Contents
1. Who We Are
RECATOOLS (recatools.com) is operated by Tan Seng Fei (Jeffrey Tan), trading as RECASYS, a business registered in Singapore. We operate a free utility tools platform, AI directory, and tech news service.
For privacy matters: [email protected]
2. Data We Collect
2.1 Data you provide directly
- Account data (if you register): email address, display name, hashed password
- Contact form submissions: name, email, message content
- Product enquiry forms (on our partner product listings): your name and work email, the product you are asking about, and your message — plus, only if you choose to provide them, your company, phone number, and country
- Newsletter subscriptions: email address only
- Tool request forms: tool name, description, your email (optional)
2.2 Data collected automatically
- Analytics (consent required): page views, session duration, device type via Google Analytics 4
- Tool usage metrics (consent required): anonymous counters recording whether one of our in-browser tools could complete a step — for example, whether an image tool could read a photo's saved quality setting. Daily totals only: never your file, its name, its size, or its contents, and nothing that identifies you or your device.
- Advertising: we do not currently serve advertising on RECATOOLS, and no advertising cookies are set. If we enable advertising in future it will be consent-gated, and this policy will be updated before any ad is served.
- Technical logs: hashed IP addresses (SHA-256 with salt), error logs — stored for 90 days maximum
- Consent records: your cookie consent decision, timestamp, and method — retained for 5 years (GDPR compliance)
2.3 Data we do NOT collect
- Tool input data (your letters, URLs, images, etc.) — all tool computation happens in your browser and your files are never uploaded. If you have granted analytics consent, a tool may report an anonymous counter about the outcome of that computation (see 2.2) — never the input itself.
- Plain-text IP addresses — only SHA-256 hashed with a server-side salt
- Payment card data — we never touch card data (Stripe handles payments if applicable)
3. How We Use Your Data
- Provide and improve the tools and services
- Send newsletters (only if you subscribed — unsubscribe at any time)
- Respond to contact and support requests
- Display relevant advertising (only with consent)
- Comply with legal obligations
- Detect and prevent fraud or abuse
4. Legal Basis for Processing (GDPR)
- Contract: processing necessary to provide the services you requested, including steps taken at your request before any contract exists — for example, passing a product enquiry to our distributor so they can quote you
- Consent: analytics, advertising, newsletter — you can withdraw at any time
- Legitimate interests: security monitoring, abuse prevention, service improvement
- Legal obligation: compliance with Singapore PDPA, EU GDPR, applicable laws
5. Cookies & Tracking
We use a Cookie Consent Manager. Non-essential cookies (analytics, advertising) are only set after you give explicit consent. See our full Cookie Policy for the complete list of cookies.
We support the Global Privacy Control (GPC) signal — if your browser sends GPC, we automatically treat it as a rejection of non-essential cookies.
6. Third-Party Services
- Google Analytics 4 — analytics (consent-gated). Google Privacy Policy
- Cloudflare — CDN, DDoS protection, and DNS. Also routes inbound email sent to our @recatools.com addresses. Processes IP addresses per their Privacy Policy
- Cloudflare R2 — object storage holding our nightly platform backups (database and uploaded media), retained for 30 days
- Resend — delivery of transactional email and newsletters, which it sends using Amazon SES. Resend Privacy Policy
We do not use a payment processor. We do not serve advertising today — no ad-network script loads on any page and no advertising cookie is set, and you can confirm that in your browser's network tab. Advertising is planned. When it begins, Google AdSense will be our advertising network, and it will not load until you consent to advertising cookies. Visitors in the EEA, the United Kingdom and Switzerland will additionally be shown Google's certified consent message, which Google serves from fundingchoicesmessages.google.com. That message is how the question gets asked, so — unlike AdSense — it loads before you answer. It carries no advertising and stores only your choice, but loading it does disclose your IP address and browser details to Google. This paragraph is written ahead of that change so the notice precedes the processing; as at this version's effective date, no advertising script or cookie is present on the site. Tool inputs are never sent to an AI or LLM provider — every tool computes in your browser.
Product enquiries on our partner listings. RECASYS resells security products from partner vendors — currently ThreatBook and digiDations — alongside SAIBERGARD Pte. Ltd., a Singapore company that distributes them in the region. If you submit the enquiry form on one of those listings, we pass what you wrote — the details in section 2.1 — to SAIBERGARD so they can reply with pricing, a demo, or the product documentation. SAIBERGARD decides for itself how to handle your enquiry, so for that enquiry it is an independent controller, and it uses your details only to answer you. We share nothing if you do not submit the form, and browsing a ThreatBook listing sends nothing to anyone. Because SAIBERGARD is based in Singapore, this is not an international transfer.
Error monitoring is self-hosted. When something goes wrong on our servers we record the technical details of the fault so we can fix it. We do this with GlitchTip, open-source software we run on the same Singapore server as the rest of the site — no third party is involved and nothing is sent outside that server. Before a fault report is saved it is automatically stripped of personal data: email addresses and public IP addresses are replaced with placeholders, cookies and login credentials are removed, and the values passed between internal functions are discarded entirely. Fault reports are deleted after 90 days.
7. Data Retention
- IP address hashes: 90 days
- Error/fault reports: 90 days
- Consent records: 5 years (GDPR Article 7 requirement)
- Account data: retained while account is active + 2 years after last login
- Newsletter subscriptions: until you unsubscribe
- Contact form and product enquiry messages: 2 years
- Anonymous tool usage counters: retained indefinitely — daily totals containing no personal data, so there is nothing to expire
- Emails we send you: 13 months — the recipient address, subject and message body, kept encrypted on our Singapore server so that correspondence sent in our name can be audited, then deleted automatically
8. Your Rights
Under GDPR, PDPA (Singapore), and CCPA/CPRA you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten") — we process within 30 days
- Restrict processing
- Data portability — receive your data in machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent at any time without affecting prior lawful processing
- CCPA/CPRA: opt out of sale/sharing of personal information at Do Not Sell My Data
To exercise any right, email [email protected]. We respond within 30 days (GDPR) or 10 business days (PDPA).
9. International Transfers
RECATOOLS runs on a dedicated virtual private server located in a Singapore data centre. Your data is stored and processed there, under Singapore law.
Some of the processors listed in section 6 operate outside Singapore, so a transfer occurs when they are involved:
- Google (Analytics; and, once advertising is enabled, AdSense and its consent message) — may transfer data to the United States under Standard Contractual Clauses (SCCs)
- Resend — a United States provider (Plus Five Five, Inc.) which sends via Amazon SES. It carries the message; it is not where the record is kept. Our own copy of what was sent stays on the Singapore server described above, for the period given in section 7. Resend separately holds its own delivery logs for the retention period of our plan with them — 30 days as at this version’s effective date — after which only our Singapore copy remains. Transfers rely on Standard Contractual Clauses and the EU–U.S. Data Privacy Framework
- Cloudflare — operates a global network; requests are served from the edge location nearest you, with Standard Contractual Clauses in place. Our nightly backups are held in Cloudflare R2 object storage
10. Children's Privacy
RECATOOLS is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted data, contact us at [email protected] and we will delete it promptly.
11. Contact & Complaints
Privacy enquiries: [email protected]
If you are in the EU/EEA and believe we have violated your data protection rights, you have the right to lodge a complaint with your local supervisory authority.
If you are in Singapore, you may contact the Personal Data Protection Commission (PDPC).