This policy covers RedCRM AI, the app businesses use to manage their customers, bookings, orders, staff and customer messages. RedCRM AI is provided and hosted by Redfluent Pte. Ltd. (“we”, “us”), a company in Singapore, for the businesses that use it (the “business”).
For LorryGo and our websites, see the Privacy Policy.
1. Who is responsible for your data
- The business decides to use RedCRM AI, creates staff accounts and keeps its customer records in it. Under Singapore’s Personal Data Protection Act 2012 (PDPA), the business is responsible for that personal data.
- Redfluent runs RedCRM AI for the business as its data intermediary. We handle the data only to provide, support and secure the service. We do not sell it and we do not use it for advertising.
2. What we collect
Staff accounts
- Name, email address, phone number, role and profile photo. Accounts are created by the business’s administrator.
- Your password is stored only as a one-way hash. We cannot see it.
- Staff details the business may record, such as salary, commission rate and address.
Customer records kept by the business
- Name, phone number, email address, gender, photo, notes, how they found the business, and the staff member assigned.
- Bookings, orders, packages, payments and attachments.
- WhatsApp conversations between the business and its customers (name, number, message text and media), when the business connects its WhatsApp. A customer record may be created automatically for someone who messages the business.
Photos, files and business records
- Photos and files you upload, such as payment proofs, receipts, customer attachments and issue reports.
- Financial records the business keeps: orders, payments, transactions, imported bank statements and reimbursements.
Device and security data
- A device identifier, device model, operating system version, app version and a push-notification token.
- An audit log of important actions, including the IP address they came from.
- The app keeps a copy of your data on your device so it works offline. If you turn on Face ID, the app stores a sign-in token in the iPhone Keychain — never your password.
What we do not collect
- Your location. The app does not read it.
- Your advertising identifier. The app contains no advertising or analytics software.
- Crash reports. The app does not send them to us.
3. AI features
- The AI assistant, reply drafts, daily summaries and expense categorising send the business data needed for the task to an AI model — for example customer names, booking details, notes and your question. Reading a receipt or screenshot sends the image.
- These requests go first to Redfluent’s own AI service. If it is unavailable, text requests (not images) are sent to DeepSeek, an AI provider whose processing may take place outside Singapore. In the AI chat you can also choose DeepSeek yourself.
4. Who can see it
- Staff of the business, according to the role the business gives them.
- Redfluent staff, when needed to set up, support or fix the service.
- Service providers that process data for us: Vercel (app servers and file storage), Neon (database), Apple (push notifications and app distribution), Resend (email verification codes), HitPay (payments — amount, order number and customer name), Meta (WhatsApp messages) and DeepSeek (AI, as described above). Singapore postal codes are looked up with OneMap.
- Authorities, only when the law or a court order requires it.
5. Where it is stored
The database and app servers are in Singapore. Uploaded photos and files are stored privately with Vercel and can only be opened by signed-in users with permission. Database backups are kept on Redfluent’s own equipment.
6. How long we keep it
| Data | Kept for |
|---|---|
| DataBusiness records, customer records, messages, photos and files | Kept forWhile the business uses RedCRM AI, or until the business deletes them or asks us to. |
| DataSign-in sessions | Kept forUp to 30 days. |
| DataEmail verification codes | Kept for10 minutes. |
| DataDatabase backups | Kept for14 days. |
| DataAudit log | Kept forWhile the business uses RedCRM AI. There is no shorter automatic limit today. |
7. Security
- Data is sent over encrypted connections.
- Passwords are stored only as one-way hashes.
- Uploaded files are private and checked against your permissions every time they are opened.
8. Your choices and rights
- Staff: ask your business’s administrator to correct or delete your account, or email us. Administrators can delete staff accounts in the app.
- Customers of a business: contact that business about your records. You can also email us and we will pass it on.
- You can ask what personal data we hold about you, ask us to correct it, or ask us to delete it.
9. Children
RedCRM AI is a business tool and is not intended for children under 13.
10. Contact
- Data Protection Officer, Redfluent Pte. Ltd.: ai@redfluent.com
- If you are not satisfied with our response, you can contact the Personal Data Protection Commission of Singapore (pdpc.gov.sg).
11. Changes to this policy
If we change this policy we update the date at the top. If we start collecting a new type of data, we update it first.