Privacy Policy & Data Protection Notice

1. Definitions & who this covers

“Personal data” means data, whether true or not, about an individual who can be identified from that data — or from that data together with other information we have or are likely to have access to — such as a name, email address or telephone number. Other terms carry the meanings given to them under the PDPA.

This Notice covers two groups of people:

•Account holders — the businesses and individuals who create a Zomodus account to build surveys and read reports.

•Respondents — the people who answer a survey shared by an account holder. Respondents answer anonymously by default and are not asked to create an account.

2. What we collect

From account holders: your email address (used for magic-link sign-in), and any business details, survey content and settings you choose to enter. We also record basic usage and billing information needed to run your account.

From respondents: the answers submitted to a survey, and limited technical data — such as an approximate device type and a one-time token that prevents duplicate submissions. An IP address may be processed transiently for security and is stored only as a one-way hash for abuse prevention, not as a plain address. Respondents are not asked to identify themselves unless the account holder adds a question that requests it.

We do not intentionally collect special categories of sensitive data, and we ask that account holders do not design surveys that solicit it unless they have a lawful basis and the respondent's clear consent.

3. How we use personal data

We generally collect personal data only with your knowledge and consent, or as otherwise permitted by the PDPA. We use it to:

•provide and operate Zomodus and perform our contract with you;

•authenticate sign-in and keep your session secure;

•generate questionnaires and reports;

•process credits and payments;

•handle and respond to enquiries, applications, feedback and complaints;

•manage our ongoing customer relationship;

•keep the service secure and prevent fraud or abuse;

•comply with legal and regulatory obligations, and assist law-enforcement authorities where required.

Survey responses belong to the account holder who collected them. We process those responses on the account holder's behalf to produce their report. We do not sell respondent data, and we do not use one customer's responses to benchmark, profile or advertise to another.

We will obtain your consent before collecting additional personal data, or using existing data for a new purpose not described here, unless permitted by law.

4. Reliance on legitimate interests

Where the PDPA permits, we may collect, use or disclose personal data without consent under the legitimate interests exception — for example, to secure the service, detect and prevent fraud or abuse, and protect our systems and users. Before relying on this basis we assess that our legitimate interests are not outweighed by any adverse effect on the individuals concerned. These provisions may remain valid for a reasonable period after your relationship with us ends.

5. AI-assisted processing

Zomodus uses automated and AI-assisted processing for two tasks: drafting or polishing survey questions, and clustering open-ended comments into themes. Numerical results (such as scores and key-driver analysis) are calculated directly from the data. We do not use your survey content to train third-party foundation models.

6. Disclosure to service providers

We share personal data only with service providers who help us run Zomodus, and only as needed to deliver the service — for example: database and application hosting, email delivery (for sign-in links and reports), AI language-model processing (for drafting questions and clustering comments), review-data services (for the legacy audit feature), and payment processing where card checkout is enabled. These providers act on our instructions under appropriate confidentiality and data-protection terms.

We may also disclose personal data if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition or reorganisation — in which case we will take reasonable steps to ensure this Notice continues to apply.

7. International transfer & storage

Zomodus runs on managed, access-controlled cloud infrastructure, and some of our service providers — including database hosting, email delivery and AI language models — are located outside Singapore. Your personal data may therefore be transferred to, and processed in, countries other than Singapore. Where we transfer personal data overseas, we take reasonable steps to ensure the recipient provides a standard of protection comparable to that required under the PDPA.

8. Withdrawing your consent

Consent remains valid until you withdraw it in writing. You may withdraw consent for some or all of our processing by writing to our Data Protection Officer (details below). We will usually process a withdrawal request within ten (10) business days; more complex requests may take longer, and we will tell you if so.

Before finalising, we will let you know the likely consequences — for example, that we may be unable to continue providing some or all of the service. You may cancel a withdrawal request in writing at any time. Withdrawing consent does not affect our right to retain or process personal data where permitted or required by law.

9. Accessing & correcting your data

You may write to our Data Protection Officer to request access to the personal data we hold about you and information on how it has been used, or to correct or update it. We may need to verify your identity first, and we may charge a reasonable fee for an access request (we will tell you of any fee beforehand).

We aim to respond within ten (10) business days. If we cannot respond within thirty (30) days, we will let you know in writing within that period when we expect to respond. If we decline a request, we will explain why, unless we are exempt from doing so under the PDPA.

Respondents who wish to access or withdraw a specific survey response should contact the business that ran the survey, as that business controls those responses; we will assist that business where we can.

10. Retention

We keep personal data only for as long as your account is active or as needed to provide the service, and thereafter only as required for legitimate business or legal purposes. Account holders can delete surveys and responses from their account; deleted data is removed from active systems within a reasonable period, after which it is securely destroyed or anonymised.

11. Security & accuracy

We use administrative, physical and technical safeguards — including encryption in transit, access controls, row-level data isolation, need-to-know access and secure disposal — to protect personal data against unauthorised access, use, disclosure, modification or loss. No method of transmission or storage over the Internet is completely secure, but we review and improve our measures and respond promptly to any incident.

We rely on you to keep your personal data accurate and complete; please notify our Data Protection Officer of any changes.

12. Cookies

Zomodus uses only the cookies and similar technologies needed to sign you in and keep your session secure, plus a functional cookie that remembers your chosen language. We do not use third-party advertising cookies, analytics or tracking pixels. Our separate Cookie Policy (at /cookies) sets out each cookie and how to manage them.

13. Data Protection Officer

You can reach our Data Protection Officer for any privacy question, feedback or request:

•Name: Gary

•Phone: +65 9777 5255

•Email: support@zomodus.com

14. Changes to this Notice

This Notice operates alongside any other notices, terms or consent forms that apply to you. We may update it from time to time; material changes are shown by the “Last updated” date above, and where appropriate we will notify account holders. Continued use of Zomodus after an update means you accept the revised Notice.

15. Contact

For any privacy question or request, email support@zomodus.com or write to Zomodus Pte Ltd at the address below.