Privacy policy
Last updated 22 October 2026
This policy explains how Bytexa handles personal data in Business Plus. We follow Singapore's Personal Data Protection Act (PDPA).
Our role
- For the people who use the service (staff of our customer organisations), we decide how their account data is used.
- For data an organisation enters about its own customers (names, contacts, sites, signatures), the organisation decides, and we only process it on its behalf.
What we hold
- Users: name, work email, phone (optional), time zone, signature (optional), passkey public keys, and sign-in times.
- Organisation content: customers, contacts, sites, tickets, notes, time records, reports and customer sign-offs.
- Technical records: security logs and an audit log of administrative actions.
Passkeys never leave your device; we store only a public key that cannot be used to sign in on its own.
Why we use it
- To run the service: sign-in, the features your organisation uses, and emails such as sign-in links.
- To keep it secure and to help your organisation when it asks for support (read-only and logged).
- To bill your organisation. We do not sell personal data or use it for advertising.
Who helps us
- Supabase: database and sign-in, hosted in Singapore.
- Vercel: web hosting, in Singapore.
- Resend: sends sign-in emails.
- Microsoft: calendar invites, only if your organisation connects its Microsoft 365.
Each is bound by its own data protection terms. Some may process data outside Singapore under comparable protection.
How long we keep it
- While your organisation uses the service.
- After it leaves: erased 90 days later; backups roll over within a further period of up to 90 days.
- A user removed by their admin keeps no access; their name stays on past records the organisation keeps.
Security
Data is encrypted in transit, each organisation's data is separated by the database itself, and sign-in uses passkeys instead of passwords.
Your choices
To see, correct or remove your data, ask your organisation's admin first; they can update most of it. You can also write to us. If a data breach affects you, we will tell your organisation and, where the law requires, the PDPC.