berthcast ("we", "us", "our") provides an inventory analysis service to food distribution and similar businesses. This Privacy Policy explains what personal data we collect when you use the Service, how we use it, who we share it with, and the rights you have over it.
This policy applies to personal data of users of the Service (account holders, employees of customer organisations) and of individuals whose data appears in customer-uploaded files (for example, contact persons in a supplier list).
When you use the Service, you upload business data including:
Some of this data may include personal data of third parties (for example, a supplier's contact email). By uploading it, you confirm that you have a lawful basis under the PDPA (or equivalent law applicable to you) to share that data with us for the purpose of running the Service.
We do not run third-party analytics, advertising trackers, or session-recording tools anywhere in the Service.
If you contact us through the website's contact form (with or without an account), we collect the name, email address, company name, and message you submit. We use this data solely to respond to your enquiry and to set up accounts you request, and we keep it for up to 12 months.
We use your data to:
| Purpose | Examples |
|---|---|
| Provide the Service | Authenticate you, run analyses on your uploaded data, generate recommendations, save your approvals. |
| Communicate with you | Send verification emails, password resets, critical-stock alerts, and (if you opt in) product updates. |
| Improve the Service | Aggregated, anonymised statistics (for example, how many analyses run per week). We do not use your uploaded business data to train AI models — ours or anyone else's. |
| Keep the Service safe | Detect abuse, fraud, and security incidents. |
| Comply with the law | Respond to legitimate legal requests and meet our regulatory obligations under the PDPA and other applicable law. |
We share data only with sub-processors who help us run the Service. Each is contractually bound to confidentiality and limited use:
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic, PBC | AI model inference (Claude) used to generate recommendations from your data. | United States |
| Render, Inc. | Application hosting, database storage, log retention. | United States (primary) |
| Google LLC (Gmail SMTP) | Outbound transactional email (verification, password reset, alerts). | Global |
| Cloudflare, Inc. | Content delivery, TLS, and denial-of-service protection in front of the Service (proxies all traffic and therefore sees visitor IP addresses). | Global |
| Google LLC (Google Fonts) | Font files loaded when pages render (Google receives the visitor's IP address as part of serving the font). | Global |
We do not sell your personal data. We do not share your data with advertisers, data brokers, or for any purpose unrelated to providing the Service.
We may share your data in response to a valid legal request (court order, regulator subpoena, law enforcement requirement) where we are legally obliged to do so. We will notify you where we are lawfully permitted.
The Service is operated from Singapore. Some of our sub-processors store and process data outside Singapore, primarily in the United States. Where data is transferred out of Singapore, we take reasonable steps under section 26 of the PDPA to ensure the recipient is bound by enforceable obligations to protect the data at a standard comparable to that under the PDPA.
We retain your data for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution obligations. Specifically:
You may request earlier deletion by contacting us (see section 12). We will honour the request unless we are required by law to retain the data longer.
We use commercially reasonable technical and organisational measures to protect your data, including:
No online service is fully secure. If we become aware of a personal data breach that is likely to result in significant harm to you or to the individuals whose data you have uploaded, we will notify you and the Personal Data Protection Commission as required by Singapore law.
Under the PDPA, you have the right to:
To exercise any of these rights, contact us using the details in section 12. We will respond within 30 days. Where we cannot honour a request (for example, because we are legally required to retain the data), we will explain why.
The Service uses a small number of cookies that are strictly necessary for it to function (for example, to keep you logged in). We do not use advertising cookies, third-party analytics that profile you across the web, or tracking pixels in marketing emails. If we add optional analytics in future, we will update this policy and provide a clear opt-in.
The Service is a B2B tool not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this Privacy Policy from time to time. When we make a material change, we will notify account holders by email or via the Service at least 14 days before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.
Questions about this policy, or any request to exercise your rights under the PDPA, can be sent through our contact page or emailed to admin@berthcast.com. Mark your message "Privacy request" so we route it correctly.
Our designated Data Protection Officer (DPO) under section 11(3) of the PDPA can be contacted directly at admin@berthcast.com.