Privacy policy
Last updated: 24 October 2026
This policy explains how Nine Scrolls Pte. Ltd. (Nine Scrolls Private Limited, UEN 202529756C, "Nine Scrolls", "we") collects, uses and protects personal data when you use our website and our services: ReplyMate (WhatsApp assistant), Wes (websites), Echo (social media posting and analytics) and Victoria (short videos), and our employment agency services. We follow Singapore's Personal Data Protection Act 2012 (PDPA).
In short
- We handle WhatsApp messages, and the Meta (Facebook, Instagram) and TikTok accounts you connect, only to run the services you pay us for.
- We post only what you approve, and read your posts' numbers (views, likes, reach) only to report them to you.
- We never sell your data or your customers' data.
- You can ask us to delete your data at any time: email ninescrollstech@gmail.com or use our data deletion page.
1. Who we are
Nine Scrolls Pte. Ltd., 48 Hillview Terrace, #02-06 Hillview Building, Singapore 669269. Data Protection Officer: ninescrollstech@gmail.com.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Your name, business name, phone, email, address | You, when you sign up or contact us | To set up and run your service, send quotes and invoices, and contact you |
| Invoices and payment records (amount, date, PayNow reference) | Our billing | Accounting and tax records. We do not receive your bank or card details. |
| WhatsApp messages between you and Nine Scrolls, including your APPROVE / REVISE replies | To get your approval before anything is posted, and to answer your requests | |
| Messages between ReplyMate and your customers, and the customer records it keeps for you | Your WhatsApp line | To run ReplyMate for you (see section 5) |
| TikTok account: TikTok user ID, display name, profile picture, list of your videos and their public counts (views, likes, comments, shares) | TikTok, after you sign in with TikTok and agree | To show you which account is connected, post the videos you approve, and report how they perform |
| Instagram professional account: Instagram user ID, username, account type, profile picture, your media and their counts | Instagram, after you sign in with Instagram and agree | Same as TikTok |
| Facebook Page you connect: Page ID, Page name, your Page's posts and their insights (reach, views, reactions, comments, shares, followers) | Meta, after you sign in with Facebook and agree | Same as TikTok |
| Access tokens from TikTok and Meta (Facebook, Instagram) | TikTok and Meta | To post on your behalf. Stored encrypted (AES-256-GCM). We never see or store your TikTok or Instagram password. |
| Videos, photos, captions and hashtags we make or you give us | You and our team | To make and post your content |
| Job candidates: name, contact details, CV, and identity and work pass documents (for example passport details) needed for an application | The candidate or the employer | To place candidates with employers and apply for Employment Passes and Work Permits with the Ministry of Manpower, which receives this data as part of the application |
| Website visits (IP address, browser, pages viewed) | Our hosting and network provider | Security and keeping the site working. We use no advertising cookies. |
3. How we use TikTok and Meta data
- We only post content you have approved, to the account you connected.
- We read the numbers for your posts and account (analytics) only to show you how your content is doing and to plan better posts for you.
- We use the data only to provide the service to you. We do not sell it, rent it, use it for advertising, share it with other clients, or use it to train AI models.
- You can disconnect at any time (see our data deletion page). When you do, we delete the tokens at once.
- Our use of data from TikTok and Instagram also follows the TikTok Developer Terms and the Meta Platform Terms.
4. Who we share data with
We share data only with service providers that help us run the services, and only what they need:
- TikTok and Meta (Instagram, WhatsApp): to post your content and send and receive messages.
- OpenAI: to draft captions and ReplyMate replies. OpenAI processes this text in the United States and does not use API data to train its models.
- Cloudflare: website hosting and network security.
Our own systems run on our servers in Singapore. When data goes outside Singapore, we make sure it is protected to a standard comparable to the PDPA. We may also disclose data where the law requires it.
5. We do not sell your data
We do not sell, rent or trade personal data, yours or your customers', to anyone. We do not use it for advertising.
6. Data about your customers (ReplyMate)
When ReplyMate talks to your customers, you decide what it collects and why, and we process that data on your behalf. You are responsible for telling your customers that an AI assistant answers your WhatsApp and for having a lawful reason to keep their data. We keep it only to run ReplyMate for you and delete it when you ask or when your service ends.
7. Where and how we store data
Your data is kept in databases on our own servers in Singapore. TikTok and Meta tokens are stored encrypted (AES-256-GCM). Each client's WhatsApp line, settings and records are kept separate from every other client's. Backups follow the same rules and are deleted on the same schedule.
8. How long we keep data
- TikTok and Meta tokens: until you disconnect or your service ends, then deleted at once.
- Videos, captions, messages and customer records: while your service runs, then deleted within 30 days after it ends, unless you ask us to delete them sooner.
- Invoices and payment records: 5 years, as required for Singapore tax and company records.
9. How we protect data
Tokens are encrypted. Access to our systems is limited to Nine Scrolls staff who need it, with separate logins. Salespeople only see their own clients. If a data breach is likely to harm you, we will tell you and the Personal Data Protection Commission as the PDPA requires.
10. How to ask for deletion
- Use the form on our data deletion page, or email ninescrollstech@gmail.com from the email address on your account and write "Delete my data".
- You can also remove our app at any time in your Facebook, Instagram or TikTok settings. We then delete that account's tokens and the data we got from it.
- We confirm by email, give you a confirmation code, and finish the deletion within 30 days. Only invoices and payment records we must keep by law stay for 5 years.
- Your customers can ask you, or us directly, to delete their ReplyMate records.
11. Your rights under the PDPA
You can ask to see the personal data we hold about you, ask us to correct it, or withdraw your consent (which may mean we can no longer provide a service). Email our Data Protection Officer at ninescrollstech@gmail.com. We reply within 30 days.
12. Children
Our services are for businesses. They are not meant for anyone under 18.
13. Changes
We may update this policy. The date at the top shows the latest version. If a change is important, we will tell clients on WhatsApp or by email.