Effective date: 8 September 2026
Data controller / organisation: Agent Galactica Pte. Ltd. (UEN 202539172N), a company incorporated in Singapore ("we", "us"). Registered office: 65 Marine Drive, #05-158, Singapore 440065.
Data Protection Officer: dpo@tagpatrol.app
This policy explains how we handle personal data when you use TagPatrol at tagpatrol.app (the "Service"). It is written to comply with the Singapore Personal Data Protection Act 2012 ("PDPA") and, for customers and visitors in the UK and European Economic Area, the UK GDPR and EU GDPR ("GDPR"). If you have any questions, contact the DPO.
1. Who we are and how we operate
Agent Galactica Pte. Ltd. is a Singapore company whose products, content and customer support are built and operated by AI agents under the direction of a human director. Automated systems draft and send routine communications, run audits and answer support requests. A human reviews escalations, decisions about your rights requests, and anything involving a complaint, a regulator or a security incident. Where a decision produces a legal or similarly significant effect on you, you may ask for human review by contacting the DPO.
2. What we collect
| Category | Data | Source |
|---|---|---|
| Account | Email address, name (if given), organisation name, password hash or magic-link tokens, login timestamps and IP address | You; our authentication provider |
| Billing | Plan, invoices, transaction IDs, billing country, VAT/GST number if given. Card details are collected and held only by our merchant of record (Section 6); we never see full card numbers | You, via the merchant of record |
| Audit inputs | The URLs you submit for audit and any options you set | You |
| Audit outputs | Screenshots, HTTP archive (HAR) files, cookie and tag inventories, scores and remediation text generated from public web pages at those URLs. These may incidentally contain personal data visible on those pages or in request headers | Generated by the Service |
| Support | Emails and chat messages you send us, and our replies | You |
| Usage and analytics | Pages visited on tagpatrol.app, feature usage, browser and device type. Optional analytics cookies are set only with your consent (Section 9) | Your browser |
| Agency plan | Your client names and logos used for white-label reports | You |
We do not knowingly collect data from children under 16, and the Service is intended for business use.
3. Why we use it and our legal basis
| Purpose | PDPA basis | GDPR basis (Art. 6) |
|---|---|---|
| Creating and administering your account; running audits you request; delivering reports | Consent / deemed consent; contractual necessity | Contract (6(1)(b)) |
| Billing, tax records, fraud prevention | Legal obligation; business improvement | Contract; legal obligation (6(1)(c)) |
| Service emails (receipts, audit ready, drift alerts, security notices) | Deemed consent | Contract; legitimate interests (6(1)(f)) |
| Product newsletters and marketing | Express consent, unsubscribe in every message | Consent (6(1)(a)) |
| Security, abuse detection, logging | Legitimate interests exception (PDPA Part 3, First Schedule) | Legitimate interests |
| Analytics cookies | Consent | Consent |
| Improving the Service, including reviewing anonymised audit results to refine detection rules | Business improvement exception | Legitimate interests |
| Complying with law, responding to lawful requests | Legal obligation | Legal obligation |
We do not sell personal data. We do not use your audit results to train third-party AI models; see Section 6 for how AI providers process data.
4. Audited websites and third-party personal data
When you submit a URL, our browser visits that public page in the same way a member of the public would, records the tags, cookies and network requests that fire, and takes screenshots. You are responsible for ensuring you own or are authorised to audit the site (see the Terms of Service). We do not log in to sites, submit forms, or collect data behind authentication. If an audit artefact incidentally captures personal data of a third party, we hold it only as part of your report and delete it on the schedule in Section 7.
5. Retention
| Data | Retention |
|---|---|
| Audit artefacts (screenshots, HAR files, raw request logs) for one-off audits and free scans | 90 days from audit completion, then deleted |
| Audit artefacts for active Monitor or Agency subscribers | For the life of the subscription plus 90 days |
| Audit scores, findings and PDF reports | Life of the account plus 90 days, or on request earlier |
| Account data | Life of the account plus 30 days after deletion request |
| Billing and tax records | 5 years from the end of the financial year, as required by Singapore tax law |
| Support correspondence | 2 years |
| Security logs | 12 months |
| Analytics data | 14 months maximum, and anonymised where possible |
Backups are purged on a rolling 30-day cycle after the primary copy is deleted.
6. Sub-processors and disclosures
We share personal data only with the providers below, each under a written contract with data protection terms.
| Provider | Role | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Web hosting, edge network, application logs | Account, usage, IP | United States (global edge) | Vercel DPA with EU Standard Contractual Clauses ("SCCs") |
| Supabase Inc. | Database, authentication, file storage | Account, audit inputs and outputs | Singapore (ap-southeast-1) | Supabase DPA with SCCs |
| Anthropic PBC | AI models used to classify unknown tracking requests and draft remediation text and support replies | Audit outputs (URLs, request metadata), support messages. API inputs are not used to train Anthropic's models under its commercial terms | United States | Anthropic commercial DPA with SCCs |
| Paddle.com Market Ltd (UK), subject to onboarding | Merchant of record: checkout, payment, invoicing, sales tax and VAT | Name, email, billing address, card data (held by them, not us) | UK / US | Their own privacy policy applies as they act as merchant of record; DPA and SCCs for data shared with us |
| Resend | Transactional and newsletter email | Email address, name, message content | [provider region] | DPA with SCCs |
| Oracle Cloud Infrastructure | Audit browser workers | URLs, transient audit artefacts | Singapore region | Oracle DPA |
| Cloudflare R2 | Storage of screenshots and HAR files | Audit outputs | [region] | DPA with SCCs |
We will update this table before adding a sub-processor that handles personal data, and will email account holders at least 14 days before a change that materially affects how their data is processed.
We may also disclose personal data to professional advisers, to a purchaser in a business transfer (with notice to you), or where required by law, court order or a regulator.
7. International transfers
We are based in Singapore and use providers in Singapore, the United States, the United Kingdom and the EU. Transfers out of Singapore are made under contracts that meet the PDPA Transfer Limitation Obligation (Regulation 10 of the Personal Data Protection Regulations 2021). Transfers of UK or EEA personal data outside those areas are made under the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or to countries with an adequacy decision. You may request a copy of the relevant safeguards from the DPO.
8. Your rights
Under the PDPA you may ask us for access to your personal data and how it has been used or disclosed in the past year, ask us to correct it, and withdraw consent (which may mean we can no longer provide the Service). Under the GDPR you additionally have rights to erasure, restriction, portability, objection to processing based on legitimate interests, and to lodge a complaint with a supervisory authority (in Singapore, the Personal Data Protection Commission, www.pdpc.gov.sg).
To exercise any right, email dpo@tagpatrol.app from your account email or via the in-app settings page. We respond within 30 days (PDPA) or one month (GDPR), extendable where the law permits. We may charge a reasonable fee for PDPA access requests where allowed and will tell you first. We do not discriminate against anyone for exercising their rights.
Data subject rights requests are reviewed and decided by the DPO, a natural person, not by an automated system.
9. Cookies and similar technologies
We use these categories on tagpatrol.app:
| Category | Examples | Consent |
|---|---|---|
| Strictly necessary | Session and authentication cookies, CSRF tokens, consent preference cookie | Not required |
| Analytics | Vercel Web Analytics (cookieless) | Required before loading, unless the tool is cookieless and does not track individuals |
| Marketing | None at launch | Would require consent |
The consent banner records your choice, lets you reject non-essential cookies as easily as accepting them, and lets you change your mind from the footer link "Cookie settings". We do not load third-party advertising pixels on our own site. Because our product audits exactly this behaviour on other sites, we hold ourselves to the same standard, and you may audit tagpatrol.app with the free scanner at any time.
10. Security
Data is encrypted in transit (TLS 1.2+) and at rest by our hosting providers. Access to production data is restricted to the director and to service accounts with least-privilege roles enforced at the database row level. Audit artefacts are stored in private buckets accessible only through signed, expiring links. We log administrative access. No system is perfectly secure; if you discover a vulnerability, email security@tagpatrol.app.
11. Data breach notification
If we become aware of a data breach we will contain it and assess within 30 days whether it is notifiable. Where a breach is likely to cause significant harm to affected individuals, or affects 500 or more individuals, we will notify the Personal Data Protection Commission within 3 calendar days of that assessment, as required by the PDPA. Where UK or EEA personal data is affected we will notify the relevant supervisory authority within 72 hours of becoming aware, as required by the GDPR. We will notify affected individuals directly, by email, without undue delay where the law requires it, and will tell you what happened, what data was involved, and what we and you can do about it.
12. Automated decision-making and AI
The Service uses AI models to classify network requests, write remediation guidance, and answer support questions. These outputs are technical analysis, not decisions about you as a person. We do not use automated processing to make decisions with legal or similarly significant effects on individuals. Support conversations may be handled by an AI agent; you may ask at any time to have a human review your case, and it will be routed to the director.
13. Changes
We may update this policy. Material changes will be announced by email to account holders at least 14 days before they take effect and the effective date at the top will be updated. Continued use after that date constitutes acceptance under the PDPA deemed-consent rules; where the GDPR requires fresh consent, we will ask for it.
14. Contact
Data Protection Officer, Agent Galactica Pte. Ltd.
Email: dpo@tagpatrol.app
Post: 65 Marine Drive, #05-158, Singapore 440065, Singapore