HAPIO Privacy Policy
CR8TEK (UEN 53531114A) is a sole proprietorship registered in Singapore at 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051. CR8TEK operates HAPIO. "CR8TEK" means CR8TEK. Contact: admin@cr8tek.com
1. Purpose
This document explains what personal data CR8TEK collects through the hapio.org website and the Hapio waitlist, why it collects it, and what Hapio itself does and does not send anywhere once a Pilot participant is running it. Any privacy question or request goes to the contact above.
2. Scope
This document covers CR8TEK's handling of Waitlist and support data, and the data flow behaviour of Hapio once deployed. It does not cover a Pilot participant's own choices about who may access its deployment, or any third party service a Pilot participant separately integrates.
3. Definitions
| Term | Definition |
|---|---|
| CR8TEK | The operator of HAPIO, as identified above. |
| Visitor | Anyone who accesses the Site. |
| Waitlist | The list a Visitor joins by submitting the form on the Site. |
| Pilot participant | An organisation running a Hapio deployment under a Pilot agreement with CR8TEK. |
| Deployment | One running installation of Hapio, operated by a Pilot participant on its own infrastructure. |
4. Policy Statement
Two separate things exist, and they must not be blurred:
- CR8TEK holds Waitlist and support data. A Visitor who joins the Waitlist gives CR8TEK contact details so CR8TEK can follow up. CR8TEK keeps that. It is the only personal data CR8TEK collects from a Visitor who has not entered a Pilot.
- CR8TEK holds nothing from a running Deployment. A Pilot participant runs Hapio on its own infrastructure. There is no CR8TEK server in the data path, no telemetry, no licence server, no analytics, and Hapio makes no automatic contact with CR8TEK of any kind. CR8TEK never sees a Pilot participant's documents, queries, logs or users. This is not a promise CR8TEK could quietly break; there is no channel over which the software could send CR8TEK anything.
Hapio itself processes data locally: both the embedding model that indexes documents and the language model that answers questions run inside the Deployment, on the Pilot participant's own hardware. Requirements 6.2 states this precisely, because it is the claim compliance reviewers check most closely.
5. Roles and Responsibilities
| Role | Responsibility |
|---|---|
| CR8TEK | Holds Waitlist and support data; discloses what a Deployment does and does not send anywhere; has no access to a Deployment's content. |
| Visitor | Provides accurate information when joining the Waitlist. |
| Pilot participant | Operates its Deployment; gives its own end users any notice this document identifies as the participant's to give; is the data controller, or equivalent, for its Deployment's data under the law that applies to it. |
6. Requirements
6.1 What CR8TEK Collects, and Why
Waitlist data. When a Visitor submits the Waitlist form, CR8TEK collects and keeps:
- the Visitor's name;
- the Visitor's business email address;
- the Visitor's company name, where given;
- the Visitor's Singapore Unique Entity Number, where given;
- the Visitor's phone number, where given;
- the store name and store website the Visitor gives;
- the team size and hosting stack the Visitor selects on the form;
- the timeline the Visitor gives for trying Hapio;
- the marketing source, medium and campaign tags attached to the Visitor's visit, where present;
- the Visitor's confirmation that it agrees to this document and the Terms of Use, given by checking the consent box before submitting the form.
CR8TEK uses this to assess whether a Visitor's setup fits the pilot, to consider the Visitor for a Pilot, to notify the Visitor when Hapio becomes available for purchase, and to send updates about Hapio. Under the Personal Data Protection Act 2012, CR8TEK collects this with the Visitor's consent, given by submitting the form, and does not sell, rent, or use it for advertising to a third party.
Technical and usage data. CR8TEK runs no analytics or tracking script on the Site. Cloudflare, as the Site's host, necessarily processes standard web request data, such as an IP address and browser type, to deliver the Site and to protect it from abuse; this is not something CR8TEK collects or can turn off, and this section will be updated if CR8TEK ever adds an analytics provider on top of that.
Support correspondence. If a Visitor or Pilot participant emails CR8TEK, CR8TEK keeps the email and its attachments to help and to refer back to the thread. A Pilot participant must not send CR8TEK production data; CR8TEK does not need it and holding it works against the whole design of this product.
6.2 What a Deployment Sends, and Does Not Send
This subsection is about what a Hapio Deployment does, not about data CR8TEK holds. It is stated here because a Pilot participant needs it to make its own disclosures accurately.
Indexing documents: local. When a Pilot participant ingests a document, Hapio splits it into passages and turns each passage into a vector using an embedding model that runs inside the Deployment, on the Pilot participant's own hardware. The document text, the passages and the vectors are written to a database on the Pilot participant's own infrastructure. No third party receives the document text at indexing time. There is no embedding vendor, no indexing API and no API key involved.
Answering a question: local. When an end user asks Hapio a question, it turns the question into a vector locally, retrieves the matching passages from the Deployment's own database, and generates the answer using a language model that also runs inside the Deployment. Nothing about this exchange, the question, the retrieved passages, or the answer, is sent anywhere outside the Deployment. There is no AI provider, no API key and no outbound connection involved in answering a question.
The consequence. A Pilot participant can accurately tell its own users, and its own compliance reviewers, that no part of a question or a retrieved passage leaves its own infrastructure. This is the only privacy claim Hapio makes, and it is the unqualified one: nothing about indexing or answering leaves the Deployment. An earlier version of Hapio offered a cloud answering mode that sent questions and retrieved passages to a Customer chosen AI provider; that mode has been removed from the product entirely, and a reader of an earlier version of this policy should treat this paragraph as replacing any description of it.
6.3 What CR8TEK Does Not Collect
- No telemetry. Hapio sends CR8TEK no usage data, no crash reports, no heartbeats, no install pings, no version checks. None of this is a setting that can be turned off; it does not exist in the code.
- No licence server. Where a licence file is in use, it is verified offline with a public key bundled in the artefact. Starting Hapio makes no call to CR8TEK.
- No deployment content. A Pilot participant's documents, the chunks and embeddings derived from them, the questions asked, the answers given, and its end users' identities all live in the Pilot participant's own database on its own infrastructure. CR8TEK has no copy and no access route.
- No remote access. CR8TEK has no credentials to a Pilot participant's deployment, no support tunnel and no back door.
- No metering. CR8TEK cannot count a Pilot participant's deployments, users, documents or questions, and nothing in the software counts them for CR8TEK.
6.4 Who CR8TEK Shares Data With
- Cloudflare, which hosts the Site and holds the Waitlist data, to the minimum extent needed to run the Site and store what a Visitor submits.
- CR8TEK's email and, once in use, analytics providers, to the minimum extent needed to send mail and keep CR8TEK's books.
- A regulator or court, if CR8TEK is legally required to disclose.
That is the entire list. CR8TEK has no sub processors for Deployment content, because it holds no Deployment content.
6.5 Security of What CR8TEK Holds
What CR8TEK holds today is small: a name, an email, and whatever else a Visitor volunteers on the Waitlist form. CR8TEK keeps it on access controlled systems and keeps the number of people who can see it at one. If a breach affects a Visitor or Pilot participant and meets the Personal Data Protection Act notification threshold, CR8TEK will notify the affected person and the Commission as required.
CR8TEK holds no security certification. No SOC 2, no ISO 27001, no equivalent audit. Nothing in this policy should be read as implying one.
7. Procedures
7.1 Exercising a Data Right
A Visitor or Pilot participant may ask CR8TEK to:
- tell them what personal data CR8TEK holds about them and how CR8TEK has used it;
- correct it if it is wrong;
- delete it, including leaving the Waitlist;
- stop sending them email.
Email admin@cr8tek.com. CR8TEK aims to respond within 30 days. There is normally no charge.
If unhappy with how CR8TEK handled a request, a person may complain to the Personal Data Protection Commission of Singapore.
8. Exceptions
None. This document applies to every Visitor and Pilot participant without exception.
9. Compliance and Enforcement
CR8TEK complies with the Personal Data Protection Act 2012 for the Waitlist and support data it holds, as described in this document. A breach by CR8TEK of the commitments in this document may be raised with CR8TEK directly (Procedures 7.1) or with the Personal Data Protection Commission of Singapore.
10. Review and Maintenance
CR8TEK reviews this document at least once every 12 months, and sooner on any material change to what CR8TEK collects or to the product's data flows.
11. References
- Terms of Use: the terms governing the Site and the Waitlist.
- Acceptable Use Policy: conditions on how a Pilot deployment may be used.
- Personal Data Protection Act 2012 (Singapore).
12. Governing Law
This policy is governed by the laws of Singapore.
Retention. Waitlist entries are kept until the Visitor unsubscribes or asks for deletion. Support correspondence is kept up to three years after the thread closes, then deleted.
Location. CR8TEK is a Singapore business and its records are held in Singapore and on the systems of the providers named in Requirements 6.4, which may store data outside Singapore. Where personal data is transferred out of Singapore, CR8TEK takes reasonable steps to ensure it receives a standard of protection comparable to the Personal Data Protection Act.