This Data Protection Notice ("Notice") sets out the basis on which Care Hero Pte. Ltd. (UEN 202500589Z), 20 Cecil Street, #22-00, Singapore 049705 ("Care Hero", "we", "us", "our") collects, uses, discloses and otherwise processes personal data, in accordance with the Personal Data Protection Act 2012 ("PDPA").

It applies to personal data in our possession or under our control, including personal data held by organisations we have engaged to process it for our purposes. It covers our website at agentheroai.com and the Agent Hero platform (the "Platform"), and forms part of the Agent Hero Terms of Use.

1. The two different roles we play

This is the most important section, because your rights differ depending on which category data falls into.

Where an Organisation obtains the Platform through another company (a "Provider"), that Provider may also handle Account and Usage Data about the Organisation for its own billing and support, under its own privacy policy.

2. Definitions

"Customer" means an individual who (a) has contacted us by any means to find out about our goods or services, or (b) may, or has, entered into a contract with us. "Organisation" means a company or firm with a workspace on the Platform. "User" means an individual with a login to a workspace. "Personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access. Other terms have the meanings given to them in the PDPA where the context permits.

3. What we collect

3.1 Data you or your Organisation give us

• Account details: name, work email address, job title, role, and the Organisation you belong to.
• Content you submit: documents, files, images, notes, prompts, agent and skill configurations, and messages to AI agents.
• Credentials and tokens for third-party services you choose to connect.
• Enquiries, support correspondence, and feedback.
• Billing and payment details, handled by our payment processor — we do not store full card numbers.

Depending on the nature of your interaction with us, personal data collected through our website or in the course of a commercial relationship may also include telephone number, employment information, and business contact details.

3.2 Data we collect automatically

• Login and authentication records, including IP address, approximate location, device, and browser.
• Activity within the Platform: features used, agents and skills run, files accessed, actions taken.
• AI usage metering: volumes processed, models used, credits consumed.
• Technical logs, errors, and performance data.
• Website visitor traffic and analytics via cookies on agentheroai.com.

3.3 We do not seek out special categories of data. If your Organisation chooses to put sensitive material into its workspace — health, financial, or legal records — that is its decision and its responsibility, and it must have the right to do so.

4. How we collect it, and consent

We generally do not collect your personal data unless (a) you provide it voluntarily, directly or through a third party you have authorised, after being notified of the purposes and having consented; or (b) collection and use without consent is permitted or required by the PDPA or other law. We will seek your consent before collecting additional personal data, or before using your personal data for a purpose not notified to you, except where permitted or authorised by law.

5. Why we use it

We rely on your Organisation's instructions to process Workspace Content, and on consent, contractual necessity, or the PDPA's legitimate interests provisions for Account and Usage Data. These purposes may continue to apply for a reasonable period after our relationship with you ends, including to enforce our rights under a contract.

6. Legitimate interests

In compliance with the PDPA, we may collect, use or disclose personal data without consent for our legitimate interests or those of another person. In relying on that exception we assess the likely adverse effects on the individual and satisfy ourselves that the legitimate interests outweigh them. We rely on it for:

• fraud detection and prevention;
• detection and prevention of misuse of the Platform;
• network analysis to prevent fraud and financial crime; and
• collection and use of personal data on company-issued devices to prevent data loss.

7. AI processing — what happens to your content

This section matters most to people evaluating the Platform, so we state it plainly.

7.1 The Platform makes a number of AI models available, reached through one or more third-party AI gateways and model providers. We may add to, change, or replace them from time to time. Current examples include Vercel AI Gateway, OpenAI, and Anthropic (Claude).

7.2 We do not use Workspace Content to train, fine-tune, or otherwise develop or improve any AI model — not our own, not anyone else's — and we do not permit anyone acting on our behalf to do so. Your content is not pooled with other organisations' content for any such purpose. This is unqualified: it applies to every plan, including trials, and we do not ask you to opt out of anything to get it.

7.3 What we cannot control is what those gateways and model providers do at their end. Whether any of them keeps a copy of prompts and outputs, for how long, whether a zero-data-retention (ZDR) arrangement applies, and whether it may use prompts and outputs to train or improve its own models, is governed entirely by that provider's own policies and terms. Those policies differ between providers and between models, and each provider may change them at any time without reference to us.

7.4 Read those policies yourself. It is your Organisation's responsibility to read, evaluate, and keep up to date with the ZDR, retention, and training policies of each gateway and model provider it uses, and to decide which models are appropriate for the sensitivity of its data. Start with the providers named in 7.1 — each publishes its policy on its own website.

7.5 We are not responsible for them. We give no warranty or representation as to any gateway's or model provider's ZDR, retention, or training practices, or that any such arrangement will be available, enabled, or maintained. We are not responsible or liable for those policies, for changes to them, or for a provider acting inconsistently with them. Where a zero-data-retention arrangement is available and enabled for your Organisation, we will pass requests through it — but that is us routing your request, not us guaranteeing the provider's conduct.

7.6 None of this reduces our own commitment in 7.2, which is ours alone to keep.

8. Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing.

Our service providers, who process it on our instructions under confidentiality and security obligations. The ones that may handle Workspace Content are:

We also use providers for payment processing, email delivery and support tooling, which handle Account and Usage Data rather than Workspace Content.

We additionally share personal data with:

• Your Organisation. Your Org Admin can see the content and activity in the Organisation's workspace, including yours.
• Your Provider, where your Organisation obtains the Platform through one, to the extent it administers your Organisation or provides support.
• Authorities and advisers, where we are required to disclose by law, court order, or a regulator, or to establish or defend legal claims.
• A successor, if our business or the relevant part of it is sold or merged. We will tell your Organisation if that happens.

9. Where your data is held

Workspace Content is held in Singapore. The production database and uploaded-file storage that hold it are located here.

Some supporting services operate outside Singapore — application delivery, authentication, error monitoring, and AI inference — so personal data does cross borders in the course of those functions. The table in section 8 shows where each provider sits.

Where personal data is transferred out of Singapore, we take the steps required by the PDPA to satisfy ourselves that the recipient is bound to protect it to a standard at least comparable to the PDPA, ordinarily through contractual commitments with each provider. By using the Platform you acknowledge that these transfers are necessary to provide it.

10. Security

To safeguard personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks, we apply administrative, physical and technical measures including: minimised collection of personal data; authentication and access controls, including good password practices and need-to-know disclosure; multi-factor authentication on administrative access; encryption of data in transit; per-Organisation workspace isolation; logging; data anonymisation where appropriate; up-to-date antivirus protection; regular patching of operating systems and software; secure erasure of storage media before disposal; web security measures; credential exposure checks; device vulnerability assessments and security hardening; and regular security review and independent penetration testing.

We are certified. Care Hero Pte. Ltd. holds CSA Cybersecurity Certification — Cyber Essentials (2025) for HIMS Vendors, certificate CEM-2026-252, issued by ISOCert Pte Ltd and valid from 26 August 2026 to 25 August 2028. The certified scope is the production and development environment for our SaaS service.

You should be aware that no method of transmission over the internet or electronic storage is completely secure. While security cannot be guaranteed, we work to protect your information and keep our measures under review.

Data breaches. If a breach occurs that is likely to result in significant harm to affected individuals, or is of significant scale, we will notify the Personal Data Protection Commission within 3 calendar days of assessing it as notifiable, and notify affected individuals and Organisations as the PDPA requires. Where we act as data intermediary, we notify the Organisation without undue delay so it can meet its own obligations.

11. Accuracy

We generally rely on personal data provided by you or your authorised representative. To keep it current, complete and accurate, please tell our Data Protection Officer in writing if it changes.

12. Retention, deletion, and proof of deletion

• Workspace Content is kept for as long as the Organisation's agreement runs. When it ends, the content is available for export for 30 days and is then deleted from the live service. Any copy surviving in routine backups expires within 3 months of that deletion, after which no copy remains. Backups are not accessed in the meantime except to restore the service.
• Account and Usage Data is kept while the account is active and for a reasonable period afterwards, for security, dispute, and audit purposes.
• Billing records are kept for as long as tax and company law require — ordinarily 5 years in Singapore.

We cease to retain personal data, or remove the means by which it can be associated with an individual, once it no longer serves the purpose for which it was collected and is no longer necessary for legal or business purposes.

Deletion on request, and proof of it. An Organisation may instruct us in writing at any time to permanently delete identified Workspace Content, or all of it, without waiting for its agreement to end. We action it within 30 days, backup copies expire within 3 months of that, and we then give written confirmation of deletion setting out what was deleted, when, and by what method — in a form the Organisation can hand to its own clients or to a regulator. If the law requires us to keep something, we say so and identify it. Individuals should route these requests through their Organisation, since it is the Organisation's data.

13. Your rights

Access and correction. You may ask us for a copy of the personal data we hold about you and information about how it has been used or disclosed in the past year, or ask us to correct or update it. Submit your request in writing or by email to our Data Protection Officer. A reasonable fee may be charged for an access request, and we will tell you the fee before processing it. We respond as soon as reasonably possible, generally within 7 business days. If we cannot respond within 14 days of receiving your request, we will tell you in writing within that period when we will be able to. If we cannot provide the data or make the correction, we will generally tell you why, except where the PDPA does not require it.

Withdrawing consent. Your consent remains valid until you withdraw it in writing. Submit your request in writing or by email to our Data Protection Officer. On receipt we may need reasonable time to process it and to tell you the consequences, including any legal consequences affecting your rights and liabilities; in general we will process it within 14 business days. Depending on the nature and scope of your request, we may no longer be able to provide our goods or services to you, and we will tell you before completing the processing of your request. If you decide to cancel your withdrawal, please tell us in writing. Withdrawing consent does not affect our right to continue collecting, using and disclosing personal data where doing so without consent is permitted or required by law.

About Workspace Content, ask your Organisation. For content in an Organisation's workspace we act on that Organisation's instructions, so requests should go to the Organisation. If you send one to us, we will pass it on and support the Organisation in answering it.

14. Google user data (Google API Services)

14.1 Care Hero Pte. Ltd.'s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

14.2 Where you choose to connect a Google account to our services, we request access only to the data needed for the features you enable, and only at the point you connect that account:

• Gmail — so that your assistant can send email on your behalf. We do not request access to read your inbox.
• Google Drive — so that your assistant can create and work with files it creates for you. We do not request access to browse or scan your Drive as a whole.
• Google Calendar — so that your assistant can create, update and remove events at your direction, list your calendars so you can choose which one to use, and read your calendar settings so events are created in your local time zone.

A plain-language description of these features is in our Email, Calendar and Files documentation.

14.3 Google user data is used solely to provide those user-facing features within your own workspace. It is stored encrypted and isolated per tenant. We do not sell, license, or broker Google user data; use it for advertising, credit, or lending decisions; or use it to develop, improve, or train generalised or non-personalised AI or machine-learning models. Where delivering a feature requires processing by our infrastructure or AI sub-processors, that processing is performed under contract and solely to deliver the feature you requested. For clarity, the general collection, use, disclosure, fraud-prevention, credit-analysis, and incidental-business provisions in sections 5, 6 and 8 do not expand the permitted use or transfer of Google user data described in this section.

14.4 We do not permit humans to read your Google user data except: (a) with your explicit consent for the specific messages or files concerned; (b) where necessary for security purposes, such as investigating abuse; (c) where required to comply with applicable law; or (d) where the data has been aggregated and anonymised for internal operations.

14.5 You may disconnect a Google account at any time from the integrations settings in the product, which revokes our access immediately. You may also request deletion of the data we hold from that account by contacting our Data Protection Officer below; we will delete it without undue delay and in any event within 30 days, save where retention is required by law.

15. Website, cookies and links

Our website may contain links to other sites. Those sites do not operate under this Notice, and you should review the policies displayed on them before use.

Our websites use cookies to keep you signed in, remember your preferences, keep the Platform secure, and understand how it is used so we can improve it. We do not use advertising cookies. You can control cookies in your browser, but the Platform will not work properly without the essential ones.

We retain copyright in the material on our sites, including logos, photographs and content. No part may be copied, performed in public, used or adapted without our written consent.

16. Marketing

We may send your Organisation's contacts service messages about the Platform — changes, incidents, and billing. These are not marketing and you cannot opt out of them while you have an account.

We only send marketing where the recipient has agreed to receive it, and every marketing message has an unsubscribe link. Singapore numbers are checked against the Do Not Call Registry where the Registry applies.

17. Children

The Platform is for business use by adults. It is not intended for anyone under 18, and we do not knowingly collect their personal data.

18. Data Protection Officer

You may contact our Data Protection Officer if you have any enquiries or feedback on our personal data protection policies and procedures, or if you wish to make any request:

Name of DPO: Dave Gurbani
Contact No.: +65 8725 9789
Email: dpo@cybersafe.sg

If you are not satisfied with how we have handled your personal data, you may complain to the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

19. Effect of this Notice, and changes

This Notice applies in conjunction with any other notices, contractual clauses and consent clauses that apply to our collection, use and disclosure of personal data. Where an Organisation has a written agreement with us or with a Provider covering data, that agreement governs as between the parties to it.

We may revise this Notice from time to time. The current version is published at agentheroai.com/privacy-policy with the date on which it was last updated. Where a change materially affects how we handle personal data, we will give reasonable notice in the Platform or by email before it takes effect. Your continued use of our services constitutes acknowledgement and acceptance of the change.