Contents
1. Who We Are
RECATOOLS (recatools.com) is operated by Tan Seng Fei (Jeffrey Tan), trading as RECASYS, a business registered in Singapore. We operate a free utility tools platform, AI directory, and tech news service.
For privacy matters: [email protected]
2. Data We Collect
2.1 Data you provide directly
- Account data (if you register): email address, display name, hashed password
- Contact form submissions: name, email, message content
- Product enquiry forms (on our partner product listings): your name and work email, the product you are asking about, and your message — plus, only if you choose to provide them, your company, phone number, and country
- Newsletter subscriptions: email address only
- Tool request forms: tool name, description, your email (optional)
2.2 Data collected automatically
- Analytics (consent required): page views, session duration, device type via Google Analytics 4
- Site measurement (no cookie, nothing stored on your device): when a page loads and when you leave it, your browser tells our own server which page it was, the page's title, the website that linked you here (its address only — never what you searched for), whether you used a phone, tablet or computer, your browser's name, how long the page was on screen and how quickly it loaded. On a tool page, it also notes whether you used the tool: that a result appeared after you pressed, typed or chose something in it. For a quiz, it notes whether you started it and whether you finished it. It never records what you entered, what you chose, or the result you got. From your connection we note the country and the network operator's number, so that we can tell people apart from automated programs. Your IP address is never stored in readable form: it is combined with a secret key and scrambled, and the scrambled value changes every day at midnight Singapore time, so it cannot be used to follow you from one day to the next.
- Returning-visitor recognition (analytics consent required): if you allow analytics, your browser keeps one random number on your device so that we can count how often you come back. Our server stores only a scrambled copy of that number and counts of your visits — how many visits, pages and minutes, and the country, device type and referring website of each visit. We never keep a record of which pages you read across visits. Withdrawing analytics consent deletes the number from your device and tells our server to delete your visit counts.
- Tool usage metrics (consent required): anonymous counters recording whether one of our in-browser tools could complete a step — for example, whether an image tool could read a photo's saved quality setting. Daily totals only: never your file, its name, its size, or its contents, and nothing that identifies you or your device.
- Advertising: we do not currently serve advertising on RECATOOLS, and no advertising cookies are set. If we enable advertising in future it will be consent-gated, and this policy will be updated before any ad is served.
- Technical logs: hashed IP addresses (SHA-256 with salt), error logs — stored for 90 days maximum
- Consent records: your cookie consent decision, timestamp, and method — retained for 5 years (GDPR compliance)
2.3 Data we do NOT collect
- Tool input data (your letters, URLs, images, etc.) — all tool computation happens in your browser and your files are never uploaded. If you have granted analytics consent, a tool may report an anonymous counter about the outcome of that computation (see 2.2) — never the input itself.
- Plain-text IP addresses — only SHA-256 hashed with a server-side salt
- Payment card data — we never touch card data (Stripe handles payments if applicable)
3. How We Use Your Data
- Provide and improve the tools and services
- Measure how the site performs — which pages are read, how fast they load, and which visits come from automated programs — so that we can improve it
- Send newsletters (only if you subscribed — unsubscribe at any time)
- Respond to contact and support requests
- Display relevant advertising (only with consent)
- Comply with legal obligations
- Detect and prevent fraud or abuse
We use site-measurement data only to improve the site's performance and content. It is strictly not for sale, it is not shared with advertisers, and it is not used for any purpose you have not been told about here.
4. Legal Basis for Processing (GDPR)
- Contract: processing necessary to provide the services you requested, including steps taken at your request before any contract exists — for example, passing a product enquiry to our distributor so they can quote you
- Consent: analytics, advertising, newsletter — you can withdraw at any time
- Legitimate interests: security monitoring, abuse prevention, service improvement, and the site measurement described in section 2.2 (which stores nothing on your device and cannot follow you across days)
- Legal obligation: compliance with Singapore PDPA, EU GDPR, applicable laws
5. Cookies & Tracking
We use a Cookie Consent Manager. Non-essential cookies (analytics, advertising) are only set after you give explicit consent. See our full Cookie Policy for the complete list of cookies.
We support the Global Privacy Control (GPC) signal. If your browser sends GPC, we treat it as a refusal of non-essential processing: no analytics or advertising cookies are set, and neither the site measurement nor the returning-visitor recognition described in section 2.2 runs.
6. Third-Party Services
- Google Analytics 4 — analytics (consent-gated). Google Privacy Policy
- Cloudflare — CDN, DDoS protection, and DNS. Also routes inbound email sent to our @recatools.com addresses. Processes IP addresses per their Privacy Policy
- Cloudflare R2 — object storage holding our nightly platform backups (database and uploaded media), retained for 30 days
- Resend — delivery of transactional email and newsletters, which it sends using Amazon SES. Resend Privacy Policy
We do not use a payment processor. We do not serve advertising today — no ad-network script loads on any page and no advertising cookie is set, and you can confirm that in your browser's network tab. Advertising is planned. When it begins, Google AdSense will be our advertising network, and it will not load until you consent to advertising cookies. Visitors in the EEA, the United Kingdom and Switzerland will additionally be shown Google's certified consent message, which Google serves from fundingchoicesmessages.google.com. That message is how the question gets asked, so — unlike AdSense — it loads before you answer. It carries no advertising and stores only your choice, but loading it does disclose your IP address and browser details to Google. This paragraph is written ahead of that change so the notice precedes the processing; as at this version's effective date, no advertising script or cookie is present on the site. Tool inputs are never sent to an AI or LLM provider — every tool computes in your browser.
Product enquiries on our partner listings. RECASYS resells security products from partner vendors — currently ThreatBook and digiDations — alongside SAIBERGARD Pte. Ltd., a Singapore company that distributes them in the region. If you submit the enquiry form on one of those listings, we pass what you wrote — the details in section 2.1 — to SAIBERGARD so they can reply with pricing, a demo, or the product documentation. SAIBERGARD decides for itself how to handle your enquiry, so for that enquiry it is an independent controller, and it uses your details only to answer you. We share nothing if you do not submit the form, and browsing a ThreatBook listing sends nothing to anyone. Because SAIBERGARD is based in Singapore, this is not an international transfer.
Error monitoring is self-hosted. When something goes wrong on our servers we record the technical details of the fault so we can fix it. We do this with GlitchTip, open-source software we run on the same Singapore server as the rest of the site — no third party is involved and nothing is sent outside that server. Before a fault report is saved it is automatically stripped of personal data: email addresses and public IP addresses are replaced with placeholders, cookies and login credentials are removed, and the values passed between internal functions are discarded entirely. Fault reports are deleted after 90 days.
7. Data Retention
- IP address hashes: 90 days
- Site-measurement page views: the daily scrambled key and the page-view number are removed after 90 days. What remains — page, country, device type, referring website, time on page — no longer relates to any person and is kept for trend reporting
- Returning-visitor counts (with consent): 13 months after your last visit, or until you withdraw consent, whichever comes first
- Error/fault reports: 90 days
- Consent records: 5 years (GDPR Article 7 requirement)
- Account data: retained while account is active + 2 years after last login
- Newsletter subscriptions: until you unsubscribe
- Contact form and product enquiry messages: 2 years
- Anonymous tool usage counters: retained indefinitely — daily totals containing no personal data, so there is nothing to expire
- Emails we send you: 13 months — the recipient address, subject and message body, kept encrypted on our Singapore server so that correspondence sent in our name can be audited, then deleted automatically
8. Your Rights
Which rights you have depends on the law that applies to you. They are not the same everywhere, so we list them by law.
8.1 Everyone
Wherever you are, you can ask us to delete your personal data, and we will do so within 30 days unless the law requires us to keep it. We offer this to everyone as our own policy, whether or not your local law requires it.
8.2 Singapore (PDPA)
- Access your personal data, and find out how it has been used or disclosed in the past year
- Correct inaccurate or incomplete data
- Withdraw consent to our collecting, using or disclosing your data. We will tell you what withdrawing is likely to mean for you
The PDPA does not currently give a right to data portability. The Act contains one, but it has not yet come into force.
8.3 EU/EEA and UK (GDPR)
- Access your personal data
- Rectify inaccurate data
- Erase your data (the “right to be forgotten”)
- Restrict processing
- Data portability: receive your data in a machine-readable format
- Object to processing based on our legitimate interests
- Withdraw consent at any time. This does not affect processing we carried out lawfully before you withdrew it
8.4 California (CCPA/CPRA)
- Know what personal information we collect, use and disclose, and get a copy of it
- Delete personal information we collected from you
- Correct inaccurate personal information
- Opt out of the sale or sharing of your personal information at Do Not Sell My Data
- Non-discrimination: we will not treat you differently for exercising any of these rights
8.5 How to make a request
To exercise any right, email [email protected]. How quickly we reply depends on the law that applies:
- GDPR: within one month. For a complex request we may extend this by up to two further months, and we will tell you if we do
- PDPA: as soon as reasonably possible. If we cannot respond to an access or correction request within 30 days, we will tell you in writing, within those 30 days, when we will
- CCPA/CPRA: within 45 days, extendable once by a further 45 days if we tell you. We act on an opt-out of sale or sharing within 15 business days
9. International Transfers
RECATOOLS runs on a dedicated virtual private server located in a Singapore data centre. Your data is stored and processed there, under Singapore law.
Site-measurement and returning-visitor data is processed and stored only on that server in Singapore, for visitors from every country, including mainland China. It is not transferred to any third party.
Some of the processors listed in section 6 operate outside Singapore, so a transfer occurs when they are involved:
- Google (Analytics; and, once advertising is enabled, AdSense and its consent message) — may transfer data to the United States under Standard Contractual Clauses (SCCs)
- Resend — a United States provider (Plus Five Five, Inc.) which sends via Amazon SES. It carries the message; it is not where the record is kept. Our own copy of what was sent stays on the Singapore server described above, for the period given in section 7. Resend separately holds its own delivery logs for the retention period of our plan with them — 30 days as at this version’s effective date — after which only our Singapore copy remains. Transfers rely on Standard Contractual Clauses and the EU–U.S. Data Privacy Framework
- Cloudflare — operates a global network; requests are served from the edge location nearest you, with Standard Contractual Clauses in place. Our nightly backups are held in Cloudflare R2 object storage
10. Children's Privacy
RECATOOLS is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted data, contact us at [email protected] and we will delete it promptly.
11. Contact & Complaints
Privacy enquiries: [email protected]
If you are in the EU/EEA and believe we have violated your data protection rights, you have the right to lodge a complaint with your local supervisory authority.
If you are in Singapore, you may contact the Personal Data Protection Commission (PDPC).