Privacy policy
Last updated 15 January 2026
This policy explains what personal data Incepta Group collects, why, on what legal basis, how long we keep it, and who processes it on our behalf. Both the Singapore Personal Data Protection Act and the EU General Data Protection Regulation apply to us, and we build to the stricter of the two.
Who processes data on our behalf
| Processor | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| Hosting provider | Serving the website and the API. | Singapore | SCCs |
| MongoDB Atlas | Primary application database. | Singapore (ap-southeast-1) | SCCs |
| S3-compatible object storage | Encrypted storage of documents you upload (passport, diplomas, transcripts, CV, visa paperwork). | Singapore | SCCs |
| Stripe Payments Singapore Pte. Ltd. | Payment processing, invoicing and subscription billing. | Singapore, United States, European Union | SCCs |
| HubSpot | Customer relationship management and lead follow-up. | European Union, United States | SCCs |
| Transactional email provider | Sending account, booking, billing and service emails. | European Union, United States | SCCs |
| Sanity | Headless CMS for the blog, guides and pathway content. No personal data. | European Union, United States | SCCs |
| Cal.com | Scheduling calls with an advisor. | European Union | adequacy |
| Sentry | Error monitoring. Personal data is scrubbed before transmission. | European Union | adequacy |
| Plausible Analytics | Privacy-friendly audience measurement. Loaded only after you consent to analytics cookies. | European Union | adequacy |
| Google Analytics 4 | Marketing measurement. Loaded only after you consent to marketing cookies. | United States | SCCs |
| Cloudflare Turnstile | Protecting public forms from automated abuse. | Global edge network | SCCs |
Cross-border transfers
- EU → Singapore
- Singapore → Malaysia
- EU → United States
How long we keep data
- lead — 24 months
- account — 84 months
- identity-documents — 24 months
- financial-records — 60 months
- analytics — 14 months
Your rights
You can access, correct, export or delete your data from your client portal at any time, without contacting us first. Where a legal obligation requires us to retain a record — a tax invoice, for example — we tell you which record and for how long.
Contacting the data protection officer
InceptaSG Pte Ltd — a Singapore private limited company.