Privacy Statement

v1.1 (Updated September 2026)

1. Introduction

Good Bards Pte. Ltd. and all its subsidiaries and affiliates globally (“GoodBards”, “Us”, “We”, “Our”) is committed to collecting, using, storing, sharing and disposing of your Personal Data in a fair, ethical, transparent, secure and legitimate way, in accordance with the Singapore Personal Data Protection Act 2012 (“PDPA”) and other applicable data protection and privacy laws, standards or regulations.

This Privacy Statement applies to our use of your Personal Data when you interact with our websites, social media pages, applications and other platforms (“Sites”), and when you or your organisation use the GoodBards marketing platform and related services (the “Platform”). It describes what Personal Data we collect, how we use it, how we protect it, and your rights in relation to it. This Privacy Statement forms part of our Terms of Use.

Our role. For data about visitors to our Sites, prospects and users of our Platform, GoodBards acts as the organisation responsible for the data (a “data controller”). For data that our customers upload to, connect to, or generate within the Platform about their own contacts, audiences and accounts (“Customer Data”), GoodBards acts as a data intermediary (a “data processor”) and processes that data only on the documented instructions of the customer and under the terms of our customer agreement. Where you are a contact of one of our customers, that customer is responsible for the lawful collection of your data and you should direct requests about it to them; we will assist them in responding.

2. What Information Do We Collect

Personal Data is any information that relates to you and can be used to identify you. For specific definitions, please refer to the PDPA and other applicable standards.

Personal Data that we collect directly from you

• When you use our Sites, access or download white papers or reports, subscribe to our mailing lists or newsletters, or create an account on the Platform, we collect the information you submit, including but not limited to your first and last name, email, contact information, industry, job title or role, country of residence or work, and your company.

• When you post on or respond to our social media pages, we may collect information about you from your post.

• When you register for and attend our events, workshops or seminars, we collect the information you submit for registration, including but not limited to your name, email, industry, role, country, company, any additional information in our forms, and video and/or audio recordings.

• When you request information from us, we may collect your name, email, industry, role, country, company, and the details of your inquiry.

Personal Data that we automatically collect

We and our service providers may automatically collect information about your use of our Sites and Platform through cookies, web beacons and similar technologies, including but not limited to your domain name, browser and operating system, pages viewed, links accessed, language preferences, marketing preferences, IP address, time and length of access, referring links, and approximate location.

Personal Data we collect from other sources

We may collect Personal Data about you from our subsidiaries and affiliates, from our business partners with whom we offer our services and joint marketing programmes, from public sources and databases, and from third-party service providers where you have provided your Personal Data and agreed to it being shared.

Data from third-party platforms you choose to connect

The Platform lets customers connect their own third-party accounts, such as Google (Analytics, Search Console, Ads, YouTube, Drive and Docs), Meta (Facebook and Instagram), LinkedIn and TikTok, so that we can retrieve reporting data and publish content on their behalf. We only access these accounts after you explicitly authorise the connection through the platform's own consent screen, and only within the permissions you grant. Data obtained from Google APIs is subject to the additional commitments in Section 7.

Customer Data processed on behalf of our customers

Customers use the Platform to manage marketing contacts, event registrations, form submissions, email campaigns and analytics. This Customer Data may include names, email addresses, phone numbers, company details, engagement history and other fields the customer chooses to collect. We process Customer Data only to provide the Platform to that customer.

Special categories of Personal Data

We do not ask for Special Categories of Personal Data such as information relating to your health, biometric or genetic information, religion, political beliefs, union membership, race or sexual orientation, and our Platform is not designed to store them. Customers must not upload such data to the Platform.

You can choose not to provide your Personal Data to us. However, if your Personal Data is required for us to provide our products, services and solutions under a contract, we may not be able to provide these to you without it.

3. What Is Our Legal Basis For Using Your Personal Data

We may rely on the following legal bases to use your Personal Data in connection with the purposes in this Privacy Statement:

• Applicable laws and regulations

• Performance of contracts

• Your consent to the use of your Personal Data

• Legitimate business interest

4. What We Use Your Personal Data For

Products, services and solutions improvements. For example, to:

• Carry out administrative and business tasks and internal reporting, send administrative information to you and manage our business relationship.

• Request feedback from you regarding our products, services and solutions, using your Personal Data solely for assessing performance and improving operations.

• Process your orders and deliver our products, services and solutions to you.

• Provide timely updates about our products, services and solutions.

• Address your inquiries and fulfil any requests you make.

• Maintain updated records and ensure the accuracy of your contact details.

Provide you with marketing materials and personalise your experience. For example, to:

• Distribute marketing communications to you.

• Enhance your interaction with us by offering a tailored experience.

• Facilitate your subscription to our newsletters and mailing lists.

• Empower you to manage your marketing and cookie preferences.

• Enable you to register for events, workshops and seminars organised by us.

Achieve our business purposes and analyse information. For example, to:

• Establish, oversee and sustain our business relationship with you.

• Provide you with details about our products, services and solutions that might interest you.

• Aggregate usage data for our Sites and Platform.

• Handle and address privacy inquiries, questions, concerns and complaints.

• Fulfil our contractual commitments.

Research and analytical purposes. For example, to:

• Gain insights into your usage patterns on our Sites and Platform.

• Enhance the quality of our products, services and solutions.

• Assess the demand for our products, services and solutions.

• Conduct surveys and questionnaires, including for market research or client satisfaction.

Fulfil our legal obligations, such as investigating, preventing or addressing illegal activities or suspected fraud, and investigating violations of our Terms of Use or this Privacy Statement.

5. How We Share Your Personal Data

We may share your Personal Data with the following parties for the purposes set out in this Privacy Statement (as applicable):

• Our subsidiary companies and affiliated entities, to support the operation of our business, facilitate the delivery, analysis, enhancement, security and customisation of our products, services and solutions, send relevant communications, and for other lawful purposes as allowed by applicable law or with your consent.

• Authorised personnel and advisors, including authorised GoodBards staff, agents and professional advisors such as legal advisors, auditors and consultants, as necessary.

• Our service providers (sub-processors), where we have subcontracted parts of our products, services and solutions, engaged third-party applications, services or products, or tasked third parties with administering internal business processes. Examples include cloud hosting, email and SMS delivery, payment processing, AI model providers, customer support tooling and event registration hosting. Our current categories of sub-processors are listed in Section 6.8.

• Our business partners, with whom we collaborate to offer our products, services and solutions jointly, including providing additional technical assistance in resolving reported issues.

We may also share Personal Data in the following circumstances:

• As part of the contractual terms agreed for the service provided.

• In connection with any joint venture, merger, sale of company assets, consolidation or restructuring, financing or acquisition involving all or a portion of our business, to our advisors and the advisors of the other party.

• To safeguard the rights, property or safety of GoodBards, its business partners, you or others, or as otherwise mandated by applicable law.

• To comply with a request for information from a competent authority in accordance with applicable law, regulation or legal process, or as necessary to adhere to judicial proceedings, court orders or government directives.

• In aggregated, anonymised and/or de-identified form that cannot reasonably identify you.

Any service providers or other parties with whom we share Personal Data are contractually obligated to implement suitable physical, administrative and technical measures to safeguard Personal Data, and are expressly prohibited from using Personal Data for any purpose other than the specific purpose for which we provide it.

6. How We Safeguard Your Personal Data

We are committed to protecting your Personal Data from accidental or unlawful destruction, loss, alteration, unauthorised access or disclosure. This section describes the specific physical, administrative and technical mechanisms we use. We require our service providers to uphold comparable levels of protection.

6.1 What we treat as sensitive data

We apply our strictest controls to the following categories (“Sensitive Data”):

• Authentication credentials, including passwords, session tokens, API keys and OAuth access and refresh tokens for connected third-party accounts (including Google accounts).

• Data retrieved from third-party platforms you have connected, including Google user data obtained through Google APIs (see Section 7).

• Customer Data about our customers' contacts, such as names, email addresses, phone numbers and engagement history.

• Billing and payment information.

6.2 Encryption

• In transit: all connections to our Sites, Platform and APIs, and all connections between our services and third-party APIs, are encrypted using TLS 1.2 or higher. Unencrypted HTTP is not accepted.

• At rest: all databases, object storage and backups are encrypted at rest using AES-256 through our cloud provider's managed encryption.

• Credentials and tokens: passwords are never stored in plain text and are hashed using a modern, salted, adaptive algorithm. OAuth access and refresh tokens for connected accounts, and application secrets, are stored in an encrypted secrets store or encrypted database fields, are never written to logs, and are never exposed to the browser or to other customers.

6.3 Access control

• Access to production systems and to Sensitive Data is restricted to a small number of authorised GoodBards personnel on a strict need-to-know, least-privilege basis, granted through role-based access control and reviewed periodically.

• All staff access to production infrastructure requires individual accounts and multi-factor authentication. Shared accounts are not used.

• Within the Platform, customers control who in their organisation can access their workspace through role-based permissions, and each user authenticates with a password or single sign-on.

• Administrative and data-access actions on production systems are logged.

6.4 Multi-tenant isolation

The Platform serves multiple customer organisations (“tenants”). Every record of Customer Data and every connected-account credential is bound to a single tenant identifier, and every request is authorised against the tenant of the authenticated user before any data is read or written. No customer can access another customer's data, connections or reports.

6.5 Infrastructure and application security

• The Platform is hosted on Google Cloud Platform in enterprise-grade data centres that hold independent certifications including ISO 27001 and SOC 2.

• Services run as stateless, isolated containers with no persistent local storage; all persistent data lives in managed, encrypted database and storage services protected by network-level restrictions.

• Application secrets are held in a managed secrets vault, not in source code or configuration files.

• We apply secure development practices, including code review, dependency vulnerability scanning and input validation, and we patch known vulnerabilities in our dependencies and infrastructure on a prioritised schedule.

• We commission independent penetration testing of the Platform and remediate findings according to their severity.

• Systems are monitored for availability, errors and anomalous activity, and security-relevant events are logged and retained.

6.6 Personnel

All GoodBards employees and contractors are bound by confidentiality obligations, receive data protection and security awareness guidance appropriate to their role, and lose access to systems promptly when their engagement ends.

6.7 Backups, retention and secure deletion

Data is backed up regularly to encrypted storage to protect against loss. When Personal Data reaches the end of its retention period (Section 9), or when you or a customer request deletion, it is deleted from live systems and is removed from backups as those backups expire on their rolling schedule. Credentials for a disconnected third-party account are deleted immediately from live systems.

6.8 Sub-processors

We use a limited number of service providers to operate the Platform. Each is bound by a written agreement that requires them to protect Personal Data to a standard no lower than this Privacy Statement and to process it only on our instructions. Current categories are:

A current, named list of sub-processors is available on request at Info@goodbards.com.

6.9 Incident response and breach notification

We maintain an incident response procedure covering detection, containment, investigation, remediation and communication. If we become aware of a data breach affecting Personal Data, we will assess it without undue delay and, where the breach is likely to result in significant harm to affected individuals or meets the notification thresholds under the PDPA, notify the Personal Data Protection Commission of Singapore within three calendar days of that assessment and notify affected individuals and customers as required. Customers will be informed of incidents affecting their Customer Data so that they can meet their own obligations.

6.10 Your part

Despite these measures, no system can be guaranteed to be 100% secure. We encourage you to protect your account by using a strong, unique password, enabling multi-factor authentication where available, never sharing your credentials, and reviewing the third-party accounts you have connected to the Platform.

7. Google API Services and Google User Data

The Platform integrates with Google services so that customers can view reporting and manage marketing assets in one place. This section explains exactly how we handle data obtained through Google APIs (“Google User Data”).

7.1 What we access and why

We request only the permissions needed for the feature you choose to enable, and each connection is authorised separately by you through Google's consent screen.

7.2 How we use Google User Data

• We use Google User Data only to provide and improve the user-facing features described above, within the Platform, for the customer who connected the account.

• We do not use Google User Data for advertising, and we do not sell it.

• We do not use Google User Data to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. Where an AI feature summarises or analyses your Google data at your request, the data is used only to produce that output for you (see Section 8).

• We do not transfer Google User Data to third parties except (a) to our sub-processors as necessary to provide the feature (for example, our cloud host), (b) as required by law, (c) as part of a merger or acquisition with prior notice to you, or (d) with your explicit consent.

• GoodBards personnel do not read Google User Data except with your explicit consent, for security or abuse investigation, to comply with law, or on aggregated and anonymised data for internal operations.

7.3 How we store and protect Google User Data

• OAuth tokens granted by Google are stored encrypted, bound to your tenant, and used only server-side to call Google APIs on your behalf. They are never exposed to the browser, to other users or to other customers.

• Reporting data retrieved from Google APIs is stored in our encrypted databases, isolated per tenant, and protected by all the controls in Section 6.

• Google User Data is protected in transit by TLS and at rest by AES-256 encryption.

7.4 Retention, revocation and deletion

• We retain Google User Data only for as long as the connection is active and the data is needed to display reports and history in the Platform.

• You can disconnect a Google account at any time from the Platform's integrations settings. Disconnecting deletes the stored OAuth tokens immediately. You can also revoke our access from your Google Account permissions page.

• When you disconnect an account, close your GoodBards account, or ask us to, we delete the associated Google User Data from live systems within 30 days, and it is purged from backups as they expire.

• To request deletion of your Google User Data, contact Info@goodbards.com.

7.5 YouTube API Services

The Platform uses YouTube API Services to retrieve information about the YouTube channel you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to Google's handling of your data.

• What we access: with the read-only YouTube and YouTube Analytics permissions we retrieve your channel details, the list of your uploaded videos with their titles, descriptions and thumbnails, and their performance metrics (views, watch time, likes, comments, shares, impressions and click-through rate). We do not access private messages, and we cannot upload, edit or delete videos, comments or playlists.

• How we use it: only to display YouTube performance reports inside your GoodBards workspace alongside your other channels, and to generate insights about that performance at your request. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.

• How we store it: your OAuth tokens are stored encrypted and used only server-side. Retrieved channel and video metrics are stored per tenant in our encrypted databases and are refreshed from the YouTube API on a daily basis. Data that is not refreshed is deleted after 30 calendar days, in line with the YouTube API Services Developer Policies. We may retain aggregated, non-identifying statistics for longer.

• How we share it: your YouTube data is visible only to users of your own workspace and is not shared with third parties other than our cloud hosting sub-processor.

• How to revoke access: you can disconnect your YouTube channel at any time from the Platform's integrations settings, or revoke GoodBards' access from the Google security settings page. When access is revoked or the channel is disconnected, we delete the stored tokens immediately and the stored YouTube data within 7 days.

• Contact: questions about our use of YouTube data can be sent to Info@goodbards.com.

8. Artificial Intelligence Features

The Platform includes AI-assisted features such as content generation, summarisation, analysis and recommendations. When you use these features, the content you provide and relevant context (for example, brand information, campaign data or reporting data you ask us to analyse) is sent to our AI model providers to generate the response.

• We use AI model providers under agreements that prohibit them from using your data to train their models.

• We do not use your Personal Data, Customer Data or Google User Data to train generalised AI models.

• We minimise the data sent to AI providers to what is needed for the requested task, and we do not send authentication credentials.

• AI outputs are suggestions. You remain responsible for reviewing content before publishing it.

9. How We Keep Your Personal Data

We retain information about you for the duration necessary to fulfil the purpose for which it was collected, unless extended retention is required by legal obligations, dispute resolution, asset protection or enforcement of rights. We retain your Personal Data under the following circumstances:

• When obligated by law, contract or other legal obligations, or as part of an investigation for litigation purposes.

• When your Personal Data is necessary to maintain accurate business and financial records.

• When you have provided consent for us to retain your Personal Data for an extended period, in line with your consent.

• Customer Data is retained for the life of the customer's subscription and deleted within 30 days after termination, unless the customer requests earlier deletion or the law requires longer retention.

• If Personal Data is present in backups or archived copies and its removal is infeasible, we retain it only until those backups expire on their rolling schedule and protect it in accordance with Section 6.

Where automated means are available, you can access and delete your Personal Data yourself at any time. We may anonymise your information in accordance with our policies and retain anonymised records for longer periods.

10. Cross-Border Transfers

Our Platform is hosted in Google Cloud Platform data centres in the Asia-Pacific region. We may transfer your Personal Data to countries where we, our service providers or business partners operate, in connection with the purposes identified above and in accordance with this Privacy Statement.

When we transfer your Personal Data outside the country where it was originally collected, we ensure that appropriate safeguards are in place in line with applicable law, including the PDPA transfer limitation obligation, such as contractual clauses requiring the recipient to protect the data to a comparable standard. You may obtain a copy of these safeguards by contacting us using the details in Section 18.

11. Your Personal Data Rights

You have rights under data protection laws in different countries concerning your Personal Data, and we extend these rights regardless of your location. These include:

• Right to be informed: to know what Personal Data we hold about you, how we use it, its source, whom we share it with, how long we retain it, and why we need it.

• Right of access: to access your Personal Data and obtain a copy from us.

• Right to rectification: to correct inaccurate or incomplete Personal Data.

• Right to be forgotten: to request the erasure, deletion or destruction of your Personal Data.

• Right to data portability: to securely move, copy or transfer your Personal Data for your own purposes.

• Right to withdraw consent: to withdraw consent to our use of your Personal Data, or in relation to direct marketing, at any time.

• Right to restrict use: to limit how we use your Personal Data.

• Right to object: to stop or prevent us from using your Personal Data, including for direct marketing.

• Right to challenge automated decisions: to question and review decisions made about you by purely automated means.

• Right to complain: to lodge a complaint with us or with a relevant data protection authority, including the Personal Data Protection Commission of Singapore.

When you contact us, we may request specific information to verify your identity before providing access to or a copy of your Personal Data, as permitted by applicable law. If allowed by law, we may charge a reasonable fee for access; we will inform you of any fee in advance. Individuals may hold additional rights in certain countries, which we will recognise and uphold. In some situations, where permitted by law, we may decline a request, for example where we have a legitimate business interest or legal obligation to retain the data.

If you are a contact of one of our customers, please direct your request to that customer in the first instance; we will support them in responding.

12. Cookies and Similar Technologies

When you access our Sites, we and our service providers may use cookies (small text files containing a unique identifier placed on your computer, tablet or mobile phone) and similar technologies, including scripts, embedded web links, web beacons, local shared objects and local storage. You can manage cookies through your browser settings and, where available, through our cookie preference tool.

13. Links to Third-Party Websites and Applications

Our Sites may contain links to third-party websites and applications, and you can engage with us through third-party platforms such as LinkedIn, WhatsApp, Slack, Microsoft Teams, Facebook, Instagram, TikTok, X and YouTube. We do not assume responsibility for the security, privacy practices or content of these third-party websites and applications. Please review their privacy and cookie policies before sharing any Personal Data. Your use of such websites and applications is at your own discretion and risk.

14. Changing Your Consent Preferences

In certain instances, you may grant GoodBards consent to process your Personal Data, such as when you opt in to receive direct marketing communications. You can change your consent preferences at any time by unsubscribing from our communications or updating your preferences via email at Info@goodbards.com. Once we receive and confirm your request, we will promptly act on your preferences.

Even if you opt out of marketing communications, you may still receive administrative or essential communications necessary for your continued use of our products, services and solutions.

We do not share your Personal Data with unrelated parties for their own direct marketing purposes, nor do we sell, rent, distribute or otherwise make Personal Data commercially available to any third party.

15. Children's Privacy

Our Sites and Platform are not intended for children. We urge parents and guardians to monitor their children's online activities. If you believe we have inadvertently collected Personal Data about an individual under the applicable age of consent in your country without proper parental consent, please contact us and we will delete it.

16. Updates to Our Privacy Statement

We reserve the right to update this Privacy Statement at any time. When we do, we will revise the “Version” and “Updated” details at the top of this page, and for material changes we will notify Platform customers by email or in-app notice. We encourage you to review this Privacy Statement periodically.

17. Other Privacy Statements

Further details regarding our privacy practices for specific products, services, solutions, human resources, finance and other areas, as well as local jurisdictional requirements, may be set out in separate privacy terms, statements or notices delivered to you. In case of conflict, those separate statements will take precedence for the situations they cover.

18. How to Contact Us

If you have any questions about this Privacy Statement, how we use your Personal Data, concerns about privacy, or if you wish to make a request or file a complaint regarding your Personal Data, please contact our Data Protection Officer at:

Good Bards Pte. Ltd.
Attn: Data Protection Officer
160 Robinson Road #14-04, Singapore 068914
Email: Info@goodbards.com