence records | 12 months | Yes | 30 days, then deleted |
| Audit trail | 7 years | Yes | Exportable, then deleted per your instruction |
| Prompt and completion bodies | 30 days | Yes, or off | Deleted with the workspace |
| Backups | 35 days rolling | No | Expire on the rolling window |
| Account and billing records | 7 years | No | Retained — statutory requirement |
Handling a data-subject request
- Completed: 1 · Locate
- Completed: 2 · Export
- Current step: 3 · Correct or delete
- 4 · Evidence
- Locate
Search knowledge, run history, evidence records and human decisions by identifier across the workspace. You do not need to raise a ticket with us.
- Export
Machine-readable export of everything found, with provenance, so the response you send is defensible.
- Correct or delete
Corrections are recorded as append-only records that supersede prior values; deletions remove content and its derived embeddings, and are propagated to backups on the rolling window.
- Evidence the response
The actions you took are themselves auditable, which is what an assessor will ask for.
No customer content is used to train any model, ours or a provider's. Zero-retention terms are a condition of being on the approved model list, and a model that cannot offer them is not added. See Responsible AI for the list and the policy.
We are a data intermediary for the content your crews process, which means we act only on your documented instructions. If you ask us to do something with that content that your own obligations do not permit, the answer is no, and the DPA says so in writing.