Privacy Policy

Red Augment Pte. Ltd. ("Red Augment", "we", "our", "us") is a Singapore company registered at 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you:

• Visit our website at www.redaugment.com
• Contact us, apply for a role, or engage our services
• Use any of our Products as a Client
• Interact with a Product that one of our Clients has deployed

We process personal data in accordance with the Singapore Personal Data Protection Act 2012 (PDPA) and, where applicable, the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended (CCPA/CPRA), the Australian Privacy Act 1988, and India's Digital Personal Data Protection Act 2023 (DPDP Act).

---

1. Definitions

• Client means a business that has contracted with Red Augment to use our services or Products.
• Products means the software products we offer, currently including RedConcierge and RedEnvoy, and any product we add in future. Product-specific details are in Section 4.
• End User means a person who interacts with a Product that a Client has deployed, for example by chatting with an assistant on a Client's website or receiving a call placed on a Client's behalf.
• Conversation Data means the messages, voice audio, transcripts, and related metadata generated when an End User interacts with a Product.

---

2. Our Role: Controller or Processor

We act in two different capacities, and your rights depend on which applies.

We are the data controller (an "organisation" under the PDPA) when we decide why and how personal data is processed. This applies to:

• Website visitors
• People who contact us or apply for a role
• Client staff who hold accounts with us or communicate with us

We are a data processor (a "data intermediary" under the PDPA) when we process personal data on behalf of a Client. This applies to End Users of any Product a Client has deployed.

When we act as a processor, the Client is the controller. The Client's own privacy policy governs how your data is used, and requests about your data should be directed to that Client. We will assist Clients in responding to such requests as required by our contract with them and by law.

---

3. What We Collect

3.1 Website visitors

Collected automatically through cookies and analytics tools:

• IP address, approximate location, browser type, device identifiers, operating system
• Pages visited, time on site, referral source, and interaction patterns

3.2 Enquiries, applicants, and Client contacts

Provided by you directly:

• Name, email address, phone number, company name, job title
• Content of your enquiry, application, or correspondence
• CV and supporting documents (applicants only)

3.3 Client account users

When a Client onboards to a Product:

• Login credentials (passwords are stored hashed)
• Name, work email, role within the Client's organisation
• Billing contact details and transaction records (payment card numbers are handled by our payment processor and are not stored by us)
• Configuration data the Client provides, such as branding, business information, product catalogues, and knowledge base content
• Integration credentials and API tokens for platforms the Client connects

3.4 End Users (processed on behalf of the Client)

The data we process depends on the Product and how the Client has configured it. In general:

• Conversation Data
• Information the End User provides during an interaction, such as name, email, phone number, address, and preferences
• Actions the End User takes through the Product, such as orders, bookings, or signups
• Session identifiers, timestamps, and device or channel metadata
• Where the Client has enabled it, data retrieved from the Client's connected third-party platforms

Product-specific details are in Section 4.

3.5 Data we do not collect

We do not knowingly collect sensitive personal data (such as health, biometric, financial account, or religious information) unless a Client's use case specifically requires it and the Client has obtained the necessary consent. We do not knowingly collect personal data from children under 18. See Section 12.

---

4. Product-Specific Processing

This section describes each current Product. When we launch a new Product, we will add a subsection here and update the "Last Updated" date.

4.1 RedConcierge

RedConcierge is an AI concierge deployed on a Client's website under the Client's own name and branding. When you use it:

• Your chat messages and the assistant's responses are processed to generate replies
• Details you provide (such as contact information, delivery address, or booking preferences) are used to complete the action you request
• Cart, checkout, booking, and membership actions are executed through the Client's connected commerce, booking, or subscription platform
• Where the Client has enabled it, your account or order history may be retrieved from the Client's connected platform to answer your questions

Payment details: Payments completed through RedConcierge are processed by the Client's own commerce or payment platform. Red Augment does not receive, store, or process full payment card numbers.

RedConcierge sets a session identifier in your browser to maintain your conversation across page loads. This identifier is not used for cross-site tracking.

4.2 RedEnvoy

RedEnvoy places outbound calls on behalf of a Client. When you receive a call:

• Your phone number and name are supplied to us by the Client
• The call is conducted by an AI voice system. Audio is processed in real time to understand and respond to you
• Where the Client has enabled recording and it is permitted by law, the call audio is recorded
• A transcript, call outcome, and any structured information captured during the call are provided to the Client

The Client is responsible for ensuring it may lawfully contact you and for informing you that the call is recorded where required. See Section 14.

---

5. How We Use Personal Data

5.1 As controller

• Respond to enquiries and provide requested information
• Evaluate job applications
• Create and manage Client accounts, provide support, and process billing
• Send service notices, security alerts, and account updates
• Send marketing communications, only where you have consented or where permitted by law, with an unsubscribe option in every message
• Operate, secure, and improve our website and Products
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our terms

5.2 As processor

We process End User data only to:

• Deliver the Product to the Client as configured
• Generate responses and complete actions the End User requests
• Provide the Client with logs, analytics, and reporting
• Maintain service reliability, security, and quality
• Meet our contractual and legal obligations

We do not use End User data to market to End Users on our own behalf, and we do not sell End User data.

5.3 AI model training

We do not use Client configuration data or End User Conversation Data to train general-purpose AI models. We may use aggregated, de-identified usage statistics to improve Product performance. Any Client-specific tuning is performed only for that Client and only under the terms of our contract with them.

---

6. Lawful Basis for Processing

Where the GDPR or UK GDPR applies, we rely on:

• Consent: marketing communications, non-essential cookies
• Contract: providing Products and services to Clients
• Legal obligation: tax, accounting, and regulatory requirements
• Legitimate interests: website analytics, security, fraud prevention, and service improvement, balanced against your rights

Where the PDPA applies, we collect, use, and disclose personal data with consent, deemed consent, or under a recognised exception, and only for purposes a reasonable person would consider appropriate.

Where the DPDP Act applies, we process personal data with your consent or for a legitimate use recognised under that Act. We do not rely on "legitimate interests" as a basis for processing data of individuals in India.

---

7. AI Processing and Third-Party Model Providers

Our Products use large language models, speech models, and related AI services provided by third parties. When you interact with a Product, relevant parts of the interaction are sent to these providers to generate a response.

• We use providers that contractually commit not to train their models on data submitted through their APIs.
• Providers process data only for the time required to generate a response, subject to their own limited retention for abuse monitoring.
• We may change providers to maintain or improve service quality. Clients may request our current list of providers by contacting contact@redaugment.com.

Outputs are generated automatically and may contain errors. Clients are responsible for reviewing how a Product is configured for their use case, and End Users should confirm important details (such as bookings, prices, or availability) directly with the Client where accuracy matters.

---

8. Integrations and Subprocessors

Our Products connect to third-party platforms at the Client's direction. Depending on the Product and the Client's configuration, these may include commerce platforms, email and SMS platforms, subscription and membership platforms, booking systems, CRM systems, and telephony providers.

When a Client connects an integration, data flows between the Product and that platform according to the Client's settings. Each platform's own privacy policy applies to data it holds.

We also use subprocessors for hosting, database storage, analytics, error monitoring, email delivery, and payment processing. We require every subprocessor to sign data protection terms at least as protective as those in this policy. Clients may request our current subprocessor list by contacting contact@redaugment.com.

---

9. Who We Share Data With

We share personal data only with:

• Clients, for End User data we process on their behalf
• Subprocessors and integration partners, as described in Sections 7 and 8
• Professional advisers, including lawyers, accountants, and auditors, under confidentiality
• Regulators, courts, and law enforcement, where required by law or to protect our rights
• A successor entity, in the event of a merger, acquisition, or sale of assets, subject to this policy

We do not sell personal data. We do not share personal data with third parties for their own advertising purposes.

---

10. International Transfers

Red Augment is headquartered in Singapore. Our team members, infrastructure, and subprocessors are located in multiple countries, and personal data may be stored and processed in any of them.

Where we transfer personal data across borders, we rely on:

• PDPA transfer limitation obligations, including contractual safeguards with recipients
• EU Standard Contractual Clauses and the UK International Data Transfer Addendum for transfers from the EEA and UK
• Data processing agreements with all subprocessors
• Any transfer restrictions notified under the DPDP Act

Clients who require data to be hosted in a specific region should contact us before deployment. We assess such requirements on a case-by-case basis.

---

11. Data Retention

We retain personal data only for as long as necessary for the purposes in this policy, or as required by law, after which we securely delete or anonymise it.

• Website analytics, enquiries, and correspondence: retained for a reasonable period after last contact, then deleted or aggregated
• Job applications: retained while the role is open and for a limited period afterwards for future opportunities, unless you ask us to delete sooner
• Client account and billing records: retained for the duration of the contract and afterwards as required for tax, accounting, and audit purposes
• End User data, including Conversation Data and call recordings: retained for the period agreed with the Client or configured by the Client within the Product, then deleted or anonymised
• Security and access logs: retained for a limited period for security and audit purposes

At the end of a Client contract, we return or delete Client data within 30 days of the Client's written request, unless retention is required by law.

---

12. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS) and at rest
• Role-based access controls and multi-factor authentication for internal systems
• Segregation of Client data within our infrastructure
• Encrypted storage of integration credentials
• Logging, monitoring, and alerting for unusual activity
• Regular vulnerability scanning and dependency updates
• Confidentiality obligations for all staff and contractors

No system is completely secure. If we become aware of a data breach affecting your personal data, we will notify affected Clients without undue delay, and notify regulators and individuals where required by law, including the PDPA mandatory breach notification requirements.

---

13. Children

Our website and Products are not directed at children under 18. We do not knowingly collect personal data from children. Clients are responsible for ensuring their deployments comply with age-related laws in their jurisdictions. If you believe a child has provided us with personal data, contact us at contact@redaugment.com and we will delete it.

---

14. Cookies

We use cookies on www.redaugment.com for:

• Strictly necessary: site operation and security
• Performance: analytics and load monitoring
• Functionality: remembering your preferences

Non-essential cookies are set only with your consent where required by law. You can withdraw consent and control cookies through your browser settings. Disabling some cookies may limit functionality.

---

15. Voice Calling and Communications Compliance

Where a Product places calls or sends messages on behalf of a Client, the Client is responsible for ensuring it has a lawful basis to contact each End User, including:

• Compliance with the Singapore Do Not Call Registry provisions of the PDPA
• Compliance with Indian TRAI regulations on commercial communications, including DND registry checks and DLT registration where applicable
• Compliance with the US Telephone Consumer Protection Act and applicable state laws
• Compliance with equivalent laws in any other jurisdiction

Where a call is recorded, the Client must ensure End Users are informed and that consent is obtained where required. We provide configuration options to support these obligations but do not verify Client compliance.

---

16. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data, subject to legal retention requirements
• Withdraw consent at any time, without affecting prior processing
• Restrict or object to certain processing
• Port your data to another provider in a structured format
• Opt out of marketing at any time
• Not be discriminated against for exercising your rights (CCPA)
• Lodge a complaint with a supervisory authority

California residents: We do not sell or share personal data as defined under the CCPA/CPRA. You may exercise your rights through the contact details below.

Individuals in India: You have the right to nominate another person to exercise your rights on your behalf in the event of death or incapacity, as provided under the DPDP Act.

How to exercise your rights: Email contact@redaugment.com with your request. We will verify your identity and respond within 30 days, or sooner where local law requires. Where we act as a processor, we will forward your request to the relevant Client and assist them in responding.

---

17. Changes to This Policy

We may update this policy from time to time, including when we launch new Products. Material changes will be posted on this page with a revised "Last Updated" date. Where required by law, we will notify Clients directly. Continued use of our website or Products after changes take effect constitutes acceptance of the updated policy.

---

18. Contact, Data Protection Officer, and Grievance Redressal

General enquiries and data requests: contact@redaugment.com

Data Protection Officer (Singapore PDPA) and Grievance Officer (India DPDP Act):

Name: Dhruv
Email: dhruv@redaugment.com
Response time: within 7 working days

Postal address:

Red Augment Pte. Ltd.
160 Robinson Road, #14-04
Singapore Business Federation Center
Singapore 068914

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore, the Data Protection Board of India, the UK Information Commissioner's Office, your EU supervisory authority, or the relevant authority in your jurisdiction.

↑ Back to top