Privacy Policy

Last updated: 4 October 2026

Crios Pte. Ltd., a company incorporated in Singapore (“Crios”, “we”, “us”, or “our”) provides Crios, an autonomous AI software engineering platform. This Privacy Policy describes how we process personal information that we collect through the Crios platform and the related websites, applications, and APIs (collectively, the “Service”).

This is the edition of our Privacy Policy for individuals in the European Economic Area (“EEA”), the United Kingdom (“UK”), Switzerland, and the Asia-Pacific region. It also applies to individuals in every other region for which we do not publish a region-specific notice. Region-specific information is set out in the Addendum at the end of this Privacy Policy. Where the law of your country of residence gives you rights beyond those described here, those rights apply.

You can reach us for every privacy matter — questions, requests to exercise your rights, complaints, and notices to our Data Protection Officer — at a single address: support@crios.ai.

We may act as a data processor and process personal information in accordance with the instructions of Published App owners, Crios API customers, or organization plan owners. A “Published App” is any public-facing website, application, or service created and published through Crios, and a “Published App Owner” is its creator or operator. An “Organization Owner” is the owner of a Crios organization or team plan who determines how workspace data is processed. In those cases — which include (i) personal information of end users collected through Published Apps or API applications and (ii) personal information of organization members generated within organization workspaces — the privacy policy of the relevant Published App Owner, API customer, or Organization Owner governs, and we process the data only on their documented instructions and our Data Processing Addendum.

For customers running Crios Enterprise (self-hosted in the customer’s own infrastructure), personal information processed inside the customer’s deployment does not reach us in the ordinary course; the customer is the controller of that data, and our access, if any, is limited to support and licensing purposes agreed with the customer.

NOTICE TO EUROPEAN USERS: please see the “Notice to European users” section below for additional information for individuals located in the EEA, the UK, or Switzerland (together, “Europe”).

Index

• Your activity and information that you provide
• How we use your information
• Automated decision-making
• Retention
• How we share your information
• Your choices
• Other sites and services
• Security
• International data transfers
• Children’s data
• Changes to this Privacy Policy
• How to contact us and our Data Protection Officer
• Addendum: Notice to European users (EEA, UK, and Switzerland); Notice to Singapore users; Notice to Australia users; Notice to Japan users; Notice to South Korea users; Notice to users in other Asia-Pacific jurisdictions

Your activity and information that you provide

Information you provide to us. Depending on how you interact with us, personal information you may provide through the Service includes:

• Contact data, such as your name, email address, billing address, professional title, company name, and phone number.
• Profile data, such as the username and password you set for your account, the organizations you belong to and your role within them (e.g., owner, administrator, member), your language preference, and other information you add to your profile.
• Communications data, based on our exchanges with you, including when you contact us through the Service, by email to support@crios.ai, or otherwise.
• Transactional data, such as information needed to complete subscriptions or credit purchases, including plan type, invoices, tax identifiers you provide, and transaction history.
• Marketing data, such as your preferences for receiving marketing communications and your engagement with them.
• Inputs, prompts, and user-generated content, such as briefs, prompts, instructions, follow-up messages, source code, repositories, files, images, documents, knowledge-base entries, and other content you upload, connect, generate, transmit, or otherwise make available on the Service, together with associated metadata.
• Payment data, which is collected and processed directly by our payment processor (Stripe), as described under “How we share your information”. We receive only limited payment details (such as card type, last four digits, and billing country), never full card numbers.
• Published App end-user account data, such as email addresses and login credentials where a Published App uses authentication provided through the Service. We process this data on behalf of the Published App Owner to operate their sign-in and account features.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

We ask that you not provide us with sensitive personal information (for example, government identification numbers, financial account credentials, health, biometric, or genetic information, criminal background information, or special categories of personal data within the meaning of Article 9 GDPR) on or through the Service. The Service is not designed to process such data, and we do not knowingly collect it.

Third-party sources. We may combine personal information we receive from you with personal information obtained from other sources, such as:

• Model providers. Parts of the Service are integrated with third-party AI model platforms (“Model Providers”) that generate outputs in response to your inputs. Model Providers may share information with us as part of processing your requests.
• Service providers that help us operate the Service or our business.
• Third-party login and linked services, such as identity providers you use to log in, or services you connect to your account.
• Integrations at your direction. Where you connect the Service to third-party tools — for example GitHub, GitLab, Jira, Slack, or services reachable through Model Context Protocol (MCP) servers — we receive only the data needed to carry out the actions you request, consistent with the permissions you grant and the applicable provider’s policies.

Automatic data collection. We and our service providers may automatically log information about you, your device, and your interaction over time with the Service and our communications, such as:

• Device data, such as operating system type and version, browser type, screen characteristics, IP address, unique identifiers, language settings, and general location (city, region, or country) derived from your IP address.
• Online activity data, such as pages or screens viewed, time spent, navigation paths, access times, and whether you opened our emails or clicked links in them.
• Session and sandbox environment data. When Crios executes work on your behalf, it operates inside isolated sandbox environments. We may collect: (i) files you upload or that Crios creates during task execution; (ii) commands executed in the sandbox and their outputs; (iii) code you provide or that Crios generates; (iv) agent activity, reasoning streams, and session replay events; and (v) task execution logs, retained for replay, debugging, cost accounting, and security purposes.

Personal information of end users and organization members. When we process personal information to help Published App Owners operate their Published Apps, API customers operate their applications, or Organization Owners manage their workspaces, we do so solely at their direction, as a data processor. The purposes and means of that processing are determined by the relevant controller.

Cookies and similar technologies. The Crios application uses cookies and browser storage that are strictly necessary to operate the Service: keeping you signed in, remembering your language and interface preferences, protecting against cross-site request forgery, and balancing load. Our public website measures visits with Google Analytics, a service provided by Google, configured so that it sets no cookies: your browser sends Google a cookie-less record of the pages you view, with basic technical details such as browser type and language, which we use only in aggregate to understand how the website is used and not to build profiles of individual visitors. Nothing is sent when your browser sends a Do Not Track or Global Privacy Control signal. Where we use any optional cookies or similar technologies (for example, for product analytics inside the application) in a jurisdiction that requires consent for them, we ask for your consent first and you can withdraw it at any time through the Service or your browser settings. We do not use advertising or tracking cookies.

How we use your information

We may use your personal information for the following purposes, or as otherwise described at the time of collection. For individuals in Europe, the legal basis for each purpose is set out in the “Notice to European users” below.

Service delivery and operations. We may use your personal information to:

• provide the Service;
• transmit your inputs to Model Providers — including model endpoints you configure yourself — for processing, and receive outputs, as necessary to fulfill your requests;
• enable security features of the Service;
• establish and maintain your user profile;
• facilitate collaboration within organizations, including managing member access permissions, sharing projects and sessions among authorized members, and monitoring organization-wide resource usage and spend;
• operate authentication and hosting for Published Apps on the Published App Owner’s instructions, and provide related support;
• execute tasks asynchronously in the cloud, including scheduled and background work that continues after you close your browser, with execution logs retained to enable replay and debugging;
• run parallel agents for large tasks, all operating under the same data protection controls;
• process payments, issue invoices, calculate and remit taxes, and keep the accounting records the law requires;
• communicate with you about the Service, including service announcements, updates, security alerts, changes to our terms, and support messages; and
• provide support and respond to your requests, questions, and feedback.

Service personalization, including understanding your needs and interests, personalizing your experience, and remembering your selections and preferences.

Service improvement and analytics. We may use your personal information to analyze usage of the Service, improve the Service and our business, understand user activity, and develop new products and services. Where we use inputs and outputs for this purpose, we do so in aggregated or de-identified form as described in our Terms of Use.

Direct marketing. We may send you marketing communications about Crios and may personalize them based on your needs and interests. Where the law of your country requires it (for example, for individuals in the EEA, the UK, Singapore, Australia, Japan, or the Republic of Korea), we send electronic marketing only with your consent or, where permitted, to existing customers about similar services, and every message includes a way to opt out. You may opt out at any time as described in “Your choices” below. We do not sell your personal information, and we do not share it with third parties for targeted or behavioral advertising.

Compliance and protection. We may use your personal information to comply with applicable laws, lawful requests, and legal process; to protect our, your, or others’ rights, privacy, safety, or property; to audit our internal processes; to enforce the terms that govern the Service; and to prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and abuse of the sandbox and publishing features.

Aggregated, de-identified, or anonymized data. We may create aggregated, de-identified, and/or anonymized data from your personal information and that of other users, and use and share it for our lawful business purposes, including to analyze and improve the Service and promote our business. We maintain such data in a form that does not identify you and do not attempt to re-identify it.

Processor services for Published Apps, APIs, and organizations. When you operate a Published App or use the Crios API to process personal information about your end users, you (or your organization) act as the data controller, and we act as your data processor, handling that personal information only on your documented instructions and our Data Processing Addendum.

Further uses. In some cases we may use your personal information for further purposes; where those purposes are not compatible with the initial purpose for which the information was collected, we will inform you and, where required, ask for your consent.

Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Our systems use automated signals to detect abuse, fraud, and security threats (for example, unusual sandbox activity or payment anomalies) and may temporarily restrict an account or a Published App as a result. Any such restriction can be reviewed by a person: contact support@crios.ai to request human review, express your point of view, and contest the decision.

Retention

We generally retain personal information to fulfill the purposes for which we collected it, to satisfy legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether they can be achieved by other means, and applicable legal requirements. We purge customer data containing confidential information from the application environment, in accordance with best practices, when customers leave the Service. When we no longer need personal information, we delete or anonymize it; where immediate deletion is not possible (for example, in backups), we isolate it from further processing until deletion is possible.

Please note the following for particular parts of the Service:

• Account data is retained while your account is active and deleted or anonymized within a reasonable period after you close your account, except where we must keep it longer (for example, invoices and accounting records for the period required by Singapore tax law and the tax laws of the countries where we are registered for VAT or GST).
• Sandbox environments are ephemeral and isolated, and may be reset. Sandbox contents are reclaimed when a session ends or after a limited period of inactivity, unless persisted to your project (for example by committing to a repository or publishing).
• Session records (execution logs, replay events, and cost records) are retained while your account is active to provide replay, auditing, and billing features, and are deleted or de-identified when no longer needed for those purposes.
• Organization data (e.g., session logs and credit usage records) may also be subject to retention settings determined by the Organization Owner in accordance with its needs and applicable law.
• End-user personal information collected by a Published App Owner or API customer is stored and retained solely per their instructions; the applicable retention period is determined by them, and we act only as processor. Organization members seeking deletion of personal information related to organization activity should first contact their Organization Owner or administrator; if you receive no response within 30 days, or your request concerns data we control independently (such as billing data), you may contact us at support@crios.ai.

How we share your information

We may share your personal information with the following categories of recipients, as otherwise described in this Privacy Policy, or at the time of collection. Our service providers are located mainly in Singapore, the EEA, the UK, and the United States. A current list of the sub-processors we use to provide the Service, with their locations, is available on request at support@crios.ai.

• Our corporate parent, subsidiaries, and affiliates, for the purposes described in this Privacy Policy.
• Service providers that provide services on our behalf or help us operate the Service or our business (such as cloud hosting and infrastructure, information technology, customer support tooling, email delivery, and analytics), under contracts that restrict their use of the information to providing services to us.
• Model Providers. We share your inputs and related context with the Model Providers used to fulfill your requests. Where you bring your own model keys or endpoints, your inputs are transmitted to the provider you configured, and that provider’s handling of the data is governed by your agreement with them.
• Payment processors. Payment card information you use to make purchases is collected and processed directly by our payment processor, Stripe, which uses it in accordance with its privacy policy (https://stripe.com/privacy).
• Third parties designated by you, including the integrations you connect — for example when the Service pushes commits, pull requests, comments, or notifications to GitHub, GitLab, Jira, or Slack at your direction.
• Published App Owners and API customers. If you interact with a Published App or an application built on the Crios API, information you submit may be shared with, or collected directly by, the Published App Owner or API customer operating that experience, in accordance with their privacy policy.
• Linked third-party services. If you log into the Service with, or link your account to, a third-party service, we may share personal information with that service as needed; its use of the information is governed by its privacy policy and your settings with it.
• Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us.
• Authorities and others. Law enforcement, government and regulatory authorities (including data protection authorities), and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above. Where permitted, we will notify you of requests for your personal information.
• Business transferees. We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in or financing of Crios, or the sale, transfer, or merger of all or part of our business, assets, or shares), and to an acquirer, successor, or assignee as part of any such transaction, including in insolvency proceedings, subject to appropriate confidentiality safeguards.
• Other users and the public, at your election. If you share projects, sessions, or content with other users, or publish content publicly, that information can be seen, collected, and used by others — including being cached, copied, or stored elsewhere — and we are not responsible for such use. Within organizations, certain information is visible to other members based on role permissions: an Organization Owner may access member sessions (including task steps and content), monitor individual and organization-wide usage and spend, and export session data; administrators may access a subset of session data and manage resource allocation, per their configured permissions.

Your choices

• Access or update your information. If you have an account, you may review and update certain information by logging in. You may also ask us for access, correction, deletion, portability, or restriction as described in the regional notices below by emailing support@crios.ai.
• Opt out of marketing communications. You may opt out of marketing emails by following the unsubscribe instructions in the email or by contacting support@crios.ai. You may continue to receive service-related, non-marketing emails.
• Cookies and browser signals. Most browsers let you remove or reject cookies; doing so may affect Service functionality. Our public website honors the Do Not Track and Global Privacy Control signals. Where we ask for consent to optional cookies, you can change your choice at any time.
• Integration controls. You can view, manage, and revoke access to connected integrations at any time in your settings. When you remove an integration, associated tokens and credentials held for it are cleared.
• Declining to provide information. We need certain personal information to provide the Service; if you do not provide information we identify as required, we may not be able to provide it.
• Linked third-party platforms. If you connect via a third-party identity provider, you may be able to use that provider’s settings to limit the information we receive. Revoking access does not apply to information we have already received.
• Organization privacy controls. As an organization member, you can manage certain sharing settings; however, some information (e.g., aggregate usage and task progress) may remain visible to owners and administrators as required for organization operation.
• Delete your content or close your account. You can delete certain content through your account. To close your account, use your account settings or contact us at support@crios.ai.

Other sites and services

The Service may contain links to websites, applications, and other online services operated by third parties, and our content may be integrated into services not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party services and are not responsible for their actions. We encourage you to read the privacy policies of the other services you use.

Security

We employ technical, organizational, and physical safeguards designed to protect the personal information we collect, including sandbox isolation, encryption in transit and at rest, secrets management, role-based access controls, logging, and staff confidentiality obligations. However, no online service is fully secure, and we cannot guarantee that security measures will never be circumvented. Please exercise discretion in what you submit. If a personal data breach occurs, we will notify the competent authorities and affected individuals where required by applicable law and within the applicable time limits (including the 72-hour deadline under the GDPR and the three-calendar-day deadline under the Singapore Personal Data Protection Act 2012).

International data transfers

We are headquartered in Singapore and use service providers and infrastructure in Singapore, the EEA, the UK, the United States, and other countries. Your personal information may therefore be transferred to, stored in, and processed in countries other than your own, including countries whose data protection laws differ from those of your country of residence. Where required, we implement appropriate safeguards for such transfers, such as the European Commission’s standard contractual clauses, the UK International Data Transfer Addendum, contractual protections meeting the transfer requirements of the Singapore Personal Data Protection Act 2012 and other Asia-Pacific laws, and reliance on adequacy decisions where available. Details for each region are set out in the regional notices below. You may request further information about the safeguards we use, or a copy of them, at support@crios.ai.

Children

The Service is not intended for anyone under 18 years of age, and we do not knowingly collect personal information from children. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact support@crios.ai. If we learn that we have collected personal information from a child without legally required consent, we will comply with applicable law to delete it.

Changes to this Privacy Policy

We may modify this Privacy Policy from time to time. If we make material changes, we will notify you by updating the date of this Privacy Policy and posting it on the Service and, where the change materially affects how we process personal information we already hold about you, by email or an in-Service notice before the change takes effect. Depending on the change, we may ask for your consent. Modifications are effective upon posting of the modified version, or as otherwise indicated. Published App Owners and API customers may update their own privacy policies from time to time; as their processor, we may adjust our processing of end-user personal information in accordance with their updated policies and instructions.

How to contact us and our Data Protection Officer

We have appointed a Data Protection Officer (“DPO”) responsible for overseeing privacy compliance, including as required by the GDPR, the UK GDPR, and the Singapore Personal Data Protection Act 2012. The DPO also acts as our privacy officer under the laws of other jurisdictions described in the Addendum.

Email (all privacy matters, including for the attention of the DPO): support@crios.ai
Post: Crios Pte. Ltd., Attn: Data Protection Officer, 20 Cecil Street, #05-03 Plus, Singapore 049705

Addendum

Notice to European users

General

This section applies to individuals in the EEA, the UK, and Switzerland (together, “Europe”). References to “personal information” should be understood as references to “personal data” as defined in the EU General Data Protection Regulation (the “EU GDPR”), the UK GDPR, and the Swiss Federal Act on Data Protection (“FADP”) (together, as applicable, the “GDPR”).

Controller. Crios Pte. Ltd. is the controller of the processing of your personal information covered by this Privacy Policy for purposes of European data protection legislation. See “How to contact us” above for our contact details.

Processor. For personal data we process on behalf of Published App Owners, API customers, or Organization Owners, the relevant Published App Owner, API customer, or Organization Owner is the controller and we are their processor. For processor-context questions or to exercise your rights, please contact the relevant controller in the first instance. If you do not receive a response within 30 days, you may contact us at support@crios.ai and we will assist to the extent permitted.

Our representatives in Europe. Where required by Article 27 of the EU GDPR and the UK GDPR and Article 14 FADP, we appoint a representative in the EU, the UK, and Switzerland. Their contact details are: [Name and address of the representative appointed in the EU]; [Name and address of the representative appointed in the UK]; [Name and address of the representative appointed in Switzerland]. You may contact our representatives on all matters relating to our processing of your personal data, in addition to or instead of contacting us at support@crios.ai.

Our Data Protection Officer. Our DPO independently informs and advises us and monitors our compliance with the GDPR. You may contact the DPO at support@crios.ai (marking your message for the attention of the DPO) or by post at the address above.

Our legal bases for processing

The GDPR requires us to have a “legal basis” for each use of personal information. Our legal bases are: Contractual necessity (Article 6(1)(b)) — where we need to perform a contract we have, or are about to enter into, with you; Legitimate interests (Article 6(1)(f)) — where processing is necessary for our or a third party’s legitimate interests and your interests and fundamental rights do not override them; Compliance with law (Article 6(1)(c)) — where we need to comply with a legal or regulatory obligation; and Consent (Article 6(1)(a)) — where you have given us your consent, which you may withdraw at any time. The table below sets out the legal bases we rely on for each purpose described under “How we use your information”.

We do not carry out profiling for advertising purposes and do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (see “Automated decision-making” above).

Your rights

European data protection laws give you certain rights regarding your personal information. If you are located in Europe, you may ask us to take the following actions in relation to your personal information that we hold:

• Access — provide you with information about our processing of your personal information and give you access to it.
• Correct — update or correct inaccuracies in your personal information.
• Delete — delete your personal information where there is no good reason for us to continue processing it.
• Transfer — transfer a machine-readable copy of your personal information to you or a third party of your choice.
• Restrict — restrict the processing of your personal information, for example while we establish its accuracy or the reason for processing it.
• Object — object to our processing of your personal information where we rely on legitimate interests, and object to direct marketing at any time.
• Withdraw consent — where we use your personal information based on your consent, withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

Exercising these rights. You may submit requests by email to support@crios.ai or by post to our address above. We may request specific information from you to help confirm your identity and process your request. We will respond within one month, extendable by two further months for complex or numerous requests, in which case we will tell you. Whether we are required to fulfill a request depends on several factors (for example, why and how we are processing your personal information); if we reject a request in whole or in part, we will tell you our grounds for doing so, subject to any legal restrictions. Exercising your rights is free of charge unless requests are manifestly unfounded or excessive.

Your right to lodge a complaint with a supervisory authority. If you are not satisfied with our response to a request, or with how we process your personal information, you can make a complaint to the data protection regulator of your habitual place of residence, your place of work, or the place of the alleged infringement. For the EEA, the contact details of each authority are listed at https://edpb.europa.eu/about-edpb/board/members_en. For the UK, the regulator is the Information Commissioner’s Office (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone +44 303 123 1113; https://ico.org.uk/make-a-complaint/). For Switzerland, the regulator is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch). We would appreciate the chance to address your concerns first, so please consider contacting support@crios.ai before lodging a complaint.

Data processing outside Europe

We are established in Singapore and share personal information with service providers based outside Europe, including in Singapore and the United States. Where we transfer your personal information out of Europe, we ensure a similar degree of protection through one of the following mechanisms:

• Transfers to territories with an adequacy decision. We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection by the European Commission, the UK Government, or the Swiss Federal Council (as applicable), or under specific adequacy frameworks they have approved (for example, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, for recipients certified under them).
• Transfers to territories without an adequacy decision. For transfers to countries not covered by an adequacy decision (for example, Singapore), we use appropriate safeguards designed to give personal information effectively the same protection it has in Europe — in particular, the standard contractual clauses adopted by the European Commission, supplemented where necessary by the UK International Data Transfer Addendum and by the amendments required by the FADP for Swiss transfers, together with transfer impact assessments and supplementary measures where needed. In limited circumstances we may rely on a derogation permitted by law, such as your explicit consent to a specific transfer or the necessity of the transfer to perform our contract with you.

You may contact support@crios.ai for further information on the specific mechanism used when transferring your personal information out of Europe and to request a copy of the applicable safeguards.

Cookies and similar technologies in Europe

Under the ePrivacy rules of your country, we may store or access information on your device without your consent only where strictly necessary to provide a service you have requested. Our public website uses no cookies for analytics, and the Crios application uses only strictly necessary cookies and storage unless you consent to optional ones. You can withdraw any consent you have given as easily as you gave it, through the Service or your browser settings.

Notice to Singapore users

This section applies to individuals in Singapore and is subject to the Personal Data Protection Act 2012 (“PDPA”) and its regulations and guidelines. Crios Pte. Ltd. is a company incorporated in Singapore and is the organization responsible for the collection, use, and disclosure of your personal data as described in this Privacy Policy.

• Data Protection Officer. As required by the PDPA, we have appointed a Data Protection Officer, who can be reached at support@crios.ai or at our registered office address above.
• Purposes and consent. We collect, use, and disclose your personal data for the purposes described in this Privacy Policy, with your consent (including deemed consent by contractual necessity or by notification where permitted), or where the PDPA otherwise permits (for example, under the legitimate interests or business improvement exceptions). You may withdraw consent at any time by contacting support@crios.ai; we will explain the likely consequences of withdrawal, which may include our inability to continue providing the Service to you.
• Access and correction. You may request access to, or correction of, your personal data in our possession or under our control by contacting support@crios.ai. We will respond as soon as reasonably possible and, in any event, within thirty (30) days, or inform you if we need more time. We may charge a reasonable fee for access requests, which we will tell you in advance.
• Marketing messages. We will not send marketing messages to a Singapore telephone number listed on the Do Not Call Registry unless you have given us clear and unambiguous consent.
• Data breaches. If a notifiable data breach occurs, we will notify the Personal Data Protection Commission (“PDPC”) within three calendar days of assessing that the breach is notifiable, and affected individuals where required, within the timelines prescribed by law.
• Transfers outside Singapore. When transferring personal data outside Singapore (including to the EEA, the UK, and the United States), we ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA.
• Complaints. If you are not satisfied with our handling of your personal data, you may lodge a complaint with the PDPC (https://www.pdpc.gov.sg).

Notice to Australia users

This section applies to individuals in Australia and to our handling of personal information subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”).

• Collection. We collect personal information directly from you and from the third-party sources described above. If you do not provide the personal information we request, we may not be able to provide the Service to you. We do not collect sensitive information unless you provide it to us and the law permits.
• Overseas disclosure. We are located in Singapore and are likely to disclose personal information to recipients in Singapore, the EEA, the UK, and the United States, and to Model Providers in the countries where they operate. Before disclosing personal information overseas we take reasonable steps, including contractual protections, to ensure the recipient handles it consistently with the APPs.
• Access, correction, and complaints. You may request access to or correction of the personal information we hold about you, or make a complaint about a breach of the APPs, by contacting support@crios.ai. We will respond within a reasonable period (usually within 30 days). If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (https://www.oaic.gov.au).
• Direct marketing. We send marketing communications only as permitted by the Privacy Act and the Spam Act 2003 (Cth), and every message contains a functional unsubscribe facility.
• Data breaches. If an eligible data breach occurs, we will notify affected individuals and the Commissioner as required by the Notifiable Data Breaches scheme.

Notice to Japan users

This section applies to individuals in Japan under the Act on the Protection of Personal Information (“APPI”), including its extraterritorial provisions where applicable. Crios Pte. Ltd. is the “personal information handling business operator” for the processing covered by this Privacy Policy.

• Purposes of use. We use personal information for the purposes described under “How we use your information” and will not use it beyond the scope necessary to achieve those purposes without your prior consent, except as permitted by the APPI.
• Provision to third parties and transfers abroad. We provide personal information to third parties only with your consent or as otherwise permitted by the APPI, and we entrust processing to service providers in Singapore, the EEA, the UK, the United States, and other countries as described above. Where we transfer personal information to a third party in a foreign country with your consent, we will provide you, in advance, with information about that country’s personal information protection system and the measures the recipient takes, as required by Article 28 of the APPI. Where we entrust processing to a foreign service provider, we take the necessary and appropriate measures to supervise it. Information on these measures is available at support@crios.ai.
• Your requests. You may request notification of the purpose of use, disclosure, correction, addition or deletion, suspension of use, erasure, or suspension of provision to third parties of your retained personal data, and disclosure of records of third-party provision, by contacting support@crios.ai. We will verify your identity and respond without undue delay. We may charge a reasonable fee for disclosure requests, which we will tell you in advance.
• Complaints. Complaints about our handling of personal information may be directed to support@crios.ai. You may also contact the Personal Information Protection Commission of Japan (https://www.ppc.go.jp).

Notice to South Korea users

This section applies to individuals in the Republic of Korea and, where applicable, to our provision of the Service subject to Korea’s Personal Information Protection Act (“PIPA”).

• Privacy officer. We have designated a Chief Privacy Officer (personal information protection officer) under the PIPA, who can be reached at support@crios.ai or at our registered office address above.
• Items collected, purposes, and retention. The items of personal information we collect, the purposes for which we use them, and the periods for which we retain them are described in the sections “Your activity and information that you provide”, “How we use your information”, and “Retention” above. When the retention period expires or the purpose is achieved, we destroy the personal information without delay in a manner that prevents its recovery, unless we are required by law to retain it (for example, records of contracts and payments under the Act on Consumer Protection in Electronic Commerce).
• Outsourcing and overseas transfer. We entrust the processing of personal information to, and transfer it to, service providers outside the Republic of Korea for hosting, storage, AI model inference, payment processing, customer support, email delivery, and security. Because these transfers are necessary to perform our contract with you and to provide the Service, we rely on the bases permitted under the PIPA for cross-border outsourcing and storage, and we supervise such providers. The items transferred, the countries and dates or methods of transfer, the recipients and their contact details, the purposes of use, and the retention periods are set out in our sub-processor list, which is available at support@crios.ai. You may refuse the overseas transfer of your personal information by contacting us, in which case we may be unable to provide the Service.
• Your rights. You (or your legal representative) may request access to, correction or deletion of, or suspension of processing of your personal information, and may withdraw consent, by contacting support@crios.ai. We will respond within ten (10) days.
• Remedies. If you need help with an infringement of your personal information rights, you may contact the Personal Information Protection Commission, the Personal Information Infringement Report Center operated by the Korea Internet & Security Agency (privacy.kisa.or.kr, telephone 118), or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, telephone 1833-6972).

Notice to users in other Asia-Pacific jurisdictions

If you are located in New Zealand, Hong Kong SAR, Taiwan, India, Indonesia, Malaysia, the Philippines, Thailand, Vietnam, or another jurisdiction in the Asia-Pacific region, the data protection law of your jurisdiction (for example, the New Zealand Privacy Act 2020, the Hong Kong Personal Data (Privacy) Ordinance, the Taiwan Personal Data Protection Act, the Indian Digital Personal Data Protection Act 2023, the Indonesian Personal Data Protection Law, the Malaysian Personal Data Protection Act 2010, the Philippine Data Privacy Act of 2012, the Thai Personal Data Protection Act, or the Vietnamese Personal Data Protection Decree) may give you rights to access, correct, delete, or port your personal information, to object to or restrict its processing, to withdraw consent, and to complain to your local data protection authority. Crios Pte. Ltd. is the entity responsible for your personal information under those laws. Nothing in this Privacy Policy limits those rights. You may exercise them by contacting support@crios.ai, and we will respond within the period required by your local law. Where your local law requires specific disclosures about cross-border transfers, we will provide them on request.