Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you interact with our websites, APIs, dashboard, and related services (collectively, the “Services”).

This Privacy Policy is intended to comply with applicable privacy and data protection laws, including the Personal Data Protection Act 2012 of Singapore (“PDPA”), the General Data Protection Regulation (“GDPR”) and UK GDPR (where applicable to individuals in the EEA or United Kingdom), the Digital Personal Data Protection Act, 2023 of India (“DPDPA” / “DPDP”), the EU Artificial Intelligence Act (“EU AI Act”) where applicable to our AI-assisted document analysis, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and other applicable data protection legislation. This document has been reviewed for alignment with those obligations.

By accessing our websites or using the Services, you are informed of the practices described in this Privacy Policy. This Privacy Policy does not constitute consent to the processing of your personal data; where consent is required, it will be obtained separately in accordance with applicable law.

2. Who we are

Guni Innovations Pte. Ltd. is a technology company providing automated document fraud-detection and analysis services under the trade name TamperCheck AI.

• Registered name: Guni Innovations Pte. Ltd.
• Trade name: TamperCheck AI
• Registered address: 68 Circular Road #02-01, 049422, Singapore
• Data Protection Officer: dpo@tampercheck.ai

Full contact details, including how to submit a data subject request, are in Section 18 below.

3. Our role in processing personal data

Depending on the context, TamperCheck AI may act either as a Data Controller / Data Fiduciary or as a Data Processor.

• Controller / Data Fiduciary. We act as a controller (under GDPR/PDPA) or Data Fiduciary (under the DPDPA) for account, billing, website analytics, marketing, and support data that we collect and determine the purposes of processing.
• Processor. When you submit documents via the API or dashboard for analysis, we act as a processor on your behalf. You (or your organization) remain the controller / Data Fiduciary for that document content and must have a lawful basis to submit it for processing. TamperCheck AI processes such content solely for the purpose of performing the requested analysis and delivering results, in accordance with your instructions.

Our processing of document content as a processor is governed by our Data Processing Agreement, which includes the EU Standard Contractual Clauses, the UK Addendum, and terms for the DPDPA, PDPA, and CCPA. It applies automatically to customers who submit personal data of others to the Services; no signature is required, and a countersigned copy is available on request.

4. Categories of personal data we process

5. How we collect personal data

We may collect personal data:

• Directly from you, when you create an account, submit documents, or contact us;
• From identity and sign-in providers (e.g. Google OAuth), when you choose to authenticate through them;
• From our payment processor, to facilitate billing and transactions;
• Automatically through our websites and APIs, including via cookies and similar technologies; and
• From AI inference and OCR providers, solely as part of producing analysis results on your behalf.

6. How we use personal data

We process personal data to:

• Provide, operate, secure, and improve the Services;
• Process documents you submit and deliver analysis results;
• Authenticate API requests and prevent abuse;
• Process payments and maintain billing records;
• Respond to enquiries and support requests;
• Comply with legal and regulatory obligations;
• Communicate with you about the Services, incidents, or policy updates; and
• Improve and develop our products (without using your submitted documents to train AI models).

7. Document processing and retention

Purpose-limited processing. Document content you submit is processed solely to produce and deliver the requested analysis result. We do not use your documents to train AI models, for marketing, for resale, or for any purpose unrelated to providing the Services.

No document archive. We do not operate a customer document archive for re-download, batch analytics, or any secondary purpose. Document content is retained only for the minimum period necessary to process the job and deliver results, after which it is discarded from operational processing paths.

Operational reality. Like any file-processing service, transient infrastructure storage, logs, backups, or diagnostics may retain fragments for a short period beyond delivery. We apply technical and organizational measures to keep this window as short as practicable and to restrict access.

Job metadata. Metadata associated with analysis jobs (e.g. verdict, risk score, timestamps, job identifiers, error codes) may be retained for audit, billing, reliability, and abuse-prevention purposes. This is distinct from the document content itself.

The commitments that apply to document content, including purpose limitation, no model training, deletion and return, security measures, and breach notification, are set out in our Data Processing Agreement. If you need specific additional commitments for your regulatory environment, please contact us.

8. Legal bases for processing

We rely on the following legal bases, depending on the nature of the processing and applicable law:

9. Who we share personal data with

We may share personal data with the following categories of recipients, each engaged under appropriate contractual safeguards:

• Payment processors - to handle billing and transactions;
• Identity and authentication providers - to facilitate sign-in;
• Cloud hosting, storage, and CDN providers - to operate and deliver the Services;
• AI inference, OCR, and content-provenance providers - solely to process analysis requests on your behalf, including checking images for AI content credentials and watermarks;
• Email and messaging providers - for transactional and support communications;
• Bot and fraud protection providers - to prevent abuse;
• Analytics and visitor-tracking providers (including Instantly.ai) - to understand website usage, which organisations visit our website, and to improve the Services;
• Professional advisors - including legal counsel and auditors, under confidentiality obligations; and
• Regulators and law enforcement - where required by applicable law or valid legal process.

All third parties that process personal data on our behalf do so under contract and are required to implement appropriate security measures. We do not sell personal data. The current list of subprocessors that process document content is in Annex III of our Data Processing Agreement.

10. International data transfers

We may process personal data in Singapore and in other countries where we or our subprocessors operate. Where cross-border transfers are required, we use appropriate safeguards consistent with applicable law, including:

• Contractual protections consistent with the PDPA transfer obligations;
• Standard Contractual Clauses approved by the European Commission and the UK Addendum (where GDPR or UK GDPR applies), which are incorporated into our Data Processing Agreement;
• Conditions notified by the Central Government under DPDPA Section 16 (where applicable to transfers of personal data from India); and
• Other safeguards as required by applicable data protection legislation.

Regardless of where data is processed, we implement appropriate technical safeguards including encryption in transit and at rest.

11. Data retention schedule

We retain personal data only for as long as necessary for the purposes for which it was collected:

12. Your privacy rights

Depending on where you are located and applicable law, you may have rights in relation to your personal data.

Rights under GDPR (EEA and UK individuals)

• Right to be informed - to receive clear information about how your personal data is processed;
• Right of access - to obtain a copy of your personal data;
• Right to rectification - to have inaccurate or incomplete data corrected;
• Right to erasure - to request deletion of your personal data in certain circumstances;
• Right to restriction - to request that processing is paused while a dispute is resolved;
• Right to data portability - to receive your data in a machine-readable format where applicable;
• Right to object - to object to processing based on legitimate interests or for direct marketing;
• Right not to be subject to solely automated decisions - see Section 13; and
• Right to complain to a supervisory authority - your national EU Data Protection Authority or the ICO (UK).

Rights under DPDPA 2023 (Indian individuals)

• Right to information about personal data being processed (Section 11(1)(a));
• Right to access a summary of personal data and processing activities (Section 11(1)(b));
• Right to correction of inaccurate or incomplete personal data (Section 12);
• Right to erasure of personal data where the purpose is fulfilled or consent is withdrawn (Section 13);
• Right to withdraw consent at any time (Section 6(4));
• Right to nominate another individual to exercise rights on your behalf (Section 14); and
• Right to grievance redressal and to approach the Data Protection Board of India if unresolved (Sections 13(6), 27).

Rights under PDPA (Singapore) and other laws

• Access - to obtain a copy of your personal data;
• Correction - to have inaccurate or incomplete data corrected;
• Withdrawal of consent - where processing is based on consent, you may withdraw it at any time without affecting lawfulness of prior processing; and
• Complaint - to lodge a complaint with the PDPC in Singapore or another relevant authority.

To exercise your rights, submit a Data Subject Access Request or email our Data Protection Officer at dpo@tampercheck.ai. We will respond within 30 days (or such shorter period as required by applicable law). We may need to verify your identity before processing a request. You can also revoke API keys and close your account from the dashboard where available.

California residents (CCPA/CPRA). If you are a California resident, you may have additional rights under the CCPA, including the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell or share (as defined by the CCPA) your personal information. To exercise your CCPA rights, submit a Data Subject Access Request. We will not discriminate against you for exercising your rights.

Document content processed as Processor / Data Processor. Where we process document content on behalf of an organization (as Processor under GDPR, or as a Data Processor under the DPDPA), individuals should ordinarily direct data rights requests to the organization that submitted the data (the Controller / Data Fiduciary). We will assist that organization in responding to such requests in accordance with applicable law. If you contact us directly, we will acknowledge the request and coordinate with the relevant organization.

13. Automated analysis and AI systems

TamperCheck AI uses automated processes, including AI models, to analyze documents and produce outputs such as risk scores, verdict labels, and explanatory findings. These outputs are assistive tools designed to help you make informed decisions - they are not legal determinations, compliance certifications, or investigative conclusions.

You (or your organization) remain responsible for any decision made on the basis of TamperCheck AI outputs. No adverse decision affecting an individual should be made solely on the basis of automated outputs without appropriate human review.

EU AI Act. Where TamperCheck AI is used in contexts that may constitute high-risk AI under the EU AI Act (for example, certain credit, employment, or essential-service decision workflows operated by our customers), our role is typically that of a provider or deployer of an AI system used as a decision-support tool. Customers remain responsible for their own deployer obligations, including meaningful human oversight of any decision that significantly affects an individual. We design the Services so that outputs are explainable (findings tied to document regions), auditable via job metadata, and subject to human review before consequential action.

Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that significantly affects you. To request human review of any AI-generated assessment, contact our Data Protection Officer at dpo@tampercheck.ai with the subject line “Human Review Request” and include the job ID and the document concerned.

14. Security

We maintain appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest;
• Role-based access controls and least-privilege principles;
• Secure handling of API keys (hashed storage; keys are not retrievable after creation);
• Monitoring, logging, and alerting for anomalous access patterns;
• Employee confidentiality obligations and security awareness; and
• Incident response procedures, including notification as required by applicable law.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (as required under GDPR Article 33), and will notify the Data Protection Board of India in the prescribed manner under DPDPA Section 8(6) where applicable. Where required, we will also notify affected individuals without undue delay.

No method of transmission or storage is 100% secure. We work continuously to reduce risk and to respond promptly if an incident occurs.

15. Cookies and similar technologies

Our websites and Services may use cookies, analytics scripts, and similar technologies. We use the following types:

• Strictly necessary - required to operate the Services (e.g. session authentication cookies). These cannot be disabled.
• Analytics - used to understand how visitors use our website and to improve the Services. These are only set after you consent via our cookie banner.
• Website visitor tracking - we use Instantly.ai's website visitor tracking script to understand which organisations visit our website. It collects your IP address, the pages you view, and browser/device information, and uses IP geolocation to estimate your approximate location and the company you may be visiting from. Like our other analytics, this script only loads after you accept analytics cookies via our cookie banner.
• Preferences - used to remember settings and improve your experience.

When you first visit our website, you will be asked to accept or decline analytics cookies. You can change this choice at any time using the “Cookie preferences” link in the footer, or manage cookies through your browser settings. Disabling non-essential cookies will not affect your ability to use the core Services.

16. Children's privacy

The Services are intended for professional and business use and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take appropriate steps to delete it without undue delay.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our Services, legal obligations, or privacy practices. We will post the revised version on this page and update the “Last updated” date. Material changes will be communicated through appropriate channels (e.g. email or in-product notice) before taking effect.

18. Contact

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or raise a concern regarding the processing of your personal data, please contact us:

Data Protection Officer

• Email: dpo@tampercheck.ai
• Subject line: Please use “Privacy Enquiry”, “DSAR”, “Grievance”, or “Human Review Request” as appropriate
• Organization: Guni Innovations Pte. Ltd. (trading as TamperCheck AI)
• Registered address: 68 Circular Road #02-01, 049422, Singapore

Data Subject Rights Request

• DSAR form: tampercheck.ai/compliance/dsar
• Response time: 30 days (extendable for complex requests where permitted by applicable law)

General enquiries

• Support / product: tina@tampercheck.ai

Supervisory authorities

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the relevant supervisory authority:

• Singapore: Personal Data Protection Commission (PDPC) - pdpc.gov.sg
• European Union: Your national Data Protection Authority - edpb.europa.eu
• United Kingdom: Information Commissioner's Office (ICO) - ico.org.uk
• India: Data Protection Board of India - under the DPDPA 2023