LLMSource Pte. Ltd.
Privacy Policy

This Privacy Policy explains how we collect, use, disclose and otherwise process personal data, and the rights available to individuals whose personal data we handle. We provide a software-as-a-service platform (“Service”) that helps businesses understand and improve how they are described and recommended by AI systems, including by scanning a business’s website and structured data, testing AI-generated outputs about the business, and providing analysis, scoring and monitoring based on the results. This Policy applies to personal data we process in connection with the Service, our websites, and our sales, marketing, support and business communications. It does not apply to third-party websites, products or services that we do not control, including the websites we scan on our customers’ instructions and the AI systems we query.

Data protection law distinguishes between the party that determines the purposes and means of processing (a “controller”; the responsible “organisation” under the Singapore PDPA; a “business” under California law) and the party that processes personal data on that party’s behalf (a “processor”; a “data intermediary” under the Singapore PDPA; a “service provider” under California law). We act in either capacity, depending on the activity.

Where we are the controller. We are the controller of personal data relating to the administration of our business. For example, account registration and authentication data, billing and transaction data, the personal data of individuals who correspond with us, marketing contacts, website visitor data, and the security and operational logs generated by the Service.

Where we are the processor. When we process content relating to a customer’s website or business on the customer’s instructions in the course of delivering the Service, the customer is the controller and we are the processor. Our processing in that capacity is governed by the SaaS agreement and the data processing addendum entered into with the customer, and any request from an individual concerning such content should ordinarily be directed to the relevant customer as the controller.

A customer who is an individual is our contracting counterparty and a data subject: we are the controller of their account, billing and communications data, and their processor in respect of the personal data contained in the website content and other materials we process on their instruction. Where a conflict arises, the SaaS agreement and data processing addendum govern the processor relationship, and this Policy governs our controller processing.

The categories of personal data we process, whether as controller or on a customer’s behalf, are set out below. Not every category is processed for every individual, and much of the data we handle relates to businesses rather than to identifiable individuals.

Sensitive data. The Service is not designed to process special categories of personal data (as defined by the GDPR) or sensitive personal information (as defined by California law), and we ask customers not to submit such data through claims, evidence or scanned content unless strictly necessary and lawful. The authentication credentials used to secure an account may constitute sensitive personal information under California law, we use them only to authenticate access and secure the Service. Although we ask customers not to submit special categories of personal data (as defined by the GDPR) or sensitive personal information through claims, evidence or scanned content, such data may occasionally appear in that content. Where we process it on a customer’s instruction, the customer is responsible for establishing a lawful basis and any additional condition required for such data. Where we act as a controller, we process it only where the conditions under applicable law are met.

We collect personal data:

Personal data we obtain indirectly. Some personal data we process are not obtained from you directly but from the websites we scan, the AI systems we query, and public sources such as registries and directories. Where we process such data as a processor on a customer’s instruction, the customer, as controller, is responsible for providing any notice required to the individuals concerned. Where we act as a controller of such data, we provide the information required by applicable law, including Article 14 of the GDPR, unless an exemption applies.

We process personal data only where a lawful basis applies. Where the GDPR governs the processing, we rely on the legal bases identified below. Where another data protection law applies, we rely on the equivalent lawful basis available under that law, such as your consent or the necessity of the processing to perform a contract to which you are a party, as described in the regional provisions in section 16.

Where we rely on legitimate interest, we assess that those interests are not overridden by your interests or fundamental rights and freedoms. You may ask us for further information about that assessment. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. The withdrawal will take effect as soon as practicable after we receive your withdrawal notification.

The Service uses automated and AI-based analysis to help businesses understand how they are described online. This analysis is directed at businesses and their online presence; it is not designed to evaluate identifiable individuals, and it does not produce legal effects concerning an individual or similarly significantly affect an individual within the meaning of Article 22 of the GDPR. Where any feature would involve a decision about an individual based solely on automated processing and producing such effects, we will implement the safeguards required by applicable law, including the right to obtain human intervention, to express a point of view and to contest the decision.

Third-party AI systems. The Service queries third-party AI systems to assess and monitor how they describe and respond to queries about a business. These AI systems operate as independent products, are not under our instruction or control, and act as independent controllers in respect of any data contained in our queries to them, in accordance with their own privacy terms. We do not control, and are not responsible for, how these AI systems process, retain or use that data, including whether they use it to train or improve their own models. The responses returned by these systems reflect the third-party AI system and not us, and may be inaccurate, including in relation to individuals. An individual who wishes to correct information that an AI system produces about them should contact the operator of that system.

Model training. We do not use customer content or the personal data contained in it to train, fine-tune or develop AI or machine learning models, whether our own or those of any third party. Where we use machine learning to maintain and improve the Service, we utilize aggregated or anonymised data that does not identify any individual. If we change this position, we will update this Policy and, where required by law, obtain your consent or offer you a means to opt out.

Inferences. Any inferences we draw relate to a business’s online presence and not to the evaluation of an identifiable individual.

We disclose personal data only as described in this Policy. We disclose personal data to:

Payments. We use a third-party payment processor to process payments. Your card and payment details are provided directly to our payment processor and are not collected or stored by us. Our payment processor processes payment data as an independent controller for its own purposes, including processing the transaction, preventing fraud, and complying with legal and payment network obligations, in accordance with its own privacy policy. We receive from our payment processor only limited transaction details needed to administer billing. We do not sell personal data, and we do not share personal data for cross-context behavioural advertising as those terms are defined under California law. Where we act as a processor, we disclose the personal data contained in customer content only as instructed by the customer and as permitted by the applicable data processing addendum in the SaaS agreement.

We are established in Singapore and use service providers located in various countries. As a result, personal data may be transferred to, stored in, or accessed from countries other than the one in which you are located, including countries that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data across borders, we implement a transfer mechanism recognised under applicable law. For transfers from the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or on the Commission’s adequacy decision. For transfers from other jurisdictions, we rely on the mechanism required by the applicable law, such as the recipient’s provision of an adequate level of protection, appropriate contractual safeguards, or your consent, as described in the regional provisions in section 16. You may request a copy of the relevant safeguards.

We keep personal data for as long as necessary to fulfil the purposes for which it was collected, including to provide the Service, to comply with our legal, accounting and reporting obligations, and to establish, exercise or defend legal claims. To determine the appropriate retention period, we consider the nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and applicable legal requirements.

In general, we retain:

When personal data is no longer required, we delete it or irreversibly anonymise it.

Anonymised and aggregated data. Where we anonymise or aggregate personal data, we maintain it only in anonymised or aggregated form, do not attempt to re-identify it except as necessary to test the effectiveness of our anonymisation, and require any recipient to be bound by the same restrictions. We do not treat such data as personal data for so long as it is maintained in that form.

We maintain technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls and encryption, security controls for our systems and software, logging and monitoring, staff confidentiality obligations and training, and governance and audit trails. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Where the law requires it, we will notify the relevant supervisory authority and affected individuals of a personal data breach within the applicable timeframes.

We and our providers use cookies and similar technologies on our websites and within the Service to enable core functionality, remember your preferences, maintain security, and measure and improve performance. Where required by law, we obtain consent before setting non-essential cookies and provide a means to manage your preferences. Further detail is set out in our Cookie Policy, which forms part of this Policy.

Depending on where you are located or the law that applies to you, you may have rights in respect of your personal data, including the rights to access, correct, delete, port, restrict or object to processing, and to withdraw consent. The specific rights available to you, and how to exercise them, are described in the regional provisions in section 16. Where we process personal data as a processor on a customer’s behalf, please direct your request to that customer as controller; we will assist the customer in responding as required by our agreement with it. To exercise a right in respect of personal data for which we are the controller, contact us. We will respond within the period required by applicable law. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

The Service is intended for business and professional use and is not directed to children. We do not knowingly collect personal data directly from children. “Child” is understood in accordance with the applicable regional law described in section 16, including individuals under 16 in the European Economic Area (subject to Member State law) and in the United States for the purposes of the relevant rules. If you believe a child has provided personal data to us, please contact us so that we can take appropriate action.

The Service and our websites may link to, or interoperate with, third-party websites and services, including the websites we scan and the AI systems we query. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy notices.

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make a material change, we will update the “Last updated” date above and, where required by law, provide a more prominent notice or seek your consent. Please review this Policy periodically.

This section sets out additional information and rights that apply to individuals in particular jurisdictions. In the event of a conflict between this section and the rest of the Policy, this section governs for the individuals to whom it applies. Where a jurisdiction below is a Member State of the European Union or the EEA, the European Union and EEA provisions in section 16.4 also apply.

If you have any questions about this Policy or wish to exercise your rights, you may contact us as follows:

Data controller: LLMSource Pte. Ltd., 750D Chai Chee Road, #06-01 ESR BizPark @ Chai Chee, Singapore 469004.

Data Protection Officer: [email protected].