Privacy Policy

1. Introduction

Origo Labs PTE. LTD. (“Origo Labs,” “we,” “us,” or “our”), a company incorporated in Singapore with its registered office at 72 Anson Road #07-04, Anson House, Singapore 079911, provides Generative Engine Optimization (GEO) services, including through our proprietary technology, the Origo Engine (the “Engine”). This Privacy Policy explains how we collect, use, disclose, and protect information when you visit origolabs.ai (the “Website”), engage our services, or use the Engine (together, the “Services”).

We are committed to handling personal data in accordance with Singapore’s Personal Data Protection Act 2012 and its subsidiary regulations (the “PDPA”) and any other applicable data protection laws. This Privacy Policy applies to all users of the Website or our Services and by accessing or using the same you acknowledge that you have read, understood, and agreed to the terms set out therein. If you are located in a specific jurisdiction outside Singapore, one or more jurisdiction specific terms or addenda (each a “Jurisdiction Addendum” and collectively, the “Jurisdiction Addenda”) may apply to you. In the event of any conflict or inconsistency between the terms of this Privacy Policy and an applicable Jurisdiction Addendum, the relevant Jurisdiction Addendum shall govern and prevail to the extent of such inconsistency for users in that jurisdiction.

2. Scope

This Policy applies to information we process from or about (a) visitors to our Website, (b) representatives of client companies that engage our Services, and (c) prospects who request a free audit or otherwise contact us. The Engine is designed for company-level information and is not intended to receive personal data from clients; see Section 4.

3. Information We Collect

3.1 Information you provide directly. When you request a free audit, contact us, or sign up as a client, we collect information such as your name, business email address, company name, job title, and the contents of your enquiry.

3.2 Account and billing information. When you engage our paid Services, we collect account-opening details and the information necessary to process payment. For card payments this is handled by our third-party payment processor (see Section 7), and we do not collect or store full payment-card numbers. For bank transfer we collect billing contact name, company registration details, business address, and transaction references.

3.3 Client knowledge-base information. To configure and operate the Engine, clients provide company information such as website URLs, brand voice, differentiators, competitor names, and target prompts. This is intended to be business information about the client’s company, not personal data.

3.4 Information collected automatically. When you visit the Website, we and our analytics providers may collect technical data such as IP address, browser type, device information, pages viewed, and referring URLs, through cookies and similar technologies (see Section 9).

4. The Origo Engine and Personal Data

The Engine is built to process company-level information (URLs, brand positioning, competitor and prompt data) rather than personal data. Clients are instructed not to enter personal data into the Engine’s knowledge base. If a client nonetheless submits personal data into the Engine, the client represents and warrants that it has a lawful basis to do so, and expressly confirms that it has notified all relevant individuals and obtained their valid and informed consent where required under the PDPA or any other applicable data protection legislation for such personal data to be collected, used, disclosed, and processed by Origo Labs, its affiliates and its third party service providers for the provision of the Services. In such circumstances, we process that data solely on the client’s behalf as a data intermediary as described in Section 10 and the client remains responsible for all such data.

5. How We Use Information

We use information to: provide, operate, and improve the Services and the Engine; run audits and generate AI-visibility measurements and recommendations; set up and manage client accounts; process payments and maintain financial records; communicate with you; monitor and secure our systems; investigate, prevent, or address suspected fraud, unlawful acts, security threats, or violations to our Terms of Service; evaluate or execute corporate transactions; fulfill any other purpose related to the provision of the Services; and comply with legal, accounting, and regulatory obligations.

Support and communication channels depend on your plan. On self-serve plans, we communicate and provide support primarily by email. On Custom engagements, we may also communicate through additional channels such as Slack or WhatsApp, which involve those third-party providers processing the contact and message data you share through them. Without limiting the foregoing, we reserve the right to communicate with you, provide operational updates, or deliver legal and service notices using any reasonable communication channel available to us, including email, in-platform notifications, telephone, messaging applications, or via your designated account administrators.

6. Legal Bases for Processing

By accessing the Website, using the Engine or engaging the Services, you expressly consent to the collection, use, storage and disclosure of your personal data as set out in this Privacy Policy. Where the PDPA applies, we may also process personal data on other statutory grounds as permitted by the PDPA, including deemed consent, legitimate interests and compliance with legal obligations. To the extent that any other applicable data protection laws apply, our applicable legal bases are set out in each Jurisdiction Addendum.

7. Disclosure of Information

We do not sell personal data. We may disclose information to service providers and sub-processors who support our operations, to professional advisers such as auditors and lawyers, to banking and payment partners to process payments, and to authorities or other parties where required by law or to protect our rights. We require third parties handling personal data on our behalf to provide a standard of protection comparable to that required under the PDPA.

The categories of sub-processors we use include but shall not be limited to cloud hosting and infrastructure, search/data retrieval, and payment processing, together with the AI-model providers whose engines the Engine measures. We may update this list as our providers change.

8. International Transfers

We are based in Singapore and may process information in, or transfer it to, other countries where our service providers operate. Where personal data is transferred out of Singapore, we take the appropriate steps to ensure that the overseas recipient is bound by legally enforceable obligations to provide the transferred personal data a standard of protection which is comparable to that under the PDPA. Where personal data is subject to other foreign data protection laws, the applicable international transfer mechanisms are governed by the relevant Jurisdiction Addendum.

9. Cookies and Analytics

The Website uses cookies and similar technologies to operate the site and understand usage. When you access our client dashboard, we use strictly necessary session cookies solely to maintain your active login and authenticate your account session. On the Website, we use third-party analytics and measurement tools to collect aggregated usage information to improve site performance. You may accept or decline analytics cookies via our cookie consent banner upon visiting the Website. You can also control cookies through your browser settings; disabling some cookies may affect Website or dashboard functionality.

10. Our Role as Data Intermediary / Processor

To the extent we process personal data on behalf of a client (for example, if a client inadvertently or intentionally places personal data into the Engine or provides it for delivery of the Services), we act as a data intermediary under the PDPA. In that capacity we process such data in accordance with this Privacy Policy and only on the client’s documented instructions, apply appropriate security measures, and assist the client with its obligations as reasonably required and commercially feasible. The client acts as the data controller and is responsible for the lawfulness of the data it provides.

11. Data Retention

We retain personal data for as long as necessary to provide the Services, maintain our business and financial records, and comply with legal obligations. Financial and transaction records are retained for the periods required under Singapore law. Account and Engine knowledge-base data following termination is retained for up to thirty (30) days to facilitate account reactivation, address billing queries, or satisfy operational continuity, after which it is securely deleted or anonymised in accordance with our standard data deletion protocols, unless a longer retention period is required by applicable law or a separate signed agreement. When data is no longer required, we securely delete or anonymise it.

12. Security

We implement reasonable administrative, technical, and organisational measures and security arrangements to protect personal data in our possession or under our control against unauthorised access, use, disclosure, copying, modification, disposal, or similar risks. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Your Rights

Subject to applicable law, you may request access to, or correction of, the personal data we hold about you, and withdraw consent to certain processing. We may charge a reasonable administrative fee for handling access requests where permitted by law, and we will inform you of any applicable fee before processing your request. To exercise any right, contact us using the details in Section 15. We will respond within the timeframes required by the PDPA. Additional rights available to individuals in other jurisdictions are set out in the relevant Jurisdiction Addenda.

14. Children

The Services are intended for businesses and are not directed at individuals under 18. We do not knowingly collect personal data from children.

15. Contact and Data Protection Officer

For any privacy questions or requests, or to contact our Data Protection Officer, please email privacy@origolabs.ai or write to Origo Labs PTE. LTD., 72 Anson Road #07-04, Anson House, Singapore 079911.

16. Changes to This Policy

We may update this Policy from time to time. The “Last updated” date reflects the latest revision, and material changes will be communicated where required. Your continued access to or use of the Services following the effective date of any changes constitutes your binding acceptance of the revised Policy. If you do not agree to the updated Policy, your sole remedy is to discontinue use of the Services.