Contents
1. Who We Are
RECATOOLS (recatools.com) is operated by Tan Seng Fei (Jeffrey Tan), trading as RECASYS, a business registered in Singapore. We operate a free utility tools platform, AI directory, and tech news service.
For privacy matters: [email protected]
2. Data We Collect
2.1 Data you provide directly
- Account data (if you register): email address, display name, hashed password
- Contact form submissions: name, email, message content
- Newsletter subscriptions: email address only
- Tool request forms: tool name, description, your email (optional)
2.2 Data collected automatically
- Analytics (consent required): page views, session duration, device type via Google Analytics 4
- Advertising (consent required): ad impressions, clicks via Google AdSense
- Technical logs: hashed IP addresses (SHA-256 with salt), error logs — stored for 90 days maximum
- Consent records: your cookie consent decision, timestamp, and method — retained for 5 years (GDPR compliance)
2.3 Data we do NOT collect
- Tool input data (your letters, URLs, etc.) — all tool computation happens in your browser
- Plain-text IP addresses — only SHA-256 hashed with a server-side salt
- Payment card data — we never touch card data (Stripe handles payments if applicable)
3. How We Use Your Data
- Provide and improve the tools and services
- Send newsletters (only if you subscribed — unsubscribe at any time)
- Respond to contact and support requests
- Display relevant advertising (only with consent)
- Comply with legal obligations
- Detect and prevent fraud or abuse
4. Legal Basis for Processing (GDPR)
- Contract: processing necessary to provide the services you requested
- Consent: analytics, advertising, newsletter — you can withdraw at any time
- Legitimate interests: security monitoring, abuse prevention, service improvement
- Legal obligation: compliance with Singapore PDPA, EU GDPR, applicable laws
5. Cookies & Tracking
We use a Cookie Consent Manager. Non-essential cookies (analytics, advertising) are only set after you give explicit consent. See our full Cookie Policy for the complete list of cookies.
We support the Global Privacy Control (GPC) signal — if your browser sends GPC, we automatically treat it as a rejection of non-essential cookies.
6. Third-Party Services
- Google Analytics 4 — analytics (consent-gated). Google Privacy Policy
- Google AdSense — advertising (consent-gated). Google Privacy Policy
- Cloudflare — CDN, DDoS protection, DNS. Processes IP addresses per their Privacy Policy
- Brevo (Sendinblue) — newsletter delivery (if you subscribed)
7. Data Retention
- IP address hashes: 90 days
- Consent records: 5 years (GDPR Article 7 requirement)
- Account data: retained while account is active + 2 years after last login
- Newsletter subscriptions: until you unsubscribe
- Contact form messages: 2 years
8. Your Rights
Under GDPR, PDPA (Singapore), and CCPA/CPRA you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten") — we process within 30 days
- Restrict processing
- Data portability — receive your data in machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent at any time without affecting prior lawful processing
- CCPA/CPRA: opt out of sale/sharing of personal information at Do Not Sell My Data
To exercise any right, email [email protected]. We respond within 30 days (GDPR) or 10 business days (PDPA).
9. International Transfers
Our servers are hosted on Exabytes (Malaysia/Singapore region). Google Analytics and AdSense may transfer data to the US under Standard Contractual Clauses (SCCs). Cloudflare operates a global network with appropriate safeguards.
10. Children's Privacy
RECATOOLS is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted data, contact us at [email protected] and we will delete it promptly.
11. Contact & Complaints
Privacy enquiries: [email protected]
If you are in the EU/EEA and believe we have violated your data protection rights, you have the right to lodge a complaint with your local supervisory authority.
If you are in Singapore, you may contact the Personal Data Protection Commission (PDPC).