Privacy Notice

1. Definitions

Key terms used in this notice:

• Personal data: information that identifies you as an individual, such as your name, email address, phone number or a document that carries them.
• Usage data: information collected automatically when sieraOS is used, such as an IP address, browser type and the time of a request.
• Company: the business that holds a sieraOS account and lets people in.
• Controller: whoever decides why and how personal data is used.
• Processor: whoever handles personal data on a controller's instructions (a data intermediary, in Singapore).
• User: anyone with a login, and anyone who opens a personal link a company sends them.
• Applicable law: the Personal Data Protection Act 2012 of Singapore (the PDPA).

2. Our role, and the company's

Most of what is in sieraOS is a company's own records, and that company decides what happens to them. If you are an employee, a job candidate, a client or a client's contact of a company that uses sieraOS, that company is the controller of your information. sieraOS holds it on the company's instructions, as its processor, under the section 'Processing personal data for you' of our Terms of Service. Ask that company first: section 12 says how we help.

For a smaller set, we are the controller: the details of people who have a login, the account's billing, and how the service is used. Sections 3 and 4 say which is which.

3. What a company keeps in sieraOS

The company decides what goes in. Typically:

• Staff: name, contact details, identity and tax numbers, address, bank account, contract, pay, attendance with the location of the sign-in, leave, documents and certificates.
• Job candidates: name, contact details, CV, recorded video and voice answers and their transcript, scores, interview notes, identity details when an offer is made, and a signature.
• Clients and their contacts: company details, names, contact details, documents they provide, a signature, and the address their browser signed from.
• Suppliers: invoices and receipts, including any personal details printed on them.

4. What we keep for ourselves

For these we decide how the data is used:

• Login details: the name and email of each person with a login, and the sign-in provider they chose. Passwords are held by our sign-in provider and never in readable form by us.
• Account and billing details: the company's name, country and plan, any tax number given at checkout, and its payment history. Card numbers stay with Stripe.
• Partner firms: the details of a partner's people (name, email and role) and of the firm, the commission it has earned, and the bank account its payouts go to, and the address its bank needs.
• Partner applicants: what a firm gives when it applies to be a partner: its details, the names and contact details of its people, the documents it uploads, and the signature it draws on the partner agreement. Only our operators read it. We delete the application 90 days after it is declined or abandoned, or after the period the law of the applicant's country sets, if it sets one.
• Usage data: the language and currency you chose, the country your connection comes from (to show prices and language), automated runs, errors, and problems you report to us.

5. How we use your information, and why

Where we are the controller, we use it for these purposes, each on the basis shown. Where we are a processor, the company's own basis applies.

• Create and manage accounts and let people sign in: to perform our contract with the company.
• Deliver sieraOS and give support: to perform our contract with the company, and in our legitimate interest in answering you.
• Bill accounts and pay partner firms: to perform our contract, and to meet legal and tax obligations.
• Decide partner applications and run the partner programme: to take steps at the applicant's request before a contract, and to perform our agreement with the partner.
• Keep sieraOS secure, prevent fraud and fix errors: our legitimate interests, and the duty to protect data.
• Improve sieraOS from page views and error reports: our legitimate interest in running a good service.
• Send notices about your account, security and changes to the service: to perform our contract and meet legal obligations.
• Meet our legal obligations and answer lawful requests: legal obligation. Where a law asks for it, we ask for your consent first and you can withdraw it.

6. AI and automated reading

AI features run only when the company has connected its own OpenAI key. The key belongs to the company's Owner, who holds the agreement with OpenAI; we store it in encrypted form and do not meter or resell it. OpenAI is an independent provider under the Owner's own agreement. How OpenAI keeps or uses what it is sent is set by that agreement and OpenAI's terms, not by us.

When a feature runs, the following are sent to OpenAI in the United States: the text of a CV, the audio taken from a candidate's recorded answer (and the transcript made from it), and the text of a supplier invoice or a mail. A model reads them and proposes a score or a set of figures for a candidate's CV and answers, or the figures on an invoice.

A named person at the company confirms or changes every one. No candidate is rejected and no payment is made by the model alone. A candidate can ask the company for a person to look again.

• What is used: CV text, interview transcripts, the role's keywords and requirements, and the scores and short assessments the model gives.
• What it informs: who goes on a shortlist and who is invited to the next step. The model ranks CVs against the role and puts a top group in front of the person; people outside that group are not carried forward, and their CVs are erased when the person signs that step.
• Where the person comes in: the person at the company confirms or changes the shortlist and every later step; the model passes, removes, invites or rejects no one.
• Your options: ask the company for a person to look again, and write to us at the address in section 12 if the company does not answer.

7. A connected mailbox

A company's Owner can connect a Google mailbox so that sieraOS can read supplier invoices. We read the mail that arrives in that mailbox, not only invoices. The first time, we read mail dated from 1 January 2026, then new mail each time. Every message is opened. We keep the attachments we can read and, where a message has none, we keep its text if it looks worth reading. The model then decides which of them is a supplier bill. Mail that is not a supplier bill may be kept in the company's sieraOS account until a person removes it.

• Read only: the access we ask for is read-only. We never send, delete or change mail.
• Connect a mailbox used for invoices: we advise against connecting a mailbox that holds personal or confidential mail.
• Disconnect at any time: the Owner can disconnect the mailbox in sieraOS and in their Google account.
• Who else sees it: Google holds the mailbox; the text and attachments we keep go to the providers in section 8, including OpenAI.

8. Who else handles it, and where

We use other companies to run sieraOS. This is the current list, by service and the country of the company that provides it. Where a company is a processor for us, it acts on our instructions.

We update this list when it changes, and we tell account Owners by email before a new provider starts to handle personal data in their account. An Owner who objects can close the account. Sign-in providers and OpenAI also act under the person's or the Owner's own relationship with them, as explained here.

• Supabase (company in the United States): the database, file storage and sign-in. Our database and files are hosted in Singapore.
• Vercel (company in the United States): runs the application, and measures page views (section 15). Vercel serves requests from its network, so some processing happens outside Singapore.
• Stripe (company in the United States): takes card payments for subscriptions and holds card details. Stripe processes in other countries where it operates.
• Postmark (company in the United States): sends the email sieraOS sends, so it sees the recipient, subject and body.
• OpenAI (company in the United States): reads CVs, transcribes and scores recorded answers, and reads invoices, only on the company's own key (section 6).
• Google (company in the United States): only if a company connects a mailbox (section 7), and for sign-in with Google. Signing in with Apple, Facebook, LinkedIn or GitHub, where offered, sends your sign-in details from that provider to us in the same way.
• Xendit (company in Indonesia): used only to send commission to partner firms. It sees the partner's name and bank account.
• DBS Bank Ltd (company in Singapore): sieraOS's bank, used to send commission to partner firms by bank transfer. It sees the partner's name, bank account, bank and the address the bank needs.

9. Sharing

We do not sell your personal data. We share it with the providers in section 8, with legal authorities when the law requires it, in a merger or sale of the business, and with your consent.

A partner firm that a company has let in can keep that company's books in the Finance screens, see its financial records there, and give the first signature on a month's books. It never opens staff records, payroll, hiring, sales or anything else. A partner firm can also pay for the account. Each person at a partner firm has their own login, and what they do is recorded with their name.

10. Payment information

Payments are taken by Stripe. We do not store card or bank details on our servers. Stripe's handling of card details is under its own terms and privacy policy.

11. How long we keep it

We keep personal data only as long as it is needed to provide sieraOS and to meet legal, accounting and reporting obligations.

• A candidate who was not hired: 6 months after the role is filled or closed, and 12 at most.
• A candidate's video recordings: 90 days.
• Documents a client provided for a piece of work: for as long as the law of the client's country requires; nothing is deleted automatically until that period is set.
• A proposal the client did not accept: 30 days after it lapses.
• Staff, payroll and accounting records: while the account is open, and as long as the company's law requires it to keep them.
• A closed account: nothing is deleted automatically when an account closes. The Owner can export what the account lets them export (section 12) and ask us to erase the account. We erase it by hand, and not before the periods the law sets for the company's records.
• Accounting, payroll and tax records: the periods Singapore law sets for the company's books and records.

12. Exercising your rights

If a company put your information into sieraOS, ask that company: it can do all of this in sieraOS itself. If it does not answer, write to our privacy contact at privacy@fivebucks.ai and we will pass the request on and help. If the information is ours (section 4), write to us at privacy@fivebucks.ai. We answer within 30 days, and sooner where the law sets a shorter time. We may need to check who you are.

What the Owner of an account can take out themselves: sent invoices (PDF), the profit and loss and balance sheet (Excel or PDF), and a year of attendance (CSV). The Owner can do so while the account is open, and after it closes. There is no self-service export for other records, such as staff records, costs, the bank and the ledger: ask us, and we will give you a copy of the personal data we hold in a commonly used format.

• access your data and receive a copy of it
• correct data that is inaccurate or incomplete
• delete data, or end its processing, where the law gives you that right
• withdraw consent you gave, and object to or limit how it is used
• ask for it in a portable form where the law gives you that right
• complain to us, and to the Personal Data Protection Commission of Singapore (section 13)

13. Singapore: your rights, and the regulator

This notice is given under the PDPA. Where a company uses sieraOS, it is the organisation responsible for your data and we are its data intermediary under our Terms of Service; for our own data (section 4) we are the organisation.

Our privacy contact is also our data protection officer. You can reach them at the address in section 12.

For a company's payroll in Singapore we hold, on the company's behalf and as its data intermediary, the payroll data of its staff: pay, CPF details, NRIC or FIN, date of birth, race and religion (the last two only to work out the self-help group fund each person owes, and only when the company enters them), and the account each person is paid into. Only the Owner, Finance and the staff member themselves can read a person's NRIC or FIN, race, religion and payee account in sieraOS. None of them is printed on a payslip.

You can ask to access or correct personal data that we hold about you, and to withdraw consent you gave us. We answer within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Commission of Singapore (www.pdpc.gov.sg).

We transfer personal data out of Singapore only to the providers in section 8, under contracts that require them to protect it to a standard comparable to the PDPA, and only to the countries named there.

14. If something goes wrong with your data

If we find a breach of security that affects personal data in a company's account, we tell the Owner without undue delay, and no later than 48 hours after we confirm it. We give what the company needs to tell its own regulator and the people affected: what happened, what data, what we have done and what we advise.

If a data breach that the PDPA treats as notifiable affects data we hold for ourselves, we tell the Personal Data Protection Commission and the affected people as the law requires, within the time it sets. If it affects data we hold for a company, we tell the company without undue delay, as the PDPA requires of a data intermediary, so that it can notify.

15. Cookies and measurement

sieraOS sets only what it needs: a cookie that keeps you signed in, one that remembers your language, one that remembers the currency shown to you, short-lived cookies that hold a step in progress (such as connecting a mailbox), and your choice of light or dark, kept in your browser. We use no advertising cookies.

We measure page views with Vercel Web Analytics, which sets no cookie. It receives the address of the page, the page you came from, your country, and your browser and device type. We read the country your connection comes from to show prices and language. You can clear cookies in your browser settings.

16. Security

Each company's records are separated from every other's in the database itself. Files are private and opened only after a signed-in check. Every signature and approval records who gave it. We take reasonable administrative and technical measures, but no method of storage or transmission is completely secure.

17. Children

sieraOS is not intended for anyone under 18. A company's staff records can include a person under 18 (such as an intern); the company is responsible for that record. If you believe a child has given us personal data, contact us at privacy@fivebucks.ai and we will delete it.

18. Links to other sites

sieraOS may link to other websites. We are not responsible for their privacy practices, and we encourage you to read theirs.

19. Changes to this notice

We may update this notice. We tell account Owners by email before a change that matters, post the new text on this page and revise the "Last updated" date. An Owner is asked to accept a new version of the Terms of Service and this notice when it changes in a way that matters.