LayraxAI 隐私政策
生效日期：【年】年【月】月【日】日 版本：【1.0】
LayraxAI Pte. Ltd.（一家根据新加坡法律设立的公司，注册地址为【新加坡注册地址】，下称“LayraxAI”、“我们”）重视您的隐私。本政策说明我们作为个人数据的控制者（在新加坡《2012 年个人数据保护法》（PDPA）项下为“组织”，在适用的美国隐私法律项下为“business”）如何收集、使用、披露、传输与保护个人信息，以及您可如何行使与您相关的权利。
1. 本政策的适用范围
1.1 适用对象。本政策适用于以个人身份注册账号使用我们面向个人用户提供的产品与服务的自然人（下称“您”）。
1.2 不适用。本政策不适用于：(a) 我们作为受托处理者处理的个人数据（包括客户内容中的个人数据）；您就该等数据行使权利的，我们依 DPA 第 7 条转交相关客户处理；(b) 第三方服务与网站的隐私实践。
1.3 本政策不适用于企业客户与专业客户就其上传、生成或存储的客户内容所享有的权利与义务，该等事项依《企业服务协议》或《专业服务协议》及其附件一《数据处理附录》确定。但客户（含作为个体经营者、独立执业者以个人身份签约的自然人）就其自身注册、身份核验、计费与支付所提交的个人信息，以及其使用本服务所产生的设备与日志信息，仍适用本政策，我们作为该等信息的控制者依本政策处理。
1.4 判断边界。同一内容适用本政策还是 DPA，取决于其由谁的账号上传：您自行上传的内容属于您的内容，适用本政策；由装修公司、设计单位或设计师通过其账号上传的内容属于客户内容，适用 DPA。
2. 我们收集的个人信息
2.1 您直接提供的信息。(a) 账号与身份信息：姓名或昵称、手机号码、电子邮箱、登录凭据（密码以不可逆方式存储）、头像；(b) 您的内容：您在本服务中提交的留言、批注、反馈、上传的照片与文件；(c) 沟通记录：您向我们提交的支持请求、申诉与往来邮件。
2.2 我们自动收集的信息。(a) 设备与连接信息：设备型号、操作系统与版本、浏览器类型与版本、语言与时区设置、IP 地址、设备标识符；(b) 使用信息：访问的页面与功能、访问时间与时长、点击与操作序列、错误日志与性能数据、来源页面；(c) Cookie 与类似技术收集的信息，见第 10 条。
2.3 我们从第三方取得的信息。包括服务方（装修公司、设计单位或设计师）为向您发送邀请、展示方案而提供的与您相关的信息（如您的联系方式与项目信息），以及您选择第三方账号登录时该身份服务商提供的必要身份信息。
3. 我们使用个人信息的目的
我们使用个人信息的目的包括：(a) 提供、维护与支持我们的服务，包括账号注册与登录验证、内容展示与同步、消息与通知；(b) 就服务变更、安全事件、账单与政策更新向您发送服务性通知；(c) 回应您的咨询、支持请求与申诉；(d) 改进产品与服务，包括分析功能使用情况、诊断故障与开展研发；(e) 保障安全，包括防范欺诈、滥用与未经授权访问，并调查违规行为；(f) 履行法律义务，包括响应主管机关的合法请求以及税务与会计要求；(g) 在取得您同意的前提下，向您发送商业性沟通（见第 9 条）。
我们仅为实现上述目的所必需的范围处理个人信息；变更处理目的的，我们将依法另行告知并取得必要同意。
4. 处理的法律依据（新加坡 PDPA）
我们依 PDPA 收集、使用与披露个人数据，其依据包括：您作出的同意（含通过接受协议或继续使用服务作出的同意）；为履行与您之间的合同所必需；为遵守法律义务所必需；以及在 PDPA 允许的范围内，为我们或他人的合法利益所必需（如保障服务安全、防范滥用与改进产品），且该等利益不凌驾于您的合法权益之上。
5. 我们如何共享与披露个人信息
5.1 不出售与不共享（重要）。我们不出售个人信息，亦不为跨上下文行为广告之目的共享个人信息。
5.2 我们可能在下列情形下共享个人信息：
(a) 服务提供商与子处理者，包括云服务商、CDN、通信与邮件服务商、客户支持与数据分析服务商。我们与其约定不低于本政策要求的保护义务，并要求其仅为向我们提供服务之目的处理个人信息；
(b) 为您提供服务的装修公司、设计单位或设计师，即就您在本服务中提交的留言、批注与上传内容，以及为使其能够向您发送邀请、展示方案所必需的信息；
(c) 我们的关联方与专业顾问（审计、法律、会计）；
(d) 主管机关、法院或执法机构，在法律强制性要求下，或为保护我们、您或他人的权利、财产与安全所必要时；
(e) 业务转让（合并、重组、资产转让或融资）中的交易对方与其顾问，该情形下我们将要求继受方继续遵守不低于本政策的要求；
(f) 经您同意的其他情形。
5.3 我们要求上述接收方仅在为实现第 3 条所述目的所必需的范围内处理个人信息，不得将其用于自身目的。
6. 保留期限
我们仅在为第 3 条所述目的所必需的期间内保留个人信息，并在为遵守法律义务、解决争议与执行协议所必需的范围内可延长保留。具体期限如下：
| 信息类别 | 保留期限 |
|---|---|
| 账号与身份信息 | 账号存续期间及注销后【12】个月 |
| 您在本服务中提交的内容 | 随您的账号一并处理；其中客户内容的保留与删除由客户依其与我们之间的协议决定 |
| 日志与安全记录 | 不少于【12】个月 |
| 账单、发票与税务记录 | 适用法律要求的期间 |
| 商业性沟通的订阅与退订记录 | 自退订之日起【24】个月 |
保留期届满后，我们将删除个人信息或对其进行匿名化处理；达到不可识别特定自然人且不能复原标准的数据不再作为个人数据处理。
7. 跨境传输
我们在多个司法管辖区的服务器上处理、存储与访问个人信息，包括新加坡、美国，以及我们的关联机构、服务提供商与合作伙伴所在的其他国家和地区。无论您的个人信息在何处处理，我们均按照本政策所述的保护措施予以保护，并仅依据合法有效的数据传输机制进行跨境传输，包括与接收方约定数据传输与保护义务、传输加密、访问控制与去标识化。
8. 您的权利
在适用法律允许的范围内，您可以：
(a) 访问与查询我们持有的与您相关的个人信息，并取得其副本；
(b) 更正不准确或不完整的个人信息；
(c) 删除您的个人信息（法律要求我们必须保留的除外）；
(d) 撤回您就特定处理作出的同意（撤回不影响撤回前基于同意所作处理的效力）；
(e) 要求我们将您的个人信息转移至另一主体（PDPA 项下的数据可携义务，自其生效之日起适用）；
(f) 拒绝接收商业性沟通（见第 9 条）；
(g) 就适用的美国州法：要求我们限制敏感个人信息的使用与披露；选择退出定向广告、个人信息的出售或共享（我们目前不进行该等活动）；以及不因您行使上述权利而受到歧视性对待；
您行使上述权利，请通过第 15 条所列方式联系我们。我们将在适用法律要求的期限内回应：新加坡 PDPA 项下通常为 30 日；适用的美国州法项下通常为 45 日，可依法延长一次。为保护您的权益，我们可能需要在处理您的请求前核实您的身份。
如您的请求涉及客户内容中的个人数据，我们将依 DPA 第 7 条将您的请求转交相关客户处理，并告知您相关情况。
9. 商业性沟通
我们可就新产品与新功能、活动与促销信息、使用技巧与案例向您发送商业性沟通。您可通过我们提供的退订链接、账户控制台设置或以书面方式通知我们，随时拒绝接收该等沟通；我们收到请求后在合理期限内（不超过【15】日）停止发送。您拒绝接收商业性沟通的，不影响服务性通知的发送，亦不影响您对本服务的使用。
10. Cookie 与类似技术
我们使用 Cookie 与类似技术以维持您的登录状态、记住您的偏好、保障安全并分析使用情况。您可通过浏览器设置管理或禁用 Cookie；但禁用必要 Cookie 可能导致登录、内容同步等部分功能不可用。
11. 安全措施
我们采取并维持符合行业标准的技术与组织措施，以保护个人信息免遭丢失、滥用以及未经授权的访问、披露、篡改或破坏，包括传输加密、基于角色的访问控制与最小权限原则、操作日志审计、备份与灾备、漏洞管理与安全事件响应机制。我们定期评估并更新该等措施，但不会实质降低对个人信息的整体保护水平。
发生涉及个人信息的安全事件的，我们将依适用法律通知您与相关监管机构。
12. 未成年人
我们的服务不面向儿童，我们不故意收集儿童的个人信息。未满适用法律所规定年龄的自然人（适用的美国州法项下未满 16 周岁，其中未满 13 周岁须取得监护人同意）不应自行注册账号。如我们知悉在未取得必要同意的情况下收集了儿童的个人信息，将及时删除该等信息。
13. 第三方链接与服务
我们的服务可能包含第三方网站、服务或内容的链接。第三方依其自身的隐私政策处理您的信息，我们不对该等实践负责。请您在向第三方提供信息前查阅其隐私政策。
14. 本政策的变更
我们可修订本政策以反映法律变化、监管要求或服务变更。构成重大变更的，我们将至少提前【30】日通过网站公告、产品内通知或您登记的联系方式通知您；其他变更自我们发布至官方网站之日起生效。本政策变更后您继续使用本服务的，即视为接受变更后的政策。
15. 联系我们
数据保护负责人（DPO）／隐私事务联系邮箱：【隐私联系邮箱】；收件地址：【新加坡注册地址】。
如您认为我们对您的个人信息的处理不符合适用法律，请先与我们联系；您亦可依适用法律向相关监管机构（如新加坡个人数据保护委员会 PDPC）提出投诉。
16. 加州居民特定披露
如您为加利福尼亚州居民，下列披露依《加州消费者隐私法》（经《加州隐私权法》修订）作出：
| 项目 | 内容 |
|---|---|
| 过去 12 个月内收集的个人信息类别 | 标识符（姓名、联系方式、账号、IP 地址、设备标识符）；互联网活动信息（浏览与使用情况）；音频、电子与视觉信息（您上传的照片与视频，如适用）；您自愿提供的其他信息 |
| 信息来源 | 您本人、您的设备、为您提供服务的客户、我们的服务提供商 |
| 收集与使用目的 | 见第 3 条 |
| 披露对象 | 见第 5 条 |
| 出售与共享 | 我们不出售个人信息，亦不为跨上下文行为广告之目的共享个人信息；过去 12 个月内未进行该等活动 |
| 保留期限 | 见第 6 条 |
您享有知情与访问、删除、更正、限制敏感个人信息使用与披露、选择退出出售或共享，以及不因行使上述权利而受歧视的权利。行使方式见第 8 条与第 15 条；您可授权代理人代为提出请求。
LayraxAI Privacy Policy
Effective Date: 【Year】/【Month】/【Day】 Version: 【1.0】
LayraxAI Pte. Ltd. (a company incorporated under the laws of Singapore, with its registered address at 【Singapore registered address】, hereinafter referred to as "LayraxAI" or "we") respects your privacy. This Policy explains how we, as the controller of personal data (an "organisation" under the Singapore Personal Data Protection Act 2012 (PDPA) and a "business" under applicable U.S. privacy laws), collect, use, disclose, transfer, and protect personal information, and how you may exercise your rights in relation to that information.
1. Scope of This Policy
1.1 Who This Policy Applies To. This Policy applies to natural persons who register an account in their individual capacity to use our products and services offered to individual users (hereinafter referred to as "you").
1.2 What This Policy Does Not Cover. This Policy does not apply to: (a) personal data that we process as a processor (data intermediary under PDPA), including personal data contained in Customer Content; where you seek to exercise rights in respect of such data, we will forward the matter to the relevant customer for handling in accordance with Section 7 of the DPA; (b) the privacy practices of third-party services and websites.
1.3 This Policy does not apply to the rights and obligations of enterprise customers and professional customers in respect of the Customer Content they upload, generate, or store; such matters are determined under the Enterprise Service Agreement or the Professional Services Agreement and its Schedule 1, the Data Processing Addendum (DPA). However, this Policy does continue to apply to the personal information that a customer (including a natural person who contracts in an individual capacity as a sole proprietor or independent practitioner) submits for its own registration, identity verification, billing, and payment, as well as the device and log information generated by its use of the Services; we process such information as the controller of that information in accordance with this Policy.
1.4 How the Boundary Is Determined. Whether this Policy or the DPA applies to a given item of content depends on whose account uploaded it: content you upload yourself constitutes Your Content and is governed by this Policy; content uploaded by a renovation company, design firm, or designer through its own account constitutes Customer Content and is governed by the DPA.
2. Personal Information We Collect
2.1 Information You Provide Directly. (a) Account and identity information: name or nickname, mobile phone number, email address, login credentials (passwords are stored in an irreversible form), and profile picture; (b) Your Content: the messages, annotations, and feedback you submit in the Services, and the photos and files you upload; (c) communication records: the support requests, complaints, and email correspondence you submit to us.
2.2 Information We Collect Automatically. (a) Device and connection information: device model, operating system and version, browser type and version, language and time zone settings, IP address, and device identifiers; (b) usage information: pages and features visited, times and durations of visits, click and action sequences, error logs and performance data, and referring pages; (c) information collected through cookies and similar technologies, see Section 10.
2.3 Information We Obtain from Third Parties. This includes information relating to you that a Service Provider (a renovation company, design firm, or designer) provides in order to send you an invitation or present a design proposal to you (such as your contact information and project information), as well as the necessary identity information provided by the identity provider when you choose to sign in with a third-party account.
3. Purposes for Which We Use Personal Information
We use personal information for the following purposes: (a) to provide, maintain, and support our services, including account registration and login verification, content display and synchronization, and messages and notifications; (b) to send you service notifications regarding service changes, security incidents, billing, and policy updates; (c) to respond to your inquiries, support requests, and complaints; (d) to improve our products and services, including analyzing feature usage, diagnosing faults, and conducting research and development; (e) to safeguard security, including preventing fraud, abuse, and unauthorized access, and investigating violations; (f) to fulfill legal obligations, including responding to lawful requests from competent authorities and to tax and accounting requirements; (g) to send you commercial communications, subject to your consent (see Section 9).
We process personal information only to the extent necessary to achieve the purposes above; if we change the purposes of processing, we will separately notify you and obtain any necessary consent as required by law.
4. Legal Bases for Processing (Singapore PDPA)
We collect, use, and disclose personal data under the PDPA on bases that include: consent given by you (including consent given by accepting an agreement or continuing to use the services); where necessary for the performance of a contract with you; where necessary for compliance with a legal obligation; and, to the extent permitted by the PDPA, where necessary for the legitimate interests of ourselves or others (such as safeguarding the security of the services, preventing abuse, and improving products), provided that such interests do not override your legitimate interests.
5. How We Share and Disclose Personal Information
5.1 No Sale and No Sharing (Important). We do not sell personal information, nor do we share personal information for the purpose of cross-context behavioral advertising.
5.2 We may share personal information in the following circumstances:
(a) service providers and Sub-processors, including cloud service providers, CDN providers, communications and email service providers, and customer support and data analytics providers. We agree with them on protection obligations no less stringent than those required by this Policy, and require them to process personal information only for the purpose of providing services to us;
(b) the renovation company, design firm, or designer that provides services to you, namely in respect of the messages, annotations, and uploaded content you submit in the Services, as well as the information necessary to enable them to send you an invitation or present a design proposal;
(c) our affiliates and professional advisers (audit, legal, and accounting);
(d) competent authorities, courts, or law enforcement agencies, where required compulsorily by law, or where necessary to protect the rights, property, and safety of us, you, or others;
(e) counterparties and their advisers in a transfer of business (merger, reorganization, asset transfer, or financing), in which case we will require the successor to continue to comply with requirements no less stringent than those of this Policy;
(f) other circumstances with your consent.
5.3 We require the recipients above to process personal information only to the extent necessary to achieve the purposes described in Section 3, and not to use it for their own purposes.
6. Retention Periods
We retain personal information only for the period necessary for the purposes described in Section 3, and may extend retention to the extent necessary to comply with legal obligations, resolve disputes, and enforce agreements. The specific periods are as follows:
| Category of Information | Retention Period |
|---|---|
| Account and identity information | For as long as the account exists and for 【12】months after its cancellation |
| Content you submit in the Services | Handled together with your account; the retention and deletion of any Customer Content therein is determined by the customer under its agreement with us |
| Logs and security records | No less than 【12】months |
| Billing, invoice, and tax records | The period required by applicable law |
| Subscription and unsubscribe records for commercial communications | 【24】months from the date of unsubscribing |
After the retention period expires, we will delete the personal information or anonymize it; data that meets the standard of being incapable of identifying a specific natural person and incapable of being restored will no longer be treated as personal data.
7. Cross-Border Transfers
We process, store, and access personal information on servers in multiple jurisdictions, including Singapore, the United States, and other countries and regions where our affiliates, service providers, and partners are located. Wherever your personal information is processed, we protect it in accordance with the protective measures described in this Policy, and we transfer it across borders only under lawful and valid data transfer mechanisms, including agreeing with recipients on data transfer and protection obligations, encryption in transit, access controls, and de-identification.
8. Your Rights
To the extent permitted by applicable law, you may:
(a) access and request information about the personal information we hold about you, and obtain a copy of it;
(b) correct personal information that is inaccurate or incomplete;
(c) delete your personal information (except where the law requires us to retain it);
(d) withdraw your consent to specific processing (withdrawal does not affect the validity of processing carried out on the basis of consent before the withdrawal);
(e) request that we transfer your personal information to another entity (the data portability obligation under the PDPA, applicable from its effective date);
(f) refuse to receive commercial communications (see Section 9);
(g) under applicable U.S. state laws: require us to limit the use and disclosure of sensitive personal information; opt out of targeted advertising and the sale or sharing of personal information (we do not currently engage in such activities); and not be subjected to discriminatory treatment for exercising the rights above;
To exercise the rights above, please contact us through the channels listed in Section 15. We will respond within the period required by applicable law: typically 30 days under the Singapore PDPA; typically 45 days under applicable U.S. state laws, which may be extended once as permitted by law. To protect your interests, we may need to verify your identity before processing your request.
If your request concerns personal data contained in Customer Content, we will forward your request to the relevant customer for handling in accordance with Section 7 of the DPA, and will inform you of the relevant circumstances.
9. Commercial Communications
We may send you commercial communications about new products and features, events and promotions, and usage tips and case studies. You may refuse to receive such communications at any time through the unsubscribe links we provide, the Account Console settings, or by notifying us in writing; we will stop sending them within a reasonable period (no more than 【15】days) after receiving your request. Your refusal to receive commercial communications does not affect the sending of service notifications, nor does it affect your use of the Services.
10. Cookies and Similar Technologies
We use cookies and similar technologies to keep you signed in, remember your preferences, safeguard security, and analyze usage. You can manage or disable cookies through your browser settings; however, disabling essential cookies may make certain features, such as sign-in and content synchronization, unavailable.
11. Security Measures
We adopt and maintain technical and organizational measures consistent with industry standards to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction, including encryption in transit, role-based access control and the principle of least privilege, operational log audits, backup and disaster recovery, and vulnerability management and security incident response mechanisms. We regularly assess and update these measures, but we will not materially reduce the overall level of protection for personal information.
If a security incident involving personal information occurs, we will notify you and the relevant regulatory authorities in accordance with applicable law.
12. Minors
Our services are not directed at children, and we do not knowingly collect children's personal information. Natural persons below the age prescribed by applicable law (under 16 years of age under applicable U.S. state laws, among whom those under 13 require the consent of a parent or guardian) should not register an account on their own. If we learn that we have collected a child's personal information without the necessary consent, we will promptly delete that information.
13. Third-Party Links and Services
Our services may contain links to third-party websites, services, or content. Third parties process your information under their own privacy policies, and we are not responsible for those practices. Please review a third party's privacy policy before providing information to it.
14. Changes to This Policy
We may revise this Policy to reflect changes in the law, regulatory requirements, or the services. Where a revision constitutes a material change, we will notify you at least 【30】days in advance through a website announcement, an in-product notification, or the contact information you have registered with us; other changes take effect on the date we publish them on the official website. If you continue to use the Services after this Policy is changed, you are deemed to have accepted the changed Policy.
15. Contact Us
Data Protection Officer (DPO) / privacy contact email: 【privacy contact email】; mailing address: 【Singapore registered address】.
If you believe that our processing of your personal information does not comply with applicable law, please contact us first; you may also file a complaint with the relevant regulatory authority (such as the Personal Data Protection Commission (PDPC) of Singapore) in accordance with applicable law.
16. Disclosures Specific to California Residents
If you are a California resident, the following disclosures are made under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):
| Item | Content |
|---|---|
| Categories of personal information collected in the past 12 months | Identifiers (name, contact information, account, IP address, device identifiers); internet activity information (browsing and usage); audio, electronic, and visual information (photos and videos you upload, if applicable); other information you voluntarily provide |
| Sources of the information | You, your devices, the customer that provides services to you, and our service providers |
| Purposes of collection and use | See Section 3 |
| Recipients of disclosure | See Section 5 |
| Sale and sharing | We do not sell personal information, nor do we share personal information for the purpose of cross-context behavioral advertising; we have not engaged in such activities in the past 12 months |
| Retention periods | See Section 6 |
You have the right to know and access, delete, correct, limit the use and disclosure of sensitive personal information, opt out of the sale or sharing of personal information, and not be discriminated against for exercising the rights above. For how to exercise them, see Section 8 and Section 15; you may authorize an agent to submit a request on your behalf.