Legal
Privacy Policy
Effective date: 26 June 2026
This policy explains what Adtro Media Pte. Ltd.collects, how we use it, who we share it with, and what rights you have. We've written it in plain language.
1. Information we collect
Account information
When you register, we collect your name, business name, email address, and password (stored as a one-way hash — we never store your plain-text password).
Business and product data
Product catalogues, pricing, inventory, outlet details, booking policies, loyalty programme settings, and any other content you upload to run your storefront.
Documents and files you upload
If you or your team upload documents to iBot or eBot (such as SOPs, menus, contracts, reports, or policy files), we store these files and process their content — including any personal data they contain — using OCR (optical character recognition) and AI to extract, classify, and index information for your AI assistants. Do not upload documents containing personal data of third parties (such as your staff or customers) unless you have a lawful basis to do so.
Customer data you collect
When your customers place orders, make bookings, join a queue, or interact with your storefront or WhatsApp number, we process their WhatsApp number, name, and order or booking details — and, depending on your business type, any notes or preferences they provide (for example dietary requirements or service preferences) — on your behalf. You are the data controller (the "organisation" under Singapore's Personal Data Protection Act) for your customers' information; Adtro Media acts as your data intermediary for this data, as explained in Section 8.
Payment information
We do not store full card numbers. Payments are processed by Stripe. We retain only transaction identifiers and amounts needed for order records and receipts.
Social media account data
If you connect a social media account (such as Instagram, Facebook, YouTube, or TikTok) to use our marketing or messaging features, we collect and store the account ID, username, profile picture URL, and OAuth access token provided by that platform. Where you enable inbox features, we also process customer messages and message identifiers from connected Facebook Messenger, Instagram, and WhatsApp accounts so you can view and reply to conversations. This data is used solely to publish content, retrieve analytics, and operate your connected inbox on your behalf. We do not use it for advertising or share it with third parties beyond what is necessary to operate those features.
Usage data
We automatically collect log data including IP addresses, browser type, pages visited, and feature interactions to operate and improve the platform.
2. How we use your information
- Operate and deliver the Adtro Media platform and its features
- Power AI features (iBot and eBot) that help you and your customers interact with your business data and knowledge base
- Process transactions and send order confirmations
- Send transactional emails such as email verification and password resets
- Provide customer support and respond to enquiries
- Improve platform performance, fix bugs, and develop new features
- Comply with legal obligations including tax, anti-fraud, and data protection laws
- Send product updates and announcements (you can opt out at any time)
3. AI and automated processing
Our AI assistants
iBot (a staff-facing assistant) and eBot (a customer-facing assistant) use AI models hosted on Amazon Web Services (AWS) Bedrock — including models developed by Amazon and Anthropic — to answer questions, generate suggestions, and, where enabled, automatically reply to customer WhatsApp messages.
Data sent to AI models
To provide these features, relevant business data (such as orders, bookings, inventory, customer profiles, and uploaded documents) and customer messages are sent to AI models for processing. AWS Bedrock does not use this data to train its underlying foundation models, does not share it with model providers for their own purposes, and does not retain prompts or outputs beyond what is needed to generate the response.
Document processing
Uploaded documents may also be processed using AWS Textract (optical character recognition) to extract text from scanned files, and may be embedded into a vector index to support knowledge-base search.
Human oversight
AI-generated suggestions for actions such as marketing campaigns, loyalty changes, or product updates require a staff member to review and confirm them before they take effect. eBot may send automated replies to customers without prior review, depending on your configuration — you control whether this is enabled.
5. International data transfers
Our infrastructure is hosted on AWS in the Asia Pacific (Singapore) region. Some service providers we use — including Meta, Stripe, and AI model providers accessed via AWS Bedrock — may process data in other regions as part of delivering their services. Where data is transferred outside Singapore, we rely on our providers' contractual and technical safeguards, including encryption in transit and at rest, to protect it.
6. How long we keep your data
Active accounts
We retain your account and business data for as long as your account is active.
After account closure
When you close your account, we begin deletion within 30 days. Certain records may be retained longer where required by law — for example, financial transaction records may be kept for up to 7 years for tax and audit purposes.
Documents and AI knowledge base
Documents you upload to iBot or eBot, and the data extracted or indexed from them, are retained while your account is active. When you delete a document, it and its extracted data are removed from active storage and the AI knowledge base, subject to routine backup retention.
Automated retention schedules
WhatsApp event logs are retained for 365 days. Audit logs and consent records are retained for 730 days and 1,825 days respectively. QR payment proof is retained for 730 days. Social media access tokens (Instagram, Facebook, YouTube, TikTok) are retained for as long as the account connection is active and deleted within 30 days of disconnection or account closure. Connected inbox message records are retained while the merchant account is active, unless deleted earlier by request or account closure.
7. Your rights
- Access — request a copy of the personal data we hold about you
- Correction — ask us to correct inaccurate or incomplete information
- Deletion — request erasure of your personal data (subject to legal retention obligations)
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — where we rely on your consent, you may withdraw it at any time
To exercise any of these rights, email us at contactus@adtromedia.com. We aim to respond within a reasonable time and in any case no later than 30 days, in accordance with Singapore's Personal Data Protection Act (PDPA) and, where applicable to you, the EU/UK GDPR or other data protection laws. To request deletion of data received from Meta platforms (Instagram, Facebook, Messenger, or WhatsApp), you may disconnect the related account from the Marketing or WhatsApp settings in your dashboard, which will trigger deletion of associated tokens and account data.
8. Our role under data protection law
Your business and your customers
When you use Adtro Media to operate your storefront, you collect and control personal data about your own customers and staff (such as names, WhatsApp numbers, order history, and booking details). For this data, you are the "organisation" under Singapore's PDPA (or "data controller" under GDPR), and Adtro Media acts as your "data intermediary" (or "data processor") — we process this data only on your instructions, to provide the platform's features.
Your obligations
You remain responsible for ensuring you have a lawful basis (such as consent) to collect and process your customers' and staff's personal data, for honouring their rights — including access, correction, and deletion requests — and for complying with the PDPA and any other laws that apply to your business.
Adtro Media's account and platform data
For data we collect about you and your business directly — such as your account details, billing information, and usage data — Adtro Media is the organisation/data controller, as described elsewhere in this policy.
10. How we protect your data
- All data in transit is encrypted with TLS 1.2 or higher
- Passwords are stored using scrypt — a memory-hard one-way hashing algorithm
- Social platform access tokens (WhatsApp, Instagram, Facebook, YouTube, TikTok) are encrypted at rest using AES-256
- Cloud infrastructure is hosted on AWS with access controls and audit logging
- We run regular security reviews and promptly patch known vulnerabilities
11. Children's privacy
Adtro Media is intended for business use by individuals 18 years or older. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us through the platform, please contact us so we can delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice in the dashboard. Your continued use of Adtro Media after the effective date of the revised policy constitutes your acceptance of the changes.
13. Contact us
Adtro Media Pte. Ltd. (UEN 202519799G) is responsible for this policy. If you have questions about this Privacy Policy or want to make a data request, please email us at contactus@adtromedia.com. We aim to respond to all privacy enquiries within 5 business days.
Also read our Terms of Service
contactus@adtromedia.com