Legal

Privacy Policy

Last updated: 28 September 2026

This is a working draft pending review by counsel. It describes our current practices in plain terms; the final version may be revised on their advice.

Zima Labs Pte. Ltd. (UEN 202621364G; "Zima Labs", "we", "us") is a company incorporated in Singapore. This policy explains what personal data we collect when you visit zimalabs.ai or contact us, why we collect it, who we share it with, and the choices you have. We handle personal data in line with Singapore's Personal Data Protection Act 2012 (the "PDPA").

What this policy covers

This policy covers our website, the "Talk to us" form, and email, calls and meetings with us.

It does not cover the data our customers put into Zima, our product. There we act as a data intermediary: we process that data for the customer and on its instructions, under our agreement with that customer, and the customer decides what is collected and why. If your organization uses Zima and you have a question about your data in it, please ask your organization first.

Personal data we collect

What you give us. When you send the "Talk to us" form, you provide:

• First name and last name
• Work email
• Company and company size
• Phone number (optional)
• Country (optional)
• What sparked your interest (optional)

Name, email, company and company size are required to send the form; the rest is optional. If you book a call, write to us or meet us, we also keep what you tell us in that conversation and the details needed to arrange it.

What is collected automatically. When you visit the site, our server records a standard access log for each request: your IP address, the date and time, the page requested, the page that referred you, and your browser and device type. The Google tag and the video player described under "Cookies and similar technologies" collect data as well.

We do not ask for, and ask you not to send us, sensitive personal data such as identity card numbers, health information or financial account details.

How we use personal data

We use personal data to:

• reply to your enquiry and arrange a conversation if you ask for one;
• understand whether and how Zima could help your organization;
• keep the site secure and working, and investigate misuse;
• measure how visitors reach the site, so that we can improve it and our advertising;
• meet our legal obligations.

We use your contact details to reply to you about your enquiry. We will send you marketing messages only if you have asked for them or agreed to them, and you can stop them at any time. We do not sell personal data.

Who we share it with

We share personal data only with service providers that process it for us, and only as far as they need it:

• Google: form submissions are recorded through Google Apps Script into our Google Workspace account, calls are scheduled with Google Calendar, and the Google tag measures visits and advertising.
• YouTube (Google): plays the demo video on the Nova page, once you press play.
• Our hosting provider: runs the server that serves the site and holds its access logs.

We may also disclose personal data where the law requires it, to protect our rights or the safety of others, or to a successor if our business is reorganized or sold, in which case this policy continues to apply to your data.

Transfers outside Singapore

Our service providers may store or process personal data on servers outside Singapore. When personal data is transferred out of Singapore, we take steps to ensure that the recipient is bound to protect it to a standard comparable to the PDPA, for example through its contractual commitments to us.

How long we keep it

We keep personal data only for as long as it serves the purpose it was collected for, or as long as we need it for legal or business reasons. When it no longer does, we delete it or remove what identifies you. Server access logs are overwritten on a rolling basis.

How we protect it

We make reasonable security arrangements to protect personal data against unauthorized access, use, disclosure, loss or similar risks. The site is served over an encrypted connection, and access to enquiries is limited to the people who need it to reply. No method of transmission or storage is completely secure. If a data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commission and the people affected, as the PDPA requires.

Cookies and similar technologies

We set no cookies of our own. Two things on the site come from others:

• The Google tag (Google Ads) sets cookies and sends information about your visit to Google, so that we can measure how visitors reach the site.
• The demo video on the Nova page is an embedded YouTube player served from youtube-nocookie.com. It loads only when you press play; YouTube may then set cookies and receive information about your visit.

The site may keep a display preference in your browser under the key zima-theme. It stays on your device and is never sent to us.

You can block or delete cookies in your browser's settings, and you can control how Google uses data for advertising in your Google account's ad settings. The site works without cookies.

Your rights and choices

Under the PDPA you may ask us to:

• access the personal data we hold about you, and tell you how we have used or disclosed it in the past year;
• correct personal data that is wrong or incomplete;
• stop using your personal data, if you withdraw your consent. We will tell you what follows from that, such as our no longer being able to reply to your enquiry.

To make a request, write to our Data Protection Officer at the address below. We may need to confirm who you are first. We will respond as soon as reasonably possible, and within 30 days we will either answer or tell you when we can. There is no charge for a correction; if an access request carries a fee, we will tell you the amount before we proceed.

If you are outside Singapore, the law where you live may give you further rights over your personal data. Write to us and we will honour them where they apply.

If you are not satisfied with our answer, you may complain to the Personal Data Protection Commission of Singapore.

Children

The site is intended for business use and is not directed to children. We do not knowingly collect their personal data.

Changes to this policy

We may update this policy as our practices change. When we do, we will revise the "last updated" date above, and if a change is significant we will say so on the site.

Contact our Data Protection Officer

For questions about this policy, or to make a request about your personal data, write to our Data Protection Officer at anni@zimalabs.ai and balaji@zimalabs.ai, or by post:

Data Protection Officer
Zima Labs Pte. Ltd.
7 Temasek Boulevard, #12-07, Suntec Tower One, Singapore 038987