Legal
Privacy Policy
Last updated: 30 October 2026 · Crelis Labs Pte. Ltd. (UEN 202634291E), Singapore
This policy explains what personal data Crelis collects, why, who we share it with, how long we keep it, and the choices and rights you have.
At a glance
- We do not sell personal data, show advertising, or use customer data to train AI models.
- The Website sets no tracking or analytics cookies today; contact buttons open your own email program.
- Hosted GREENLIGHT data is stored in the AWS Singapore region; customers control what they send and how long it is kept.
- For data our customers send to GREENLIGHT, the customer decides how it is used and we act on their instructions.
- You can ask to access or correct your data, or withdraw consent, by writing to our Data Protection Officer at support@crelis.ai.
This summary is for convenience. The full text below is what applies.
1. Who we are and what this policy covers
Crelis Labs Pte. Ltd. (UEN 202634291E) is a company incorporated in Singapore and trading as Crelis.ai (“Crelis”, “we”, “us”). We build GREENLIGHT, a runtime authorization platform that decides whether actions proposed by AI agents may go ahead and keeps verifiable evidence of each decision.
This policy explains how we collect, use, disclose and protect personal data when you:
- visit crelis.ai or read our blog and knowledge pages (the “Website”);
- contact us, ask for a demo or apply for pilot access;
- sign in to the GREENLIGHT console or use our APIs, SDKs or gateway (the “Services”) as a user on behalf of an organisation; or
- deal with us as a business contact, supplier or partner.
We handle personal data in line with the Singapore Personal Data Protection Act 2012 (“PDPA”). Where other laws apply to you, such as the EU or UK GDPR, we also follow them as described in section 11.
2. Our two roles: organisation and data intermediary
We handle personal data in two different capacities, and this policy treats them differently.
| When we decide (organisation / controller) | When a customer decides (data intermediary / processor) | |
|---|---|---|
| What data | Website and enquiry data, business contacts, console user accounts, sign-in and security records, billing contacts | Data a customer sends to the Services: agent action requests, decision inputs, policies, approvals and audit records (“Customer Data”) |
| Who decides how it is used | Crelis | The customer organisation |
| What governs it | This policy | The customer’s agreement with us, including any data processing terms |
If your personal data reaches us as Customer Data, for example because a customer’s agent acted on your account, the customer is responsible for it. Please contact that organisation first. If you contact us, we will pass your request to the customer and help them respond.
3. Personal data we collect
Information you give us
- Enquiries and demo requests. Our contact, demo and pilot access buttons open your own email program addressed to us. We receive what you choose to send, typically your name, work email, company, role and message. The Website itself does not store form entries.
- Business relationships. Contact details and correspondence with customers, partners, suppliers and event contacts.
- Console accounts. Your name, work email, organisation, role and permissions, created by you or by your organisation’s administrator.
- Security reports. Details you send under our Responsible Disclosure Policy.
Information collected automatically
- Website requests. Our hosting provider processes your IP address, browser and device type, the pages requested and timestamps in order to serve and secure the site.
- Sign-in and security data. When you use the console we record sign-in events, IP address, browser, session identifiers and the administrative actions you take. These records keep accounts secure and form part of the audit trail.
- Passkeys. If you register a passkey, we store only its public key and identifier. Your private key and any biometric data stay on your device.
- Your cookie choice. Stored in your browser so that we do not ask again (see section 9).
Information from third parties
- Sign in with Microsoft. If you sign in through Microsoft Entra ID, Microsoft sends us your name, email address and organisation identifiers. We do not receive your Microsoft password.
- Your organisation. Administrators may add you as a user and assign your role.
- Public sources. Professional details that you have made public, such as on LinkedIn, when we research a business contact.
We do not intentionally collect sensitive personal data, such as health, financial account or national identity numbers, through the Website. Please do not send it to us by email.
4. How we use personal data
| Purpose | Data used |
|---|---|
| Reply to enquiries, arrange demos and assess pilot access applications | Enquiry and business contact data |
| Provide, secure and support the Services, including access control, approvals and audit records | Console account, sign-in and security data |
| Detect, investigate and prevent fraud, abuse and security incidents | Website request, sign-in and security data |
| Run, maintain and improve the Website and Services | Website request data, aggregated usage information |
| Send product and event updates to business contacts who have agreed to receive them, or where the law otherwise permits | Business contact data |
| Manage contracts, billing and our relationships with suppliers and partners | Business contact data |
| Comply with law, respond to lawful requests and protect our legal rights | Any data relevant to the matter |
We collect, use and disclose personal data with your consent, or where the PDPA otherwise allows it, for example where it is reasonably necessary to provide a service you asked for, or for our legitimate interests in operating and securing our business.
You can unsubscribe from marketing emails at any time using the link in the email or by writing to us. We will still send service and security messages that are needed to run your account.
5. Customer Data in the Services
GREENLIGHT is designed to work on decision metadata, such as the type of action, its target, the amount, the policy result and the outcome, rather than on the raw personal data of our customers’ end users. Customers decide what they send, and can configure their integrations to minimise or exclude personal data.
- We process Customer Data only to provide the Services, on the customer’s documented instructions and under their agreement with us.
- Customer Data for the hosted Services is stored in the Amazon Web Services Asia Pacific (Singapore) region.
- Customers set how long decision and audit records are kept, within the limits of their plan.
- We do not sell Customer Data, use it for advertising, or use it to train our own or third-party AI models.
- Where a customer uses optional language-model assistance for intent and risk scanning, its output is advisory, and the provider involved is identified to the customer as a sub-processor.
Automated decisions
GREENLIGHT makes automated decisions about actions proposed by AI agents, applying policies that our customers set. It does not make decisions about Website visitors. Where a customer uses GREENLIGHT in a process that affects individuals, that customer is responsible for how the decision is used and for any notice or review rights that apply.
7. International transfers
Some of our providers process data outside Singapore. For example, the Website is delivered through a global network so that it loads quickly wherever you are, and our email provider may process messages in other regions. When we transfer personal data outside Singapore, we take steps required by the PDPA to make sure it receives a standard of protection comparable to the PDPA, such as contractual commitments from the recipient.
8. How long we keep personal data
We keep personal data only as long as we need it for the purposes above, or as the law requires. Typical periods are:
| Data | Typical retention |
|---|---|
| Enquiries and demo requests that do not become a relationship | Up to 24 months after our last contact |
| Business relationship and contract records | For the relationship, then as long as needed for legal, tax and accounting purposes |
| Console user accounts | While the account is active, then deleted within 90 days of closure, unless the customer’s audit retention requires longer |
| Website request and security logs | Up to 12 months, longer if needed to investigate an incident |
| Customer Data | As set by the customer and their agreement; deleted or returned when the agreement ends |
When data is no longer needed, we delete it or anonymise it so that it no longer identifies you. Deleted data may remain in encrypted backups until they expire on their normal cycle.
10. How we protect personal data
We use reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal and loss. These include encryption in transit and at rest, role-based access, multi-factor sign-in and passkeys for administrators, separation of customer tenants and environments, and logging of administrative actions. Our Security page describes these controls in more detail.
No system is completely secure. If a data breach affects your personal data, we will notify you and the Personal Data Protection Commission where the PDPA requires it. For Customer Data, we will notify the customer as set out in their agreement.
11. Your rights
Under the PDPA
- Access. Ask for a copy of your personal data that we hold, and how it has been used or disclosed in the past year.
- Correction. Ask us to correct personal data that is inaccurate or incomplete.
- Withdraw consent. Withdraw consent to our collection, use or disclosure of your personal data. We will explain the likely consequences, for example that we may no longer be able to provide a service.
We aim to respond within 30 days. If we need longer, we will tell you when to expect a response. We may charge a reasonable fee for an access request, and will tell you the fee before we act on it. We may need to verify your identity first.
If you are in the EEA or the UK
Where the GDPR applies, we rely on these legal bases: performing a contract with you or your organisation; our legitimate interests in running, securing and promoting our business; your consent, for example for optional cookies or some marketing; and compliance with legal obligations. You also have the rights to erasure, restriction, data portability and to object to processing based on legitimate interests or used for direct marketing. You may complain to your local data protection authority.
If you are in California
We do not sell personal information or share it for cross-context behavioural advertising, and we do not use it for those purposes. Because the Website sets no tracking cookies, there is nothing for a Global Privacy Control signal to switch off, but we treat such a signal as an opt-out if we ever introduce tracking. You may ask to know, correct or delete your personal information, and we will not treat you differently for doing so.
Other jurisdictions
If local law gives you additional rights, contact us and we will respond in line with that law.
In Singapore, if you are not satisfied with our response, you may contact the Personal Data Protection Commission.
12. Children
The Website and Services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.
13. Third-party links
The Website links to third-party sites, such as regulators, standards bodies, publications and our social media pages. Their own privacy policies apply when you visit them, and we are not responsible for their practices.
14. Contact us and our Data Protection Officer
For questions about this policy, or to exercise your rights, contact our Data Protection Officer at support@crelis.ai with the subject line “Privacy request”.
Crelis Labs Pte. Ltd. (UEN 202634291E), 2 Venture Drive, #09-12G Vision Exchange, Singapore 608526.
15. Changes to this policy
We may update this policy as our services or the law change. We will post the updated version here and change the date at the top. If a change is significant, we will take reasonable steps to tell you, for example by email or a notice in the console.