Privacy Policy

1. About this Policy

BYBRIX AI Pte. Ltd. (UEN 202615986H), a company incorporated in Singapore ("BYBRIX", "we", "us"), operates an AI-powered business management platform for food & beverage, nightlife, and beauty & wellness businesses. This Privacy Policy explains how we collect, use, disclose and protect personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA").

This Policy applies to personal data processed through our website at bybrix.ai, our web and mobile applications, booking portals, WhatsApp and voice channels, and all related modules (together, the "Services"). It covers three groups of people:

• Merchants — businesses that subscribe to BYBRIX, and their owners, staff and other authorised users.
• Guests — customers and clients of Merchants whose data is processed through the Services (for example, when you book a table, make a salon appointment, join a loyalty programme, or use AI Analysis at a salon).
• Visitors — anyone who browses our website or contacts us.

By using the Services or providing personal data to us or to a Merchant using the Services, you acknowledge this Policy. Where we rely on your consent, we will ask for it clearly and separately where required.

2. Our Role: BYBRIX vs Merchants

Guest data is controlled by the Merchant you deal with. When a Merchant collects your personal data through the Services, that Merchant is the organisation responsible for it under the PDPA. BYBRIX processes that data on the Merchant's behalf and on its instructions, as a data intermediary, under our agreement with the Merchant.

BYBRIX is directly responsible for:

• Personal data of Merchants and their authorised users (account, billing, support data);
• Personal data of Visitors to our website and people who contact us;
• De-identified and aggregated data we create under Section 13; and
• Any processing we carry out for our own purposes, as described in this Policy.

Each Merchant is a separate business from BYBRIX and may have its own privacy policy. Requests about how a Merchant uses your data (including its marketing to you) should be directed to that Merchant first. We will support Merchants in responding to those requests, and you may also contact us under Section 16.

3. Personal Data We Collect

3.1 Merchants and authorised users

• Account data: name, business name, role, email, mobile number, login credentials, and business details (UEN, address, industry, outlet information).
• Billing data: billing contact, subscription plan, invoices and payment records. Card details are handled by our payment processor; we do not store full card numbers.
• Staff data entered by Merchants: staff names, contact details, roles, schedules, attendance/clock-in records, sales attributed to staff, and commission records.
• Support and communications data: messages, call notes, feedback and survey responses.
• Usage data: how you use the Services, features enabled, and activity logs.

3.2 Guests (collected by Merchants through the Services)

• Identity and contact data: name, mobile number (including WhatsApp number), email, and optionally birthday or gender if the Merchant collects them.
• Booking data: reservation or appointment details, party size, preferred staff, deposits, cancellations and no-shows.
• Transaction data: orders, purchases, receipts, packages, prepaid balances, bottle balances, and loyalty points and rewards.
• Preference and profile data: notes a Merchant records (for example, seating, dietary or service preferences), visit history and service history.
• Communications data: messages exchanged with a Merchant's AI Concierge or staff over WhatsApp, web chat or other channels, and phone calls handled by the AI Concierge, including recordings and transcripts where enabled.
• Facial images and AI-generated images: where a Merchant uses AI Analysis, a photo of your face and the AI-generated style previews created from it. See Section 4.

3.3 Visitors

• Contact data: details you give us when you book a demo, message us on WhatsApp, or email us.
• Device and online activity data: IP address, browser and device type, pages viewed, referring pages and approximate location, collected through cookies and similar technologies (see Section 10).

We do not ask for NRIC or other national identification numbers except where required by law. Merchants must not collect NRIC numbers through the Services unless permitted under the PDPA.

4. Facial Images and AI Analysis

We only take a photo of your face after telling you what it is for, and we never use it to identify or recognise you. This Section applies whenever a Merchant uses BYBRIX's AI Analysis feature.

4.1 What the feature does.A Merchant's staff takes a photo of your face (or you upload one). Our AI analyses visible features in the photo, such as face shape, hair and lashes, and generates preview images showing how different hair or lash styles may look on you, together with style recommendations.

4.2 What we collect. The original facial photo, the AI-generated preview images, the styles selected, and the date, Merchant and staff member associated with the session.

4.3 Notice and consent. Before your photo is taken, the Merchant will tell you what it will be used for and that it will be saved to your profile with that Merchant. If you go ahead with the photo after being told this, that is taken as your consent. You may decline, and declining will not affect the other services the Merchant provides to you.

4.4 What we will never do. We do not use facial images to:

• Identify, verify or recognise you, or match you against other images;
• Create facial templates, faceprints or other biometric identifiers;
• Infer your race, ethnicity, religion, health, age or emotions; or
• Train or improve AI models, whether ours or a third party's (unless you give separate, optional consent to this).

4.5 Who can see your images.Your images are stored in your Guest profile with the Merchant that captured them and are visible only to that Merchant's authorised staff. They are not shared with other Merchants, not made public, and not used in any marketing by BYBRIX. If a Merchant wants to use your images publicly (for example, on social media), it must obtain your separate consent.

4.6 AI service providers. To generate previews, images are processed by our third-party AI model providers, which may be located outside Singapore. Our contracts require them to use images only to return results to us, to keep them only as long as needed to process the request, and not to use them for training.

4.7 Retention.Facial photos and generated previews form part of your Guest profile with the Merchant. They are kept for as long as that profile remains active and the Merchant's subscription continues. They are deleted if you withdraw consent, if the Merchant deletes them or your profile, or within 30 days after the Merchant's subscription ends.

4.8 Withdrawing consent. You may withdraw consent at any time by telling the Merchant. Your facial photos and generated previews will then be deleted from the Services within 10 business days. Withdrawal does not affect processing already carried out.

4.9 Children. AI Analysis must not be used on children under 13 unless a parent or legal guardian gives consent on their behalf.

4.10 Security. Facial images are encrypted in transit and at rest, stored separately from general profile fields, and accessed through short-lived, access-controlled links. Access is logged.

5. How We Use Personal Data

• To provide the Services: creating and securing accounts; taking and managing bookings; processing orders, payments, packages and balances; running loyalty programmes; tracking staff attendance and commissions; operating the AI Concierge and AI Analysis; and providing customer support.
• On behalf of Merchants: processing Guest data only as the Merchant instructs, including sending booking confirmations and reminders and, where the Guest has consented, marketing messages.
• To run and improve our business: billing; troubleshooting; monitoring performance and security; analysing usage of the Services (using de-identified data wherever practicable); and developing new features.
• To communicate with Merchants and Visitors: service notices, product updates and, where permitted, marketing about BYBRIX. You can opt out of our marketing at any time.
• For legal and protective purposes: complying with laws and lawful requests from authorities; enforcing our Terms of Service; and detecting and preventing fraud, abuse and security incidents.

We will not use personal data for a new purpose without notifying you and, where required, obtaining your consent.

6. Artificial Intelligence

The Services use AI, including large language models, voice processing and image generation, to operate features such as the AI Concierge, AI Analysis and AI Insights. Personal data may be processed by these systems to deliver those features.

AI Concierge responds to Guest enquiries, answers questions about a Merchant, and makes, changes or cancels bookings. It identifies itself as an automated assistant, and Guests can ask to be put in touch with the Merchant's staff.

AI outputs (including style previews and recommendations) are illustrative and may be inaccurate. They do not produce decisions with legal or similarly significant effects on you.

No sale or training on Guest data. We do not sell personal data and do not use identifiable Guest data to train third-party AI models. Our AI providers are contractually prohibited from training on data we send them.

7. Messaging, Calls and Marketing

Service messages. Merchants use the Services to send you messages about your bookings, orders, balances and loyalty account (for example, confirmations, reminders, and bottle or package balance updates) by WhatsApp, SMS or email. These are part of the service you requested.

Marketing messages.Merchants may send promotions, offers and win-back messages only if you have opted in. You can opt out at any time by replying STOP or using the opt-out option in the message, or by telling the Merchant. Merchants are responsible for complying with the PDPA's Do Not Call provisions and the Spam Control Act when sending marketing to Singapore numbers.

WhatsApp.Messages sent over WhatsApp pass through Meta's WhatsApp Business Platform and are also subject to Meta's terms and privacy policy.

Phone calls. Where a Merchant enables AI Concierge voice handling, calls may be answered by AI, recorded and transcribed to handle your request and for quality purposes. You will be informed at the start of the call.

Charges. You are responsible for any carrier or data charges for messages and calls.

8. Disclosure of Personal Data

We do not sell, rent or trade personal data. We disclose it only as follows:

• To the relevant Merchant: Guest data is available to the Merchant you interacted with. Merchants cannot access another Merchant's Guest data, except that outlets under the same business may share data within their group where the Merchant configures this.
• Service providers: cloud hosting and storage, AI model providers, messaging providers (including Meta/WhatsApp and SMS gateways), telephony providers, payment processors, email, analytics and customer-support tools. They may use personal data only to provide services to us, under written obligations of confidentiality and protection.
• Payment processors: payments are processed by third-party payment providers under their own terms. BYBRIX does not hold Guest funds.
• Professional advisers: lawyers, accountants, auditors and insurers, where needed.
• Business transfers: a buyer, investor or successor in a merger, financing, acquisition or sale of assets, bound to protect the data consistently with this Policy.
• Authorities: law enforcement, regulators or courts where required or permitted by law, or to protect the rights, property or safety of BYBRIX, our users or others.
• With your consent: anyone else, where you have agreed.

9. Transfers Outside Singapore

Some of our service providers, including cloud hosting and AI model providers, may process personal data outside Singapore (for example, the United States). Where we transfer personal data overseas, we take steps required by the PDPA to ensure the recipient provides a standard of protection comparable to the PDPA, including through binding contractual terms.

10. Cookies and Similar Technologies

Our website uses cookies, pixels and similar technologies to operate the site, remember preferences, measure traffic and support advertising. These include analytics tools and the Meta Pixel, which shares browsing events with Meta to measure and personalise ads. You can manage cookies through your browser settings or our cookie banner. Blocking some cookies may affect site functionality.

11. Retention

We keep personal data only as long as needed for the purposes in this Policy or as required by law.

12. Security and Data Breaches

We use reasonable security arrangements to protect personal data, including encryption in transit and at rest, role-based access controls, audit logging, and restricting access to personnel who need it. No system is completely secure, and we cannot guarantee absolute security.

If a data breach occurs, we will assess it promptly. Where we act for a Merchant, we will notify the Merchant without undue delay. Where BYBRIX is the responsible organisation and the breach is notifiable, we will notify the PDPC within 3 calendar days of assessing it and affected individuals as required by the PDPA.

13. De-identified and Aggregated Data

We may create de-identified and aggregated data from data processed through the Services, for example, booking trends by time of day or average spend by venue type across Merchants. This data does not identify any individual or Merchant. We may use it to operate, benchmark and improve the Services and to develop insights and new products. Facial images are never included in this data.

14. Children

The Services are not directed at children. Merchants may process data of Guests under 18 where they are customers of the Merchant, but must obtain consent from a parent or guardian where required. AI Analysis on children is subject to Section 4.9. If you believe we hold a child's data without proper consent, contact us and we will delete it.

15. Your Rights

Under the PDPA, you may:

• Access the personal data we hold about you and ask how it has been used or disclosed in the past year;
• Correct errors or omissions in your personal data; and
• Withdraw consent to our collection, use or disclosure of your personal data, with reasonable notice. We will explain the likely consequences, for example, that some Services may no longer be available.

Guests should first contact the relevant Merchant, since the Merchant controls their data. You may also contact us and we will pass the request to the Merchant and assist them.

We will respond within 30 days. If we need longer, we will tell you when we expect to respond. We may need to verify your identity and may charge a reasonable fee for access requests, which we will tell you in advance.

If you are not satisfied with our response, you may contact the Personal Data Protection Commission at pdpc.gov.sg.

16. Contact Us and Data Protection Officer

For questions, requests or complaints about this Policy or your personal data, contact our Data Protection Officer:

Data Protection Officer, BYBRIX AI Pte. Ltd. — hello@bybrix.ai

17. Changes to this Policy

We may update this Policy from time to time. The updated version will be posted on this page with a new effective date. For material changes, we will notify Merchants by email or in-app notice, and Merchants are responsible for passing relevant changes on to their Guests where required.