Privacy Policy

1.1 Who we are. graymatter is operated by INTERLINK VENTURE MANAGEMENT PTE. LTD. (UEN 202020541Z), a company incorporated in Singapore with its registered address at 8 TEMASEK BOULEVARD, #42, SUNTEC TOWER THREE, SINGAPORE 038988 ("graymatter", "we", "us" or "our"). You can reach us at support@graymatter.dev.

1.2 What this policy covers. This Privacy Policy explains how we collect, use, disclose and look after your personal data when you use the graymatter website at graymatter.dev, our daily case emails, and related features (together, the "Service"). It applies to visitors, Free members and Plus members.

1.3 The law we follow. We handle personal data in line with Singapore's Personal Data Protection Act 2012 ("PDPA") and its regulations. "Personal data" means data, true or not, about an individual who can be identified from that data, or from that data together with other information we have or are likely to have. This policy forms part of our Terms of Service.

1.4 Your consent. By creating an account, signing in, subscribing to our emails or buying Plus, you consent to us collecting, using and disclosing your personal data as this policy describes. You can withdraw your consent at any time (section 7.3).

2.1 What we collect. We collect only what we need to run, improve and promote the Service. Most of it you give us directly; some is created automatically as you use the Service or interact with our emails.

2.2 Card details. We never see or store your full payment card number. Payments are made on our third-party payment processor's checkout page, and our payment processor collects and keeps your card details, billing name and billing address under its own privacy policy.

2.3 Profile details are optional. Aside from your email address, profile details and profile photos are optional. Please do not put sensitive personal data, such as health, financial or government identity card details, in your profile or notes.

2.4 Local browser storage. Some features also store small pieces of data in your own browser so the Service works smoothly—for example, a record that you are signed in and interface settings such as whether you have dismissed a prompt. You can clear this at any time by clearing your browser's site data.

3.1 Our purposes. We use your personal data to:

1. create your account and sign you in by sending a one-time link to your email;
2. show you cases, keep your profile and profile photo, and (while you have Plus) keep and show your saved cases, pins, highlights and notes;
3. sell, renew and manage Plus, including taking payment, sending receipts and renewal reminders, handling refunds, and keeping your plan up to date;
4. send the daily case email and other emails you have signed up for, and measure email engagement (such as open and click rates) so we can improve our content and keep our mailing list active;
5. reply to your messages and give you support;
6. keep the Service secure, prevent fraud and misuse, and fix technical problems;
7. understand how visitors and members use the Service and measure the effectiveness of our marketing and advertising campaigns; and
8. meet our legal, tax and accounting duties, and establish, exercise or defend legal claims.

3.2 Our basis for using it. Under the PDPA we rely on:

• your consent, which you give when you sign up, fill in your profile, subscribe, buy Plus, or accept cookies and tracking technologies;
• deemed consent, where you give us data for a clear purpose (such as writing to us), or where we need to share data to perform our contract with you (such as passing your email to our payment processor so you can pay); and
• exceptions the PDPA allows without consent, such as our legitimate interests in keeping the Service secure and preventing fraud, business improvement (improving and personalising the Service), and meeting legal duties.

3.3 The daily case email. When you create an account, you also subscribe to our daily case email, as we tell you on the sign-up form. Every daily case and marketing email has an unsubscribe link, and unsubscribing does not close your account. We will still send essential emails you need to use the Service, such as sign-in links, receipts and renewal reminders.

3.4 New purposes. If we want to use your personal data for a purpose not described here, we will tell you and, where the PDPA requires it, ask for your consent first.

3.5 No selling of data, and no automated decisions. We never sell or rent your personal data to third parties, and we do not make decisions about you that have legal or similarly significant effects based only on automated processing.

4.1 Service providers. We use trusted third-party service providers to run, analyse and promote the Service. Each provider handles personal data only on our instructions or for the purposes described in this policy, under contracts that require them to protect the data:

4.2 Other disclosures. We may also disclose personal data:

• to our professional advisers, such as lawyers, accountants and auditors, under a duty of confidence;
• when the law requires it, or to a public agency or regulator (such as the Singapore police, IRAS, or the Personal Data Protection Commission) when lawfully requested;
• to protect the rights, property or safety of our members, the public or us; and
• to a buyer or successor if we sell, merge or reorganise all or part of our business, on terms that keep this policy's protections.

4.3 Other members. Your profile details, profile photo, saved cases, highlights and notes are strictly private to your account. Other members cannot see them.

5.1 Where your data goes. Our third-party service providers (see section 4.1) may store and process your personal data on servers located outside Singapore, including in the United States, the European Union and other regions where our cloud, payment, email and analytics providers operate.

5.2 How we protect it. When we transfer personal data out of Singapore, we take steps to ensure it receives a standard of protection comparable to the PDPA, as the PDPA's Transfer Limitation Obligation requires. We do this through binding contractual data protection terms with our providers, and by choosing reputable providers that hold recognised security certifications or follow legally enforceable data protection rules. You can ask our Data Protection Officer for more detail on these safeguards.

6.1 How long we keep it. We keep personal data only for as long as we need it for the purposes in this policy or as the law requires, and then delete it or make it anonymous:

Deleting your account: When you ask us to close and delete your account completely, we delete your account, profile, photo, and any active saved cases, highlights and notes from our active database within 30 days (and from routine encrypted server backups within a short period after that), except for data we must keep by law, such as payment and invoice records.

6.2 Security. We protect personal data with reasonable security arrangements. These include encrypted connections (HTTPS), one-time sign-in links that expire after a short time so we never hold passwords, strict database access rules that let each member read only their own records, payments handled entirely by our third-party payment processor, and internal system access limited to authorised personnel. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

6.3 Data breaches. If a data breach happens, we will assess it promptly, and in any case within 30 days of suspecting it. If it is a notifiable breach under the PDPA (meaning it is likely to cause you significant harm, or affects the data of 500 or more people), we will notify Singapore's Personal Data Protection Commission ("PDPC") as soon as practicable and within 3 calendar days of that assessment. Where the breach is likely to cause you significant harm, we will also notify you as soon as practicable, explaining what happened and the steps you can take to protect yourself.

6.4 Accuracy. We rely on you to keep your email address and profile accurate. You can update your profile on the site at any time, and you can ask us to correct anything else (section 7.2).

7.1 Access. You can ask for a copy of the personal data we hold about you and information about how we have used or disclosed it in the past year. We may charge a reasonable administrative fee to cover the cost of an access request; if so, we will tell you the amount before we start.

7.2 Correction. You can ask us to correct an error or omission in your personal data. Unless we have good legal reason not to, we will correct it as soon as practicable and, where needed, send the corrected data to other organisations we disclosed it to in the past year.

7.3 Withdrawing consent. You can withdraw your consent to our collection, use or disclosure of your personal data at any time by giving us reasonable notice. We will tell you what withdrawing will mean for you. If we need the data to run your account or Plus (such as your email address), withdrawing consent may mean we have to close your account. Withdrawing does not affect what we lawfully did before, or data we must keep by law. To stop only the daily case email or marketing emails, use the unsubscribe link in any email.

7.4 Deleting your account. You can ask us to close your account and delete your personal data at any time. Please cancel Plus first, as our Terms of Service explain.

7.5 Data portability. When the PDPA's data portability obligation comes into force in Singapore, you will be able to ask us to send certain data to another organisation in a commonly used electronic format, as the regulations then allow.

7.6 How to ask, and when we reply. Write to our Data Protection Officer at dpo@graymatter.dev from the email address on your account, so we can confirm your identity. We will reply to access and correction requests within 30 days. If we need longer, we will tell you within 30 days when we expect to reply. If we refuse a request, we will tell you why, unless the law prevents us.

7.7 Complaints. If you are unhappy with how we have handled your personal data, please contact our Data Protection Officer first so we can try to put it right. You also have the right to lodge a complaint with Singapore's Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

8.1 What we use on the website. We use cookies, pixels and local browser storage for three purposes:

• Essential storage: Your browser keeps your sign-in session so you stay signed in between visits, along with small interface settings. Our payment processor also sets necessary cookies on its checkout and billing pages to process payments and prevent fraud.
• Analytics: We use analytics tools (such as Google Analytics) to collect information about how visitors use the site—such as which pages are visited most often and how people find us—so we can improve the Service.
• Advertising and measurement pixels: We use tracking pixels from advertising platforms (such as the Meta Pixel and LinkedIn Insight Tag) to understand whether our ads on those platforms lead to sign-ups or subscriptions, and to reach people on those platforms who may be interested in graymatter.

8.2 Email tracking. Our emails contain a small, invisible tracking pixel and tracked links. These tell us whether an email was delivered and opened, and which links were clicked. We use this to measure engagement with our daily cases and keep our mailing list reliable.

8.3 Your choices. You can manage or block cookies and tracking in several ways:

• Browser settings: You can block or delete cookies and site data in your browser settings. Note that blocking essential cookies will sign you out of graymatter.
• Analytics and ad opt-outs: You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, and you can manage how Meta and LinkedIn show you ads in your account ad settings on those platforms.
• Email pixels: If you do not want email opens to be tracked, you can set your email client to block automatic loading of remote images, or unsubscribe from our daily case emails.

9.1 Children and minors. Learners and readers of all ages may use graymatter, subject to our Terms of Service. However, in line with PDPA guidelines, if you are under 13 years old, you must have the verifiable permission of your parent or legal guardian before creating an account, subscribing to emails, or giving us any personal data or profile photo. If you are under 18 years old, you must have the permission of your parent or legal guardian to buy Plus. If you are a parent or guardian and believe your child under 13 has given us personal data without your permission, please contact us at dpo@graymatter.dev and we will delete it promptly.

9.2 International readers and members. graymatter is operated from Singapore, and your data is governed primarily by the PDPA. If you access the Service from outside Singapore, the following additional terms may apply where required by your local law:

• EEA, UK and Switzerland: Where the GDPR or UK GDPR applies, we act as the "data controller" of your personal data. Our lawful bases for processing your data are: (a) performing our contract with you (running your account and Plus); (b) our legitimate interests (securing and improving the Service, measuring engagement, and B2B/professional marketing); (c) your consent (for optional profile details, marketing emails and non-essential cookies/pixels, which you can withdraw at any time); and (d) complying with legal obligations. Depending on your location, you may also have the right to request restriction of processing, object to processing, or lodge a complaint with your local data protection authority.
• United States (including California): We never sell your personal information, and we do not share your personal information with third parties for their own direct marketing purposes. Depending on your state of residence, you may have the right to request access to or deletion of your personal information, and to opt out of targeted advertising (see section 8.3). We will never discriminate against you for exercising your privacy rights.

9.3 Other websites. Cases link to sources and other websites. Their owners decide how they handle your data, so please read their privacy policies.

9.4 Changes to this policy. We may update this policy from time to time. We will post the new version on this page with a new date, and if a change materially affects how we use your personal data, we will email you before it takes effect.

9.5 Contact us. For questions or requests about your personal data, contact our Data Protection Officer:

• Email: dpo@graymatter.dev
• Post: INTERLINK VENTURE MANAGEMENT PTE. LTD., 8 TEMASEK BOULEVARD, #42, SUNTEC TOWER THREE, SINGAPORE 038988

For anything else, write to support@graymatter.dev.