Legal

Data Processing Agreement

This agreement is part of Victor's Terms of Service, and applies to every firm, including during its free trial. It covers the personal data in the emails, rate sheets, requests and quotes a freight forwarding firm puts into Victor. The person setting up the firm on Victor agrees to it for the firm, by ticking its box at company setup. The annexes are part of it.

1. Who's who

• The firm is the freight forwarder that uses Victor. For the personal data in its emails, rates, requests and quotes, it's the organisation responsible under Singapore's Personal Data Protection Act 2012 (PDPA).
• Victor is PEBBLEBLACK PTE. LTD., UEN 202531369R, a company in Singapore. It processes this data for the firm, as a data intermediary. For its own records of the people who use Victor, such as their sign-ins, Victor is the organisation, and its Privacy and data notice applies instead.
• Personal data, processing, and data breach mean what the PDPA says they mean.
• Work contact details in a supplier's or a customer's email, such as a name, a job title and a work email address, may be business contact information. The PDPA doesn't treat that as personal data when it wasn't given only for a personal purpose. Victor still protects those details in the same way as the rest of the firm's documents, and this agreement covers them.

2. What's processed, and why

• Annex 1 says what data this covers, whose it is, and what Victor does with it.
• Victor processes it only to provide Victor to the firm, on the firm's instructions: this agreement, the Terms of Service, and what the firm's people do in Victor. That includes measuring and testing how well Victor reads the firm's own mail and documents, and how well Ask Victor answers its people.
• Victor may use the firm's emails, the documents in them, and what Victor read from them, to test the quality of its own reading and of Ask Victor's answers, such as trying a new AI model on them before Victor switches to it. It never uses them to train a model, never for another firm, and its tests use only the paid AI services in Annex 3, under the same terms. What it keeps for this is kept and deleted under section 7, as the firm's other records are. What Victor learns from these tests, such as a better rule, prompt or check, is an improvement to Victor that belongs to PEBBLEBLACK PTE. LTD. It never contains or reveals the firm's data.
• The firm's rates, quotes and customers are never shown to, pooled with, or used for another firm. Victor doesn't use the data for anything else, and doesn't sell it.
• The firm's own data and documents stay the firm's. That includes its customer data, its rates and its quotes. The firm grants PEBBLEBLACK PTE. LTD. only the licence needed to run Victor for the firm. All intellectual property in Victor belongs to PEBBLEBLACK PTE. LTD., as the Terms of Service say.
• Victor never sends anything to the firm's customers or suppliers. It drafts and checks quotes, and the firm's people approve and send them.
• Victor reads documents with a paid AI model provider. The firm gives a general authorisation, in advance, for AI model providers. PEBBLEBLACK PTE. LTD. may use, add, remove or change them at its sole discretion, without notice to the firm (section 4). It works out prices, chargeable weights, exchanges and margins in code, not with the model.
• Ask Victor is the assistant inside the app that answers the firm's people's questions about using Victor and about the firm's own records. It only reads: it can't change, approve, or delete anything. To answer, it looks up records in the firm's account that the person's role can already see, and sends the question and what it looked up to Anthropic's paid AI service, which writes the answer, or to Google's if Anthropic's is unavailable. Google's service also checks each question for misuse (Annex 3). Victor masks NRIC numbers, bank account numbers, email addresses and phone numbers in the question before it's sent and kept, and asks people not to paste NRIC numbers or bank details into it.
• The setup import reads a mailbox export that the firm's owner, an admin or Victor's team uploads. It reads the messages from the senders and dates the firm chooses, 12 months back by default, to find the firm's suppliers' rates and the quotes the firm sent. The uploaded file is kept in the same private storage in Singapore as the firm's other files while the import runs. Victor keeps a message in which it finds a request, a rate offer, a rate sheet or one of the firm's sent quotes. It deletes every other message's text and files once it has read them, and the uploaded file when the import ends. A file that isn't imported within 2 days of its upload is deleted.
• If Victor thinks an instruction breaks the PDPA, it tells the firm.

3. Keeping it safe

• Victor protects the data with reasonable security arrangements, as the PDPA's protection obligation requires. Annex 2 lists them. Victor may change them, as long as they protect the data at least as well.
• Everyone at Victor who can reach the data is bound to keep it confidential, and reaches only what their work needs.
• Victor's support team opens the firm's account only to help it, read-only, once the firm's owner has allowed it in Settings, for an hour at a time, with a reason. Every page they open goes in the firm's audit log, and the firm's owner and admins see each visit.
• Victor follows the PDPC's advisory guidelines on NRIC numbers: it doesn't ask for them, and masks any it reads from a document, in what it reads and keeps. It keeps each file as received, so a number printed on it can still be seen there by the firm's people who may open it.

4. Service providers, and data outside Singapore

• Victor uses the service providers in Annex 3. Annex 3 is the published list of the providers that process this data. PEBBLEBLACK PTE. LTD. keeps that list current as the providers change. Publishing the list, and keeping it current, is not a notice to the firm and is not a duty to give notice. Each provider is bound by its written data processing terms to protect the data, and to use it only to provide its service to Victor, and as those terms allow, such as keeping it for a short time to check for misuse, as Annex 3 says.
• AI model providers are one category on that list. The firm gives PEBBLEBLACK PTE. LTD. a general authorisation, in advance, to use AI model providers. PEBBLEBLACK PTE. LTD. may use, add, remove or change AI model providers at its sole discretion, without notice to the firm. There is no email about that change, no notice period, no right to object, no veto, and no refund because of it. Anthropic, through its paid API, is the primary reader of documents, and it writes Ask Victor's answers. Google, through its paid Gemini API, is the backup reader when Anthropic's service is unavailable. Google also checks Ask Victor's questions for misuse, writes those answers when Anthropic's service is unavailable, and checks a sample of them.
• Whichever AI model providers Victor uses, these stay the same: each is a paid service bound by written terms, as this section says. Victor doesn't let a provider train its models on the firm's data, or opt in to that. Victor still works out every price with its own rules, never with an AI model. The firm's data stays the firm's.
• Updating Annex 3 when an AI model provider is added, removed or changed keeps the published list current. That update is not a notice, and it is not a change that section 8 of the Terms of Service notifies. Singapore's Personal Data Protection Act 2012 does not give the firm a veto over Victor's service providers.
• Some providers process the data outside Singapore, in the countries Annex 3 names for each. Before Victor sends the data to a provider outside Singapore, it makes sure the provider is bound by written terms, enforceable by Victor, that require it to protect the data to a standard at least comparable to the PDPA's, and that name or point to the countries where it may process the data. Victor doesn't rely on a certification scheme for these transfers. Annex 3, kept current, is the record of those countries.
• For a service provider that is not an AI model provider, Victor emails the firm's owner and admins at least 30 days before it adds or replaces that provider, or moves this data to another country. That email is the notice in section 8 of the Terms of Service. The firm can stop using Victor before that change applies, and Victor refunds the fees paid in advance for whole months after it ends. The firm has no veto over the change. That notice and that refund do not apply to an AI model provider.

5. A data breach

• Victor tells the firm without undue delay, as the PDPA requires of a data intermediary, and within 24 hours, after it has credible grounds to believe the firm's data has been breached. That includes the firm's rates, quotes or customers reaching another firm, a supplier or a customer, even where no personal data is in them. It then keeps the firm up to date.
• Victor says what happened, what data, and about how many people, what it has done, and whom to contact. It shares more as it learns it.
• Victor helps the firm assess whether the breach is notifiable, within the 30 days the PDPC expects, and helps it notify the PDPC within 3 calendar days of assessing that it is, and the people affected as soon as practicable where significant harm is likely.
• Victor doesn't notify the PDPC or the people affected about the firm's data itself, unless the firm asks it to or the law requires it.
• Victor follows its written plan for handling a data breach, and reviews the plan at least once a year.

6. People's requests

Victor helps the firm answer anyone who asks to see or correct their personal data, within the PDPA's time limits: as soon as reasonably possible, and within 30 days or by telling them by then when it will. The firm's people can find, correct, and export records in Victor themselves. If someone asks Victor directly, Victor passes the request to the firm within 3 working days.

7. How long it's kept

The firm instructs Victor to keep its data until the firm's owner asks in writing for it to be deleted, so that the firm keeps its full rate and quote history and its audit trail. The firm decides when it no longer needs the data, and asks for deletion then.

• Victor keeps the firm's data, whatever the firm's standing: in its trial, paid, late with a payment, or with payment needed. It never deletes it for not paying, or when a trial or a pilot ends, and nothing is deleted by a schedule.
• The one exception is the firm's written request. The firm's owner asks Victor in writing to delete the firm's data, and Victor deletes it within 30 days. That deletes every record and document of the firm, and the sign-ins of its people. Victor keeps only a record that it was deleted: the firm's name, who asked, when, and who deleted it. Victor confirms the deletion in writing. A copy in the database's daily backups is deleted when that backup expires, within 7 days, and the firm's files are removed from the nightly backup copy within a day.
• The emails forwarded to the firm's Victor address, which Victor keeps whole as received, whether it read them or skipped them as bulk mail, and what Victor read from each document, with the AI model and its usage, are kept as the firm's other data is. Victor masks NRIC numbers in the text of the emails it keeps.
• A few things are temporary, because they aren't part of the firm's records:

- Ask Victor's conversations, which are the questions, the answers, the look-ups made to answer them, and the ratings. They're deleted automatically 90 days after the conversation was last used, and each person can clear their own sooner. A copy in the database's daily backups is deleted when that backup expires. - Copies of the AI model's answers that Victor's servers keep so the same document isn't read twice, which are deleted after a day. - A file written for a request that failed, which no record holds, which is deleted an hour later. - The setup import's uploaded file, which is deleted when the import ends or, if it isn't imported, after 2 days, and the messages it doesn't keep (section 2).

• If the firm leaves, Victor still keeps its data, so the owner can sign in to read and download it, until the owner asks for its deletion.
• If Victor stops providing its service altogether, it gives the firm at least 90 days' notice to download everything, and deletes the data only after that notice ends.

8. Checking

Victor answers the firm's reasonable questions about how it protects the data. When the firm asks, once a year or after a breach, it shares a summary of how it has tested and reviewed its security. The firm can ask for an audit by an independent auditor, at its own cost, with 30 days' notice, under a confidentiality agreement.

9. The firm's obligations

The firm makes sure it may lawfully give this data to Victor for these purposes, including processing outside Singapore, and tells the people concerned, such as its customers' and suppliers' contacts, where the PDPA requires it. The firm also makes sure, as far as it reasonably can, that the personal data it sends is accurate and complete.

10. How it fits with the Terms

This agreement lasts as long as Victor holds the firm's data. Where it and the Terms of Service disagree about personal data, this agreement wins. That does not require a notice of a change to an AI model provider, and it does not apply section 8 of the Terms of Service to that change. Section 4 is the rule for an AI model provider: no notice, no email, no notice period, no objection, no veto and no refund. Section 8's 30-day notice and refund stay for another change to the Terms or this agreement, and for a sub-processor that is not an AI model provider. Singapore law governs this agreement, and the courts of Singapore decide any dispute about it. The Terms' limit on liability applies to this agreement: each side is liable, for all claims together under this agreement and the Terms, for no more than the fees the firm paid in the 12 months before the event that led to the first claim, or S$500 if that's more. This doesn't limit liability the law doesn't allow to be limited, and it doesn't limit the fees the firm owes. It also doesn't limit the firm's liability for using Victor in breach of section 5 of the Terms, or for a breach of PEBBLEBLACK PTE. LTD.'s intellectual property. Custom terms that Victor and the firm agree in writing add to this agreement, and win where they differ, except that they do not require notice of a change to an AI model provider. Section 4 wins on that point.

Annex 1: the processing

Annex 2: security measures

• Encryption in transit, with TLS, and at rest, for the database, files, and backups.
• Each firm's data kept apart: every query is limited to the signed-in person's firm, tested on every route.
• Row level security on every table, so the database's own public interface can't read any of it.
• Ask Victor reads the firm's records through a read-only database account, limited by row level security to the signed-in person's firm.
• Sign-in with a password of at least 8 characters, for each person, with their email address confirmed first. There's no second sign-in step (two-factor).
• Roles with least privilege, set by the firm.
• Sessions that end after the firm's idle time, 4 hours by default, and after the firm's longest sign-in, 12 hours by default.
• Rate limits on every request, sign-in attempts, invitations, uploads, emails received, and exports.
• An append-only audit log of every change, approval, and support visit.
• NRIC numbers masked in what Victor reads from documents.
• Logs that name documents by ID and fields by name, never their contents.
• Error reports without document contents or personal data.
• Daily database backups, a nightly copy of files to a second private bucket in Singapore, and a restore test every 3 months.
• Support access that's read-only, time-limited, logged, and visible to the firm.
• A written plan for handling a data breach, and a Data Protection Officer at james@talktoproppy.com.

Annex 3: service providers

The firm gives a general authorisation, in advance, for paid AI model providers. PEBBLEBLACK PTE. LTD. may add, remove or change them at its sole discretion, without notice, as section 4 says. PEBBLEBLACK PTE. LTD. keeps this list current. Keeping it current is not a notice to the firm. Victor does not use the firm's documents to train a model, and it does not opt in to a provider using them to train one. Of the providers named above, these are the terms read on 2026-10-25. Google's terms for its paid Gemini API say Google does not use prompts or responses to improve its products, processes them under its data processing addendum, and logs them for a limited time only to detect misuse and meet legal requirements. Google's abuse-monitoring page for that API says the log is kept for 55 days, and that it is not used to train models except the ones Google uses to enforce its own policy. Anthropic's notice for its commercial API says that, by default, it does not use inputs or outputs to train its models, and that it deletes them within 30 days, unless it must keep them longer to enforce its usage policy (up to 2 years if a conversation is flagged) or the law requires it. Victor does not opt in to that training, and does not send ratings or feedback to Anthropic. Those sentences describe the named providers. They are not a promise about a provider Victor adds later.