Personal data protection.
KYN builds systems that process personal data on behalf of the client, who is the organisation responsible under the Personal Data Protection Act 2012. This page states what that means in practice.
Roles
For client systems, the client is the organisation that collects and decides on the use of personal data; KYN is a data intermediary that processes it on the client’s instructions, under the written contract. For kyn.com.sg and the free check, KYN is the organisation: the data is a name, a work email, a WhatsApp number and the site checked, used to send the report and to follow up once.
What is processed
Customer and supplier names, contact details, messages and transaction records, as they already exist in the client’s mailbox, CRM, WhatsApp and books. Agents read what the job needs and write results back to the same systems. No new categories of personal data are created, and nothing is enriched from sources the client has not agreed to.
Where it is kept and for how long
In the client’s own cloud account, in the region the client chooses. Retention follows the client’s own policy; agent logs default to the application’s retention and managed-database backups to 35 days. On kyn.com.sg, check leads are kept for 24 months unless deletion is requested earlier.
Who it is shared with
Model providers receive only the text needed for a task: Google (Gemini) and Anthropic (Claude), under API terms that exclude training. Messaging and mail providers (Meta for WhatsApp, Google or Microsoft for mail) receive what the client already sends through them. No data is sold or shared for marketing.
Access, correction and deletion
A request from an individual goes to the client for client systems, and to hello@kyn.com.sg for kyn.com.sg data. Access and correction requests are answered within 30 days; deletion is carried out across the application tables and confirmed in writing. Backups expire on their own schedule.
Breach handling
A suspected breach is contained first, assessed within 72 hours and reported to the client, who decides on notification to the PDPC and to affected individuals under the mandatory breach notification rules. The log of the incident is kept with the system’s own logs.
Checked 13 October 2026. When a practice changes, this page changes with it.
Questions buyers ask
Who is responsible for personal data in a KYN-built system?
- The client, as the organisation under the PDPA. KYN processes the data on the client’s instructions as a data intermediary, under the contract, in an account the client owns.
Does KYN send our customers’ data to AI models?
- Only the text needed for the task, such as the body of an email to classify, over an encrypted connection to Google or Anthropic under terms that exclude training. Nothing is sent for any other purpose.
How do I ask KYN to delete my details from the free check?
- Email hello@kyn.com.sg from the address you used. The lead and the report rows are deleted from the application tables and confirmed in writing within 30 days.
Does KYN use our data to train models?
- No. Neither KYN nor the model providers used, under their API terms, train on client data.