Who we are
CanopyBay is CanopyBay Pte. Ltd. (UEN 202650288Z), a Singapore company that makes an AI ERP for businesses. It is responsible for your personal data under this policy, which covers our website canopybay.co and our sign-up app at app.canopybay.co, which is in pre-beta.
For any question about your personal data, write to our data protection contact at privacy@canopybay.co.
What we collect
When you sign up for your organisation, we collect:
- Your name, work email address, company name, job title (optional) and contact number.
- Your password, if you sign up with email. It is handled by Amazon Cognito, our sign-in service, and our staff never see it.
- If you sign in with Google: your name and email address from your Google account. We ask Google only for basic sign-in access (openid, email and profile). We never get your Google password, contacts, files or calendar.
- The two choices you make on the sign-up form, and when you made them.
- Your answers to our five questions about your business: its problems, the systems you use and what you want to achieve.
- Basic technical records that keep the service secure, such as when you signed in and the IP address and browser the request came from.
If you email us or message us on WhatsApp, we receive what you send.
Please don’t include sensitive personal data, such as NRIC numbers or health or bank details, in your answers. We don’t need it.
Why we use it
- To create your account, let you sign in and send the emails the account needs, such as your sign-up code and password resets.
- To contact you by email or phone about how CanopyBay could help your organisation, if you agree. This box is ticked on the sign-up form, and you can untick it.
- To send our newsletter and product emails, only if you tick that box. It starts unticked.
- To understand what businesses need, so we build the right product. Your answers are read by CanopyBay staff.
- To keep the service secure and to meet our legal obligations.
We don’t sell, rent or trade your personal data, we don’t use it for advertising, and we don’t use it to train AI models.
Your consent
We collect, use and disclose your personal data with your consent, which you give when you sign up, or where the PDPA otherwise allows it.
The two boxes on the sign-up form are separate choices. One lets us contact you to follow up on your sign-up. The other is for our newsletter and emails. We keep a record of what you chose and when.
You can withdraw either consent at any time, as described under Your rights. If you withdraw consent for us to contact you, we stop. We may then be unable to keep your account open, and we will tell you if so.
Where it is stored
Your sign-up data is stored on Amazon Web Services (AWS) in Singapore (region ap-southeast-1): Amazon Cognito for sign-in, and Amazon DynamoDB for your profile and answers. It is encrypted when it travels and when it is stored, and its backups stay in Singapore.
Some of the providers below, such as Google, may process data outside Singapore. Where that happens, we make sure your data is protected to a standard comparable to the PDPA, as the PDPA requires.
How long we keep it
- While we are in touch
- We keep your account and answers while you have an account or we are in contact with you about CanopyBay.
- When you ask us to delete it
- We delete your account and data within 30 days of your request.
- When we lose touch
- If there has been no contact either way for 24 months, we delete your sign-up.
- Backups
- Deleted data drops out of our backups within 35 days.
If you ask us to stop contacting you, we keep a short note of that request, so we don’t contact you again by mistake.
Your rights
Under the PDPA you can ask us to:
- Show you your data: what personal data we hold about you, and how we have used or disclosed it in the past year.
- Correct it if something is wrong or out of date.
- Stop contacting you or stop sending newsletters, by withdrawing your consent.
- Delete it: your account, profile and answers.
To do any of these, email privacy@canopybay.co, ideally from the email address you signed up with, so we can confirm it is you. We reply within 30 days, and these requests are free. Every newsletter also has an unsubscribe link that takes you off the list straight away.
If you are not happy with how we handled your request, you can contact Singapore’s Personal Data Protection Commission at pdpc.gov.sg.
How we protect it
- Every page and request uses HTTPS, and stored data is encrypted.
- Passwords are handled by Amazon Cognito. Our staff never see them.
- Only authorised CanopyBay staff can see sign-ups, and they must sign in with a second step, an authenticator app.
- Each person can see only their own profile and answers. The server checks this on every request.
If a data breach is likely to cause you significant harm, we will tell you and the Personal Data Protection Commission, as the law requires.
Changes to this policy
When we change how we handle personal data, we update this page and the date at the top. If a change is significant, we email account holders before it takes effect.
Contact us
Email privacy@canopybay.co for anything about your personal data, or hello@canopybay.co for anything else.