Privacy policy

1. Data collected

Account details include your name, email, company, and credentials. Contact forms collect the information you provide with an enquiry. Career applications include contact details, education, experience, a resume, and any optional information you submit. The service also processes data you upload, records of consent, and device and usage information required for access and security.

2. Purposes of data use

eomer uses personal data to provide accounts and requested services, respond to enquiries, review job applications, communicate about the service, and prevent misuse. Data may also support product improvements and legal obligations. Where consent is required, eomer obtains consent before it collects, uses, or discloses personal data for the stated purposes. Any other use must be permitted or required by applicable law.

3. Legal bases

We process personal data under the following legal bases:

• Consent - you provide explicit consent at registration (recorded as privacyConsentAt)
• Contract performance - processing necessary to provide your account and the services you request
• Legitimate interests - security monitoring, fraud prevention, and rate limiting, where our interests do not override your fundamental rights

For users in the EU/EEA, these bases correspond to GDPR Article 6(1)(a), (b), and (f) respectively. For users in Singapore, processing is conducted in accordance with the Personal Data Protection Act 2012 (PDPA).

4. Disclosure and overseas transfers

Personal data may be disclosed to service providers that support these purposes, or where the law requires disclosure. eomer does not sell personal data. Transfers outside Singapore are subject to safeguards that provide protection comparable to the Singapore Personal Data Protection Act 2012 (PDPA), unless an applicable exemption permits otherwise.

5. Service providers

We share data with the following sub-processors solely to operate the service:

• Vercel - application hosting and global CDN; receives all server-side request data including IP addresses
• Neon - managed PostgreSQL database; stores all account, session, audit, and lead records
• Resend - transactional email delivery; receives recipient email addresses and message content for verification and password-reset emails
• Upstash - Redis-based distributed rate limiting; receives only hashed IP+email keys - no plaintext PII is transmitted
• Cloudflare Turnstile (optional) - bot-protection challenge on sign-up and password-reset forms; processes browser signals to distinguish humans from automated requests
• Have I Been Pwned (Pwned Passwords) (optional) - password breach screening; only the first 5 characters of a SHA-1 hash of your password are transmitted using the k-anonymity protocol; your email address and account identity are never sent

We do not sell personal data to any third party.

6. Protection and retention

eomer applies reasonable security measures to protect personal data against unauthorised access, use, disclosure, or loss. Personal data is retained only while it serves the stated purposes or a legal or business requirement. Data is deleted or anonymised when retention is no longer necessary. Where a data breach meets legal notification requirements, eomer will notify the relevant authority and affected individuals as required.

7. Retention periods

• Sessions - expire automatically after 7 days; you may revoke sessions at any time via account settings
• Authentication audit logs - retained for 12 months from the date of each event, then deleted
• Account data - retained until you request deletion (see Your Rights below)
• Lead/demo-request data - retained for as long as necessary for legitimate business purposes; you may request deletion at any time by contacting us
• Password reset tokens - expire after 1 hour and are single-use; the plaintext token is never stored (only a SHA-256 hash)

8. Access, correction, and consent

You may request access to personal data and information about its use or disclosure, correct inaccurate data, or withdraw consent with reasonable notice. Contact the privacy team through the email below. Requests are subject to applicable legal exceptions and identity checks. If access cannot be provided within 30 days, eomer will explain when a response can be expected. Withdrawal of consent may limit the services available to you; eomer will explain those consequences. You may also request deletion, subject to applicable retention requirements.

9. EU/EEA rights and account requests

You have the following rights regarding your personal data:

• Access - request a copy of all data we hold about you via GET /api/privacy/export (requires authentication)
• Deletion - request deletion of your account and associated data via POST /api/privacy/delete (requires authentication); this performs a soft-delete and revokes all active sessions
• Correction - contact us to correct inaccurate data
• Portability - the export endpoint returns data in machine-readable JSON format

Users in the EU/EEA additionally have rights under GDPR Articles 15-22, including the right to object to processing and to lodge a complaint with a supervisory authority.

To exercise any right, contact us at development@eomer.ai. We will respond within 30 days.

10. Children and policy changes

The service is intended for adults. Please contact eomer if personal data from a child has been submitted. This policy may change as the service or legal requirements change. The effective date identifies the latest revision; material changes will be communicated through the website or directly where appropriate.