1. Who we are
TWO TWO PTE LTD (UEN 202003778R), a company incorporated in Singapore with its registered office at 6 Raffles Quay, #14-06, Singapore 048580 ("we", "us"), operates the Vinera website and services and is responsible for the personal data described in this policy. Vinera is a brand of TWO TWO PTE LTD.
Data protection contact (PDPA section 11): compliance@onevinera.com.
2. Our two roles
For data about our own visitors, customers and their users (contact details, accounts, billing, support), we are the responsible organisation and this policy applies.
For data our customers put into their workspaces, such as their own customers' and contacts' details, we act as a data intermediary on the customer's behalf. The customer is the responsible organisation; questions about that data are best sent to them.
3. What we collect and why
Website enquiries: name, company, work email, phone (optional), your areas of interest and message, and the time you consented. We use them to respond to your request and arrange a demo.
Accounts: email address, name and sign-in records, to create your account, sign you in and keep it secure.
Workspace and billing: workspace name, contracting entity, billing contacts, invoices and payment records, to provide the service, bill you and meet tax obligations.
Usage: which features are used and how many AI Credits they consume, to meter Credits, plan capacity and prevent abuse. We record the size of each AI request, not its text.
Support: the content and attachments of support tickets, to help you.
Logs: technical logs such as request paths, errors and IP addresses, to run, troubleshoot and secure the service.
We use personal data only for the purposes above or purposes you have agreed to. We do not sell personal data.
4. AI processing
Content you submit to AI features is processed by Microsoft Azure OpenAI under our enterprise agreement. Our AI models use Azure global deployments, so this content may be processed in any Azure region worldwide. It is not used to train models.
Document recognition and speech transcription run on Microsoft Azure in Singapore.
AI output is a draft that a person reviews. We do not use AI to make decisions about individuals that have legal or similarly significant effects.
5. Who we share data with
Our sub-processors, to provide the services. They are listed on our Sub-processors page, and we announce changes there at least 30 days in advance.
Third-party channels you connect yourself, such as messaging platforms, as you configure them.
Authorities or other parties where the law requires it, or where needed to protect rights and safety.
A successor in a merger, acquisition or sale of the business, who will be bound by this policy.
6. Transfers outside Singapore
Workspace data is stored in Singapore. Some processing takes place elsewhere: AI language-model processing (section 4), Microsoft's global sign-in and email infrastructure, and the forwarding of email sent to our onevinera.com addresses.
Under section 26 of the PDPA and the Personal Data Protection Regulations 2021, we rely on our providers' contractual commitments, including Microsoft's Data Protection Addendum, to give personal data a standard of protection comparable to the PDPA.
7. How long we keep data
Website enquiries: 24 months.
Workspace data: for the life of the subscription. After termination you have 30 days to export it; we then delete it from the live systems within 30 days.
Database backups: a rolling 35-day window.
Operational logs: 90 days.
Billing and payment records: as long as Singapore tax and accounting rules require.
8. Security
Data is encrypted in transit and at rest. Services authenticate to each other with managed identities rather than stored passwords. Workspaces are isolated in the database and storage layers, sensitive actions are logged, and access follows least privilege. Our Security page describes these measures in more detail.
9. Data breaches
If a breach is assessed as notifiable, we notify the Personal Data Protection Commission (PDPC) within 3 calendar days of that assessment, and affected individuals where the PDPA requires.
Where a breach affects data we hold for a customer, we notify that customer within 72 hours of becoming aware of it.
10. Your rights
You may ask to access or correct the personal data we hold about you, and you may withdraw consent. Write to compliance@onevinera.com; we respond within 30 days. Withdrawing consent for data we need to run your account may mean we can no longer provide the service.
If your data sits in one of our customers' workspaces, please contact that customer first; we help them respond.
If you are not satisfied with our response, you may contact the PDPC at www.pdpc.gov.sg.
11. Cookies and local storage
This website uses only strictly necessary cookies and no advertising or analytics trackers. It loads fonts from Google Fonts, which receives your IP address when a page loads.
The Vinera apps use session cookies for sign-in and your browser's local storage for interface preferences, such as language and the current workspace.
12. Children
Vinera is built for organisations and their staff and is not directed at children.
13. Changes and contact
We publish updates here with their effective date and give at least 30 days' notice of material changes. The Legal page lists each version.
Contact: TWO TWO PTE LTD, 6 Raffles Quay, #14-06, Singapore 048580 · compliance@onevinera.com.
This policy is published in English and Chinese. If they differ, the English version prevails.