Privacy Policy

1. Scope

This Privacy Policy explains how Reflextion Ventures Pte Ltd (“Reflextion,” “we,” “us”) handles personal data collected through the Cybrex website and in the course of sales, demo, and account provisioning activity.

This Policy does not cover Customer Data processed within a deployed Cybrex instance (architecture models, telemetry, alert data, and similar data generated by Customer's use of the licensed product). That processing is governed by the Data Processing Agreement executed as part of each customer's Order Form, referenced in Section 11.

2. Data We Collect

In connection with the Cybrex website and commercial relationship, we collect:

• Business contact data: name, work email address, company, and job title, submitted through demo requests, pilot enquiries, or account provisioning.
• Communications: information you provide when contacting us for support, sales, or legal matters.
• Website usage data: limited technical data (browser type, referring page) related to use of the marketing website, not the deployed product.

3. How We Use It

• Responding to demo requests and provisioning evaluation access;
• Managing the commercial relationship, including contracting, billing, and support;
• Sending product and account-related communications;
• Complying with legal, regulatory, and contractual obligations.

We do not use business contact data for purposes unrelated to the commercial relationship, and we do not sell personal data.

4. Our Obligations Under the PDPA

As a Singapore-incorporated organisation, Reflextion adheres to the Personal Data Protection Act 2012 (PDPA), including obtaining consent where required, limiting collection and use to notified purposes, providing access and correction on request, maintaining reasonable security arrangements, limiting retention to what is necessary, and notifying the Personal Data Protection Commission (PDPC) and affected individuals of notifiable data breaches within prescribed timelines.

5. Subprocessors

We use a limited set of infrastructure and service providers to operate our website and sales process (for example, cloud hosting and email delivery). Where an Order Form authorises AI-assisted reasoning within a deployed Cybrex instance (see Section 7), the relevant subprocessor is identified in that Order Form's Data Processing Agreement, not in this website-facing Policy.

6. International Transfer

Where any of the limited data described in Section 2 is processed by service providers located outside Singapore, we take steps to ensure a comparable standard of protection to the PDPA, through contractual safeguards or other legally recognised mechanisms.

7. AI-Assisted Reasoning (Within Deployed Cybrex Instances)

By default, Cybrex's AI analysis runs locally within Customer's Deployment Environment using a self-hosted, open-source language model, and no Customer Data leaves that environment for this purpose.

Customers may optionally enable cloud-assisted reasoning through a third-party AI provider for specific analysis features. Where enabled, a defined subset of architecture and alert data relevant to the specific query is transmitted to that provider strictly to generate the requested output, under that provider's data processing terms. This is opt-in, configured per deployment, and detailed in the customer's Data Processing Agreement — not in effect by default.

8. Retention

Business contact and commercial relationship data is retained for the duration of the relationship and for a reasonable period thereafter for legal, accounting, and audit purposes. Retention of Customer Data within a deployed Cybrex instance is governed by the applicable Data Processing Agreement and Customer's own configuration.

9. Security

We apply reasonable technical and organisational measures to protect personal data we hold, including encryption of data in transit, access controls, and restricted internal access on a need-to-know basis. Security commitments specific to a deployed Cybrex instance (encryption at rest, RBAC, audit logging, and similar) are set out in the Data Processing Agreement and product Documentation.

10. Your Rights

Subject to the PDPA and applicable law, you may request access to, correction of, or deletion of the business contact data we hold about you, and may withdraw consent to further communications at any time. Contact our Data Protection Officer using the details in Section 13. If you are dissatisfied with our handling of a request, you may lodge a complaint with the PDPC at www.pdpc.gov.sg.

11. Data Processing Agreement

Enterprise customers receive a Data Processing Agreement as part of their Order Form, covering the processing of Customer Data within their deployed Cybrex instance in full detail — including subprocessors, security commitments, audit rights, breach notification timelines, and data return or deletion on termination. This is negotiated and executed per customer rather than published generically on this website. Contact legal@reflextion.ai to request a copy ahead of an evaluation or Order Form.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. The updated Policy will be posted on this page with a revised effective date.

13. Contact — Data Protection Officer

Data Protection Officer
Reflextion Ventures Pte Ltd
3 Coleman Street #03-40, Singapore 179804
Email: privacy@reflextion.ai