Statement on Cross-Border Transfers of Personal Data
Effective date: 2026-09-23
This statement supplements the “Cross-Border Transfer (Article 28, APPI)” section of our Privacy Policy. It describes the providers to which personal data is transferred, the data protection regimes of the destination countries, and the safeguards in place.
1. Recipients of transferred data
| Provider | Role | Entity / jurisdiction | Processing region | Personal data received | Safeguards |
|---|---|---|---|---|---|
| Supabase Inc. | Database, authentication, storage | US (Delaware) | Singapore (AWS ap-southeast-1) | Name, email, affiliation, images, messages (encrypted), activity history | SOC 2 Type II / ISO 27001, AES-256 at rest, TLS 1.2+, row level security |
| Resend | Email delivery (transactional and newsletter) | US | US | Email address, display name, message body | TLS, DKIM / SPF / DMARC, List-Unsubscribe, delivery logs only |
| Inngest | Background job execution | US | US | Identifiers only (member ID, notification ID, etc.). We do not send your name or email | Job payloads carry identifiers only; the actual data is read back from the Singapore store. Enforced by both type checking and a runtime assertion |
| Sentry | Error monitoring | US | US | Error events (including request information and data attached to the error) | TLS; only cookies and authorization headers are removed before sending (other information attached to an error is not stripped) |
| Vercel | Hosting and edge delivery | US | Global edge (primarily Singapore) | Request metadata and IP address (in transit) | No persistent store of personal data, TLS, SOC 2 |
| Cloudflare (R2) | Off-site storage of database and file backups | Cloudflare, Inc. (US entity) | Asia-Pacific | Encrypted backups | Encryption at rest; a withdrawing member's objects are physically deleted |
| Stripe | Payments (MYR + SST) | US / Ireland | Global | Payment identifiers, billing name and email (card numbers are held by Stripe, not by us) | PCI DSS Level 1, webhook signature verification; we retain only tokens and IDs |
| Google (Gemini API) | AI first-contact in the office chat, and translation | Cannot be identified (includes the US) | Cannot be identified (the Gemini API does not let us pin a processing region) | Conversation content you enter in the office chat, and text submitted for translation. We do not send your name, email, or company | TLS. Prompts are limited to the thread's conversation history and non-personal knowledge written by our staff. Content you submit may be used by Google to improve its services and to train machine learning models |
| Google (Google Tag Manager / Google Analytics and similar) | Delivering analytics and advertising-related tags | Cannot be identified (includes the US) | Cannot be identified (we cannot pin a processing region) | IP address, browser information, the URLs you view, page titles, and cookies or other on-device identifiers. If you are signed in as a member, the URLs include member-only pages | TLS. Loaded ONLY if you consent to BOTH analytics and marketing cookies (undecided is treated the same as refused). Depending on the tag manager configuration, data may also be sent to advertising providers other than Google |
2. Data protection regimes of the destination countries
Republic of Singapore (primary storage)
The Personal Data Protection Act (PDPA 2012) imposes 11 main obligations, including consent, notification of purpose, breach notification, and accountability. The supervisory authority is the Personal Data Protection Commission (PDPC), and penalties reach S$1 million or 10% of annual turnover. Singapore has not received an EU adequacy decision. Government access takes the form of production orders under the Criminal Procedure Code; unlike Japan, there is no prior approval by an independent body.
United States of America
There is no comprehensive federal data protection statute; sectoral federal laws and state laws apply. Government access may arise under the CLOUD Act and Section 702 of the Foreign Intelligence Surveillance Act (FISA). We minimise the personal data we transfer (Inngest receives identifiers only), and for Resend, Stripe, and Cloudflare, which handle actual personal data, safeguards are provided through TLS and encryption at rest.
Country that cannot be identified (Google / Gemini API)
The Gemini API does not let us pin a processing region, so the destination country cannot be identified; processing may occur in several countries, including the US. We disclose this in the consent screen shown at registration and in our Privacy Policy.
Reference: Personal Information Protection Commission of Japan, report on Singapore's data protection regime: https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_singapore/
3. Your rights
You may withdraw your consent to cross-border transfer at any time. Once withdrawn, you can no longer use this service and will be signed out immediately. The record of your withdrawal is retained as required by law.
You may also request disclosure, correction, or deletion of your personal data. Downloading your own data and correcting your profile are available from the member pages. Full deletion of your account and data is handled by the withdrawal flow (deleted after a 30-day cooling-off period).
We respond to such requests within 21 days.
4. Contact
For questions about this statement or about cross-border transfers, please use our contact form. Once the Data Protection Officer (DPO) contact details are published in our Privacy Policy, you may also reach us there.