This Privacy Policy explains how fileAI Pte. Ltd (“we,” “us,” “our”), collects, uses, shares, and protects personal data when you visit our website at www.file.ai (the “Site”) or use our cloud-based AI and document automation platform and related services (the “Services”). It also describes your rights regarding your personal data and how to exercise them. This Privacy Policy applies to: (a) visitors to the Site; (b) individuals who create accounts and subscribe to the Services through our self-serve channel; and (c) users who access the Services on behalf of an organisation that has subscribed to our Services. It should be read together with our Legal Terms available at www.file.ai/legal-terms and our Data Processing Agreement (“DPA”) available at www.file.ai/dpa, which applies when we process personal data on behalf of our business customers.
If you are a business customer: when you upload documents or data to the Services that contain personal data belonging to your own customers or employees, we process that data as a data processor on your behalf under our DPA, not as a data controller under this Privacy Policy. This Privacy Policy governs our processing of personal data about you as an individual — for example, your account data, billing information, and usage data.
Data Controller: fileAI Pte. Ltd, 138 Robinson Road, #26-01 Oxley Tower, Singapore 068906, UEN 201925741W.
Data Protection Officer (DPO): For privacy inquiries, contact privacy@file.ai or the registered address above (Attention: Data Protection Officer).
US Entity: fileAI LLC, a Delaware limited liability company, may act as a local administrative contact for US customers. The data controller for all personal data remains fileAI Pte. Ltd.
Identity data: first name, last name, job title, company name, username
Contact data: email address, telephone number, billing address
Account credentials: password and authentication information
Payment data: billing information including card type, last four digits, expiry date, billing address (full card numbers not stored by fileAI)
Communications: support requests, feedback, survey responses
Technical data: IP address, browser type/version, operating system, device type, time zone, referring URLs, login data
Usage data: pages visited, features used, session duration, clickstream data
Cookie data: data collected via cookies and similar tracking technologies
Identity and contact data from third-party authentication providers (Google OAuth)
Marketing and analytics data from Google Analytics and HubSpot
The company does not intentionally collect special categories of personal data or data from children under 16.
The company does not sell personal data.
Personal data is shared with third-party service providers who process it on behalf of fileAI. A current list of subprocessors is maintained at www.file.ai/subprocessors. The company provides at least 30 days’ advance notice of material changes. All service providers are contractually required to protect data.
Personal data may be shared with Affiliates, including fileAI LLC in the United States, for purposes described in this policy. Affiliates are bound by equivalent data protection obligations.
Personal data is shared with lawyers, auditors, bankers, and insurers in Singapore and the United States where necessary, subject to confidentiality obligations.
If fileAI is involved in merger, acquisition, restructuring, or sale, personal data may be transferred. Users will be notified where required by law.
Personal data may be disclosed where required by law, court order, regulatory authority, or where necessary to protect rights, property, or safety. Where legally permitted, users will be notified before disclosure.
Personal data may be shared with third parties for purposes not listed above where prior consent is obtained.
Strictly necessary cookies: Required for Site function; cannot be disabled. Includes session authentication and security cookies.
Analytical/performance cookies: Help understand visitor interaction (Google Analytics). Used in aggregate to improve the Site.
Functional cookies: Remember preferences and settings to personalize experience.
Marketing cookies: Track browsing activity for relevant advertising. Set with consent where required.
Users can manage cookie preferences through browser settings to refuse, delete, or be notified when cookies are set. Disabling certain cookies may affect Site functionality. Visit www.allaboutcookies.org for more information. Consent for non-essential cookies is obtained where required.
fileAI is based in Singapore and processes personal data primarily in Singapore and the United States (via AWS). If located in the EEA, UK, or Switzerland, personal data may be transferred to countries without equivalent data protection levels.
Transfers from EEA, UK, or Switzerland rely on:
Standard Contractual Clauses (SCCs) approved by the European Commission or UK Information Commissioner’s Office (UK Addendum)
Adequacy decisions from relevant authority
Other appropriate safeguards permitted by law
Copies of transfer mechanisms can be obtained by contacting privacy@file.ai.
Personal data is retained only as long as necessary for described purposes, unless longer retention is required by law.
When no longer required, personal data is securely deleted or anonymized. Anonymized data may be retained indefinitely for research, statistical, and product improvement purposes.
Administrative, technical, and physical safeguards protect personal data against unauthorized access, use, disclosure, alteration, or destruction. Measures include encryption in transit and at rest, role-based access controls, multi-factor authentication, regular security assessments, and incident response procedures.
In case of breach likely to result in risk to rights and freedoms, users and supervisory authority will be notified as required by law. Breach notification procedures are detailed in the DPA at www.file.ai/dpa.
No transmission method over internet or electronic storage is completely secure. Security vulnerabilities should be reported immediately to security@file.ai.
Access: Request copy of personal data held and information about its use.
Correction: Request correction of inaccurate or incomplete data.
Deletion: Request deletion where no lawful basis exists, subject to legal retention obligations.
Objection to marketing: Opt out of marketing communications by clicking unsubscribe link or contacting privacy@file.ai.
EEA, UK, and Swiss residents have:
Restriction of processing: Request restriction in certain circumstances.
Data portability: Receive data in structured, commonly used, machine-readable format and transfer to another controller (where processing based on consent/contract via automated means).
Objection to legitimate interests: Object to processing where rights/freedoms override fileAI’s interests.
Withdrawal of consent: Withdraw consent anytime without affecting prior processing lawfulness.
Lodge complaint: File complaint with local supervisory authority (PDPC in Singapore; national authority in EEA; ICO in UK at www.ico.org.uk).
Singapore residents under Personal Data Protection Act 2012 have:
Access: Request personal data access and disclosure information from preceding year.
Correction: Request correction of inaccurate or incomplete data.
Withdrawal of consent: Withdraw consent to collection, use, or disclosure (subject to legal/contractual restrictions; may affect Service provision).
Data portability: Request transmission to another organization in machine-readable format (where available).
California residents have:
Know: Request information about collected categories, sources, purposes, and third-party recipients.
Delete: Request deletion subject to exceptions.
Correct: Request correction of inaccurate information.
Opt out: fileAI does not sell information or share for cross-context behavioral advertising.
Limit use: fileAI does not use or disclose sensitive information beyond CPRA-permitted purposes.
Non-discrimination: No discrimination for exercising rights.
Submit verifiable requests to privacy@file.ai. Response within 45 days, with up to 45-day extension if necessary. Authorized agents may submit with written authorization.
California “Shine the Light” disclosure: California Civil Code Section 1798.83 permits residents to request information about third-party disclosures for direct marketing. fileAI does not disclose personal information to third parties for their direct marketing without consent.
Exercise rights (except California requests per Section 9.4) by contacting:
Post
Data Protection Officer, fileAI Pte. Ltd, 138 Robinson Road, #26-01 Oxley Tower, Singapore 068906
Identity verification may be required. Reasonable requests are free; fees may apply for manifestly unfounded, repetitive, or excessive requests.
The Site and Services may contain links to third-party websites or integrate third-party services. This Privacy Policy does not apply to third parties. Users should review third-party privacy policies. fileAI is not responsible for third-party privacy practices.
fileAI’s Services use artificial intelligence and machine learning to process customer-uploaded documents. Where processing personal data in documents uploaded by business customers, the DPA governs, not this Privacy Policy.
fileAI does not use automated decision-making (including profiling) producing legal or similarly significant effects on individuals, unless specifically notified and, where required, consent obtained or human review available.
Usage Data and Aggregated Data (non-identifying) may train AI models. Personal account data or document content is not used to train AI models without explicit consent.
The Site and Services are not directed at individuals under 16 (or higher age as required by jurisdiction). Personal data from children is not knowingly collected. If inadvertently collected, contact privacy@file.ai immediately for prompt deletion.
The Privacy Policy may be updated to reflect practice changes, Service changes, or legal changes. Material changes trigger email notification (30 days before effect) or prominent Site notice. Updated Policy at www.file.ai/privacy-policy with updated effective date. Continued use after change constitutes acceptance.
For questions, concerns, or requests regarding the Privacy Policy or data practices, contact:
Post
Data Protection Officer, fileAI Pte. Ltd, 138 Robinson Road, #26-01 Oxley Tower, Singapore 068906
Security incidents
DMCA / Copyright notices (US)
legal@file.ai (Attention: DMCA Agent)
Response target: All inquiries within 5 business days; all formal rights requests within law-required timeframes.