Privacy Policy

Your relationships.
Your control.

Last updated: 19 July 2026

Who we are and scope

INNOVAS PTE. LTD. (UEN 202608492R) operates Stackit from Singapore. This policy covers the Stackit website, web app, and mobile apps.

We process account and relationship data to provide the service. We do not sell CRM contents or use contacts, notes, calendar content, card images, or Agent conversations for advertising audiences.

Data we process

We process account identifiers, profile fields, contacts, notes, tags, calendar events, reminders, business-card images, import files, audio and transcripts, device tokens, subscription state, support requests, and security logs when you use the related feature.

Optional analytics can receive device or cookie identifiers, pages, broad location, campaign fields, app information, and non-content product events. We do not send CRM contents or Agent prompts to analytics providers.

Business cards and other people's data

You are responsible for having a lawful reason to scan, import, store, and use another person's business information and for respecting their privacy and communication choices.

Stackit does not automatically invite scanned contacts, send bulk messages, or use their details for ad targeting. A person may request access, correction, or deletion through admin@innovas.sg; we may need information from the account holder to locate the record.

OCR, Agent, imports, and audio

Card images, import header samples, prompts with relevant CRM context, and audio are sent to AWS Bedrock only when you use those features. A first-use notice appears before each transfer, and core CRM functions remain available without Agent.

AWS states that Bedrock inputs and outputs are not used to train its foundation models. Stackit does not claim zero provider retention until the deployed Bedrock retention mode and inference destinations are operationally verified.

Analytics choice

Web analytics cookies are optional. You can reject or withdraw consent in Cookie preferences; Stackit then stops future web analytics sends and removes its first-party Google Analytics cookies from that browser.

Mobile analytics and crash reporting may process app-instance and device information for reliability and non-content product measurement. Store and Firebase settings determine provider retention and must be kept consistent with store disclosures.

Storage, regions, and security

Core CRM data uses an AWS DynamoDB primary in Singapore with a disaster-recovery replica in Seoul, while private uploads use S3 in Singapore. OCR can use Bedrock in us-east-1, and Agent inference profiles can route to supported AWS destinations outside Singapore.

Card images are private and exposed through short-lived signed URLs. New uploads use user-scoped object paths; access checks and deletion tests prevent one account from using another account's scoped object.

Retention and deletion

Deleting an account cancels and deletes its Stripe web-billing customer, removes active Stackit records, all versions of user-scoped uploads, and the Cognito account. Clearing data keeps the profile but removes CRM data and its uploads.

App Store and Google Play subscriptions are managed by the user's store account and must be cancelled there separately. Payment, fraud, security, and tax records may remain with processors where legally required; AWS backups expire under the configured backup schedule and require re-deletion if restored.

Your choices and requests

You can access and edit records in Stackit, export data from Settings, clear CRM data, or delete the account. Email admin@innovas.sg if you cannot sign in or need access, correction, portability, objection, restriction, or deletion help.

We verify requests before acting and may ask for information needed to find the account or third-party record. The designated DPO receives privacy complaints and records follow-up; local legal rights and transfer terms may vary by country.

Data Protection Officer and complaints

INNOVAS PTE. LTD. has designated Yea Chan Park as its Data Protection Officer. Email admin@innovas.sg for privacy questions, complaints, access, correction, consent withdrawal, or deletion requests.

Registered office: 68 Circular Road, #02-01, Singapore 049422. The same public mailbox is used for support and legal enquiries. Do not send passwords or business-card images by email.

Service providers and international processing

These providers support Stackit. The exact contracting entity, enabled products, and destinations depend on the deployed environment and store account.

ProviderPurposeData categoriesProcessing location
Amazon Web Services (AWS)Authentication, database, private storage, OCR, Agent, transcription, infrastructure logsAccount, CRM, uploads, prompts, transcripts, technical logsSingapore plus Bedrock/inference destinations such as us-east-1 or supported global routes
Google / FirebaseOptional analytics, crash reporting, push messaging, sign-in, Play attributionDevice/app identifiers, non-content events, crash and delivery data, sign-in identifiersGoogle's global infrastructure under the applicable Firebase, Analytics, and Play terms
StripeWeb checkout, subscriptions, payment complianceCustomer ID, account linkage, subscription, payment and transaction recordsStripe group infrastructure and service providers under the applicable account agreement
RevenueCat, Inc.Mobile subscription entitlementApp user ID, store purchase and entitlement stateUnited States and its listed subprocessors
Apple App Store / Google PlayMobile distribution, purchases, refunds, store subscription managementStore account, purchase, receipt, device and compliance dataApple and Google infrastructure under the user's store terms

We will update this table before a material new use or provider change. Provider legal entities, operational regions, retention controls, and store disclosures are reviewed before launch.