Privacy Policy

Riceball is a software service that helps small businesses in Singapore — salons, property agents, insurance brokers, and other service providers — manage customer conversations and bookings through WhatsApp and Instagram. This policy describes what information we collect, why, and how we protect it.

Riceball is operated by Riceball AI Pte. Ltd., a private company limited by shares incorporated in Singapore on 3 May 2026 (UEN: 202619532H). Our registered office is at 21 Lorong 28 Geylang, #04-02 Edenz Suites, Singapore 398425, on file with the Accounting and Corporate Regulatory Authority (ACRA).

Contact for privacy questions: hello@riceball-ai.com

We collect three categories of data:

a) Business owner account data

• Email address, name, phone number (used for sign-in and support)
• Business name, address, business type
• WhatsApp Business phone number ID and display number (linked via Meta)
• Service catalog, pricing, staff schedule, and similar settings you enter

b) End-customer data (your customers' data)

• Phone number (the WhatsApp identifier)
• Display name as it appears on WhatsApp
• Messages sent to and from your business through Riceball
• Booking history, notes, and any tags you apply

You — the business owner — are the data controller of this end-customer data. Riceball acts as a data processor on your behalf, under your instructions.

c) Technical data

• IP address, browser type, device information
• Pages visited within the dashboard, timestamps
• Error logs (used for debugging and improving the product)

We do not use third-party advertising trackers or sell any data to third parties.

• To provide the service you signed up for (replying to customers, scheduling, reminders)
• To bill you and process payments
• To improve features and fix bugs
• To detect and prevent abuse, fraud, and security threats
• To comply with legal obligations under Singapore law (PDPA, tax law, lawful requests)

We do not use your or your customers' messages to train general-purpose AI models. Conversation data may be sent to our AI provider (e.g., OpenAI / Anthropic) solely to generate replies for that specific conversation, under data processing agreements that prohibit training on your content.

We share data only with service providers that are necessary to operate Riceball:

• Meta Platforms — for WhatsApp Business Platform delivery (required by the service)
• Supabase — for database and authentication infrastructure
• AI providers (OpenAI, Anthropic, or similar) — for generating replies, under no-training agreements
• Stripe — for payment processing (we do not store card numbers)
• Hosting providers (e.g., Vercel) — for serving the application

We do not sell, rent, or trade personal data. We will only disclose data to law enforcement in response to a valid Singapore legal process.

Data is stored in cloud infrastructure operated by our service providers. Primary database storage is in Singapore or the closest regional data centre. Some processing (e.g., AI replies) may happen in other regions; in those cases, the providers are contractually bound to GDPR-/PDPA-equivalent protections.

• Account data: while your account is active, plus up to 90 days after cancellation
• Conversation history: while your account is active; you can delete individual conversations any time
• Billing records: 7 years (Singapore tax law requirement)
• Backups: rotated and overwritten within 35 days

You can request full deletion at any time by emailing hello@riceball-ai.com. We will delete your data within 30 days, subject to legal retention requirements.

Under the Singapore Personal Data Protection Act, you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Withdraw consent for processing (which may end your ability to use the service)
• Request data portability (export of your data in a machine-readable format)

To exercise any of these rights, email hello@riceball-ai.com. We will respond within 30 days.

We use industry-standard practices to protect data:

• TLS encryption in transit
• Encryption at rest for the primary database
• Role-based access controls; staff access is on a need-to-know basis
• Two-factor authentication available on all accounts
• Regular security reviews and dependency updates

No system is perfectly secure. If we discover a data breach affecting your data, we will notify you within 72 hours as required under PDPA.

Riceball uses only the strictly-necessary cookies required to keep you logged in and to remember your language preference (the rb_lang cookie). We do not use third-party advertising cookies, behavioural-tracking pixels, Google Analytics, or Meta Pixel on our website or dashboard.

You can clear or block cookies through your browser settings; blocking the session cookie will sign you out of the dashboard.

Riceball is intended for business use by adults. We do not knowingly collect data from anyone under 16. If you believe a child has used the service, contact us and we will delete the data.

When you use Riceball with WhatsApp Business Platform, your use is also subject to Meta's WhatsApp Business Terms. We do not store your customers' WhatsApp messages longer than necessary to provide the service, and we never re-use those messages for any purpose other than serving your account.

We may update this policy as the service evolves. Material changes will be communicated via email and a notice on the dashboard at least 14 days before they take effect.

Questions, requests, or complaints: hello@riceball-ai.com

If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore.