Who operates CorpSuite
CorpSuite is operated by Optimus Technologies Pte. Ltd. (UEN 200008713R), trading as OptimusTech, at 192 Waterloo Street, #05-01 Skyline Building, Singapore 187966.
For privacy enquiries, requests or complaints, contact support@optimustech.com or write to the address above, marked “Privacy enquiry”. This is our privacy contact channel.
This policy explains how we handle personal data in connection with CorpSuite and this website. Where we process your organisation’s records on its instructions, we act as its service provider and, where applicable, a data intermediary under Singapore’s Personal Data Protection Act 2012 (PDPA). Your organisation determines the purposes for those records and is responsible for its own privacy notices and authority to provide them. We handle our own customer relationship and support information for the purposes described below.
Information handled
The information handled depends on the features your organisation uses and the information supplied by its authorised users. It may include account and business contact details, company and corporate-secretarial records, documents, and information provided in support enquiries. These records may contain personal data about your organisation’s personnel, clients or other individuals.
The optional Gmail integration also processes message and connection information described below. Please provide only information needed for your use of CorpSuite and ensure you are authorised to provide personal data about others.
Gmail: send-only access
Permission and information processed
When you connect Gmail, CorpSuite requests only this Gmail permission: https://www.googleapis.com/auth/gmail.send. It permits sending email on your behalf. CorpSuite does not request permission to read, search, modify or delete existing messages in your Gmail mailbox. Connecting Gmail is optional; sending through Gmail requires your authorisation.
For an authorised send, CorpSuite processes sender and recipient email addresses (including CC and BCC), the subject, message body and any attachments supplied for that send. It also processes Google account identifiers and OAuth credentials needed to maintain the connection, and technical send responses or error information where available. A successful API response does not necessarily confirm delivery to, or reading by, a recipient.
Use, sharing and storage
This information is used to send the emails you authorise, maintain the connection, and support the security and operation of the integration. Message information is transmitted to Google for sending through Gmail and to the recipients you designate. Providers supporting the integration may process information only as needed to provide that service, subject to the restrictions below.
OAuth tokens are encrypted at rest. CorpSuite currently does not retain separate copies of sent email bodies or attachments after the sending operation. This does not delete original documents already held in your organisation’s CorpSuite records, or copies held by Google or recipients. Connection credentials and any retained operational metadata remain subject to the purposes and retention rules in this policy.
Storage of sent email content or attachments is planned for a future version. Before introducing it, we will revise this policy, explain the storage and retention practices, notify affected users and obtain consent where required. That future feature is not part of the current practice described here.
Google API Limited Use
CorpSuite’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We limit Google user data use to providing and improving the Gmail features visible to users and supporting their security. We do not sell it, use it for advertising, unrelated profiling, credit or lending decisions, or train general-purpose AI or machine-learning models with it. Transfers are limited to those permitted by Google’s policy: providing the authorised features with user consent, security, applicable legal requirements, or a business transfer with the user’s explicit prior consent. Broader disclosures elsewhere in this policy do not override these restrictions.
Human access to Google user data is limited to circumstances permitted by that policy, such as your affirmative agreement to view specific data, necessary security investigations, legal requirements, or aggregated information used for lawful internal operations. These restrictions also apply to personnel and service providers handling that data.
Revoke access or request deletion
You can revoke CorpSuite’s access through Google Account third-party connections. Once revoked, that authorisation can no longer be used for further Gmail sends; reconnecting requires authorisation again. Revocation does not recall delivered messages or automatically delete existing CorpSuite records.
To request removal of stored Gmail connection credentials or other personal data held by us, email support@optimustech.com. We may verify your identity and authority and coordinate with your organisation where its records are involved. Information retained for a legal requirement will be limited to that purpose. Google and recipients manage their own copies under their respective arrangements; see Google’s Privacy Policy.
Purposes and disclosure
We handle personal data to provide CorpSuite workflows, administer customer accounts and user access, carry out authorised actions, respond to support enquiries, maintain service security and reliability, and comply with applicable legal obligations. We obtain consent where required, or rely on an applicable basis permitted by law. We will notify you of materially different purposes and obtain consent where required before using data for them.
Your organisation’s authorised users may access its records according to their permissions. Our primary hosting provider is Alibaba Cloud in Singapore. Service providers supporting hosting, operation or support may process data as necessary for those services. We require providers handling personal data on our behalf to protect it and use it only for the authorised purposes.
We may disclose information where required or authorised by applicable law, including to competent authorities, or as reasonably necessary to establish or defend legal claims. Information involved in a business reorganisation or transfer remains subject to applicable privacy obligations. Google user data is subject to the stricter transfer limits above.
Singapore PDPA and your choices
You may ask for access to personal data we hold about you and information about its use or disclosure as provided under the PDPA, request correction of errors or omissions, withdraw consent on reasonable notice where processing depends on consent, or raise a privacy complaint. These requests are subject to applicable legal conditions and exceptions.
Send your request to support@optimustech.com, describing the information and action requested. We may ask for information reasonably needed to verify your identity, authority and request. We will respond as soon as reasonably possible; if an access or correction request cannot be answered within 30 days, we will tell you within that period when to expect a response. If an access fee is applicable, we will inform you before proceeding.
For records controlled by your organisation, contact its administrator first. We will assist in accordance with our role, its instructions and applicable law. We will explain the likely consequences of withdrawing consent; withdrawal may prevent us from providing features that require the relevant information. Processing may continue where required or authorised by law.
You may also request deletion, subject to applicable legal and business retention requirements. The PDPA does not provide an unconditional right to immediate erasure. If you remain concerned after contacting us, you may contact Singapore’s Personal Data Protection Commission.
Retention and deletion
We retain personal data while needed for the purposes for which it was collected and for applicable legal or business requirements. We cease retention or remove the means of identifying individuals when those purposes are no longer served and retention is no longer necessary for legal or business purposes.
Following termination of a CorpSuite subscription, customer data is retained for 90 days, after which it is scheduled for deletion or anonymisation, subject to backup and legal exceptions. Please arrange any required export with us before the retention period ends.
Residual backup copies may remain until the applicable backup cycle expires. A deletion request does not necessarily remove every backup copy immediately. Records required for legal obligations, disputes or legal holds may be retained longer, limited to those purposes. This policy does not promise a fixed backup-expiry period.
The 90-day period does not mean every record must be kept for that duration. Requests to remove Gmail connection credentials can be made separately. Current sent email bodies and attachments are not retained as separate copies after sending. Revoking Google access, terminating a subscription and requesting deletion are separate actions.
Security and international transfers
We take reasonable steps to protect personal data against unauthorised access, use, disclosure, alteration and loss, as required by applicable law. OAuth tokens are encrypted at rest. No system or transmission method can guarantee absolute security. Please protect your credentials and restrict account access to authorised users.
We will assess suspected personal data breaches and notify the relevant authorities, affected individuals or customer organisations where required by applicable law and our role.
CorpSuite’s primary hosting is on Alibaba Cloud in Singapore. This is not a guarantee that every processing activity or copy remains in Singapore. Gmail involves Google’s systems and recipients may be overseas. Where personal data is transferred outside Singapore by us or on our behalf, we will comply with the PDPA’s transfer requirements, including ensuring a comparable standard of protection through legally enforceable obligations or another permitted basis. Google user data transfers must also satisfy the Limited Use restrictions above.
This website and policy changes
This static website does not include a contact form, advertising scripts, analytics scripts or third-party font requests in its page code. The website and hosting infrastructure may process technical request information to serve and protect the site. This statement about the static website does not describe every feature of the separate CorpSuite application.
Links to the application, Google or other external services lead to services governed by their own applicable privacy notices. Contacting us by email provides us with your address and the information you choose to send, which we use to respond and manage the enquiry.
We will publish policy updates on this page with a revised “Last updated” date and provide additional notice for material changes where appropriate or required. New Google data uses will be disclosed before they begin, with consent obtained where required.