Privacy Policy & Data Protection Notice
This Privacy Policy & Data Protection Notice (“Notice”) explains how Zomodus Pte Ltd (“Zomodus”, “we”, “us”), the provider of Zomodus, collects, uses, discloses and protects personal data, in accordance with Singapore's Personal Data Protection Act 2012 (PDPA). It covers personal data in our custody or control, including data processed by service providers acting on our behalf. By using Zomodus you agree to the practices described here. It should be read together with our Terms of Use and Cookie Policy.
Last updated: 3 August 2026
On this page
1. Definitions & who this covers
This policy covers two groups: the businesses that hold a Zomodus account, and the people who answer their surveys. “Personal data” simply means information that can identify you.
“Personal data” means data, whether true or not, about an individual who can be identified from that data — or from that data together with other information we have or are likely to have access to — such as a name, email address or telephone number. Other terms carry the meanings given to them under the PDPA.
This Notice covers two groups of people:
•Account holders — the businesses and individuals who create a Zomodus account to build surveys and read reports.
•Respondents — the people who answer a survey shared by an account holder. Respondents answer anonymously by default and are not asked to create an account.
2. What we collect
From account holders we mainly collect your email and whatever survey content and settings you enter; from respondents we collect their answers plus minimal technical data. Respondents aren’t asked to identify themselves, and IP addresses are stored only as a one-way hash.
From account holders: your email address (used for magic-link sign-in), and any business details, survey content and settings you choose to enter. We also record basic usage and billing information needed to run your account.
From respondents: the answers submitted to a survey, and limited technical data — such as an approximate device type and a one-time token that prevents duplicate submissions. An IP address may be processed transiently for security and is stored only as a one-way hash for abuse prevention, not as a plain address. Respondents are not asked to identify themselves unless the account holder adds a question that requests it.
We do not intentionally collect special categories of sensitive data, and we ask that account holders do not design surveys that solicit it unless they have a lawful basis and the respondent's clear consent.
3. How we use personal data
We use your data to run Zomodus — sign you in, build surveys and reports, take payment, and keep the service secure. Survey responses belong to the account holder; we never sell respondent data or use one customer’s responses for another.
We generally collect personal data only with your knowledge and consent, or as otherwise permitted by the PDPA. We use it to:
•provide and operate Zomodus and perform our contract with you;
•authenticate sign-in and keep your session secure;
•generate questionnaires and reports;
•process subscriptions and payments;
•handle and respond to enquiries, applications, feedback and complaints;
•manage our ongoing customer relationship;
•keep the service secure and prevent fraud or abuse;
•comply with legal and regulatory obligations, and assist law-enforcement authorities where required.
Survey responses belong to the account holder who collected them. We process those responses on the account holder's behalf to produce their report. We do not sell respondent data, and we do not use one customer's responses to benchmark, profile or advertise to another.
We will obtain your consent before collecting additional personal data, or using existing data for a new purpose not described here, unless permitted by law.
4. Reliance on legitimate interests
In limited cases the law lets us process data without consent — mainly to keep the service secure and prevent fraud. We only do this after checking it doesn’t unfairly affect you.
Where the PDPA permits, we may collect, use or disclose personal data without consent under the legitimate interests exception — for example, to secure the service, detect and prevent fraud or abuse, and protect our systems and users. Before relying on this basis we assess that our legitimate interests are not outweighed by any adverse effect on the individuals concerned. These provisions may remain valid for a reasonable period after your relationship with us ends.
5. AI-assisted processing
AI is used for just two things: drafting or polishing questions, and grouping open comments into themes — scores are calculated directly from the data. We don’t use your survey content to train third-party AI models.
Zomodus uses automated and AI-assisted processing for two tasks: drafting or polishing survey questions, and clustering open-ended comments into themes. Numerical results (such as scores and key-driver analysis) are calculated directly from the data. We do not use your survey content to train third-party foundation models.
6. Disclosure to service providers
We share data only with the providers that help run Zomodus (hosting, email, AI processing, payments), under confidentiality and data-protection terms. We may also disclose data where the law requires it.
We share personal data only with service providers who help us run Zomodus, and only as needed to deliver the service — for example: database and application hosting, email delivery (for sign-in links and reports), AI language-model processing (for drafting questions and clustering comments), review-data services (for the multi-outlet review scan), and payment processing where card checkout is enabled. These providers act on our instructions under appropriate confidentiality and data-protection terms.
We may also disclose personal data if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition or reorganisation — in which case we will take reasonable steps to ensure this Notice continues to apply.
7. International transfer & storage
Some of our providers are outside Singapore, so your data may be processed abroad. When that happens, we take steps to protect it to a standard comparable to Singapore’s PDPA.
Zomodus runs on managed, access-controlled cloud infrastructure, and some of our service providers — including database hosting, email delivery and AI language models — are located outside Singapore. Your personal data may therefore be transferred to, and processed in, countries other than Singapore. Where we transfer personal data overseas, we take reasonable steps to ensure the recipient provides a standard of protection comparable to that required under the PDPA.
8. Withdrawing your consent
You can withdraw your consent in writing at any time, and we’ll usually action it within ten business days. Doing so may mean we can no longer provide some or all of the service.
Consent remains valid until you withdraw it in writing. You may withdraw consent for some or all of our processing by writing to our Data Protection Officer (details below). We will usually process a withdrawal request within ten (10) business days; more complex requests may take longer, and we will tell you if so.
Before finalising, we will let you know the likely consequences — for example, that we may be unable to continue providing some or all of the service. You may cancel a withdrawal request in writing at any time. Withdrawing consent does not affect our right to retain or process personal data where permitted or required by law.
9. Accessing & correcting your data
You can ask to see the personal data we hold about you, how it’s been used, and to correct it. We aim to respond within ten business days.
You may write to our Data Protection Officer to request access to the personal data we hold about you and information on how it has been used, or to correct or update it. We may need to verify your identity first, and we may charge a reasonable fee for an access request (we will tell you of any fee beforehand).
We aim to respond within ten (10) business days. If we cannot respond within thirty (30) days, we will let you know in writing within that period when we expect to respond. If we decline a request, we will explain why, unless we are exempt from doing so under the PDPA.
Respondents who wish to access or withdraw a specific survey response should contact the business that ran the survey, as that business controls those responses; we will assist that business where we can.
10. Retention
We keep personal data only while your account is active or as long as we need it to run the service and meet legal duties. Deleted surveys and responses are removed from active systems, then securely destroyed or anonymised.
We keep personal data only for as long as your account is active or as needed to provide the service, and thereafter only as required for legitimate business or legal purposes. Account holders can delete surveys and responses from their account; deleted data is removed from active systems within a reasonable period, after which it is securely destroyed or anonymised.
11. Security & accuracy
We protect your data with encryption in transit, access controls and row-level isolation. No system is perfectly secure, but we keep improving our safeguards and respond quickly to any incident.
We use administrative, physical and technical safeguards — including encryption in transit, access controls, row-level data isolation, need-to-know access and secure disposal — to protect personal data against unauthorised access, use, disclosure, modification or loss. No method of transmission or storage over the Internet is completely secure, but we review and improve our measures and respond promptly to any incident.
We rely on you to keep your personal data accurate and complete; please notify our Data Protection Officer of any changes.
13. Data Protection Officer
You can reach our Data Protection Officer for any privacy question, feedback or request:
•Name: Gary
•Phone: +65 9777 5255
•Email: support@zomodus.com
14. Changes to this Notice
This Notice operates alongside any other notices, terms or consent forms that apply to you. We may update it from time to time; material changes are shown by the “Last updated” date above, and where appropriate we will notify account holders. Continued use of Zomodus after an update means you accept the revised Notice.
15. Contact
For any privacy question or request, email support@zomodus.com or write to Zomodus Pte Ltd at the address below.