PRIVACY POLICY

01 // SYS.SCOPE

Who we are and what this covers

This Privacy Policy explains how Obscura Vertex Pte. Ltd. ("Obscura Vertex", "we", "us" or "our") handles personal data. We are a private limited company incorporated in Singapore (UEN 202622039R), with our registered address at 68 Circular Road, #02-01, Singapore 049422. We are an independent software and AI product studio. We build and operate our own apps and AI products, and we take on a few select client and partner projects.

This policy covers our website at https://www.obscuravertex.com and any correspondence you have with us, for example when you email us directly or use the contact form on the site to compose an email to us. Your use of the website is also governed by our Terms of Service at https://www.obscuravertex.com/terms.

It does not cover our products. Nafs, our first live product, is an iOS and Android app with its own privacy policy at https://www.getnafs.com/privacy/, and that policy governs how Nafs handles your data. Other products we release may publish their own privacy policies, and where they do, those policies apply. Client and partner projects are governed by separate written agreements.

We handle personal data in line with Singapore's Personal Data Protection Act 2012 (the "PDPA"). This policy is effective from 29 September 2026.

02 // TLDR

Key points

• This site uses no cookies, analytics, trackers or third-party scripts, and it has no accounts or logins.
• Our host, Vercel, processes standard technical data such as your IP address to deliver and secure the site. We do not use it to identify, profile or track you.
• The contact form does not send anything to us. It opens a pre-filled email in your own mail app, and nothing reaches us unless you press send.
• If you email us, we use what you send to reply to you and to handle your enquiry.
• Nafs, our app, has its own privacy policy at https://www.getnafs.com/privacy/.
• You can ask to access or correct your data, ask us to delete your correspondence, or withdraw your consent, by emailing signal@obscuravertex.com.

The rest of this policy gives the details.

03 // DATA.IN

What we collect

We collect very little, and only in two situations.

When you visit the site, our hosting provider, Vercel Inc., processes standard technical request data each time your browser loads a page or file from the site. This includes your IP address, your browser type and user agent, the URL requested, the date and time of the request, and the referring page. Vercel needs this to deliver the site to you and keep it secure. We do not use this data to identify, profile or track visitors.

When you contact us, whether directly by email or through the contact form, we receive whatever you choose to include. That usually means:

• Your name or a callsign (the ident field). You do not have to use your real name.
• Any reply-to details you give us, such as an email address, Telegram handle or phone number.
• Your message (the payload field) and anything else you write or attach.
• Your email address and the information your email service adds to the message, such as the sender name set in your mail app.

We also keep our replies and the rest of the conversation with you.

04 // DATA.NULL

What we do not collect

The site is built to collect as little as possible. It has:

• No cookies.
• No localStorage, sessionStorage or similar browser storage.
• No analytics of any kind on this website.
• No advertising or tracking pixels.
• No third-party scripts, fonts or embeds. Our fonts, images and 3D models are served from our own site.
• No user accounts or logins, no payments, no comments and no newsletter.

Because we do not use cookies, there are no cookie settings to manage for this site.

The JavaScript on the site renders the 3D scene and composes emails. It does not send what you type, or any other information about you, to us or to anyone else. Your browser does request the site's own files (such as images and 3D models) from our host, and those requests produce the standard technical request data described above.

05 // FORM.TRANSMIT

How the contact form works

The contact form does not submit anything to a server. It has three fields: ident (your name or a callsign, required), reply-to (an email address, Telegram handle or phone number, optional) and payload (your brief, required).

When you press TRANSMIT, the site composes a pre-filled email in your own mail app, addressed to signal@obscuravertex.com. Nothing is sent to us at that point. You can review, edit or discard the draft, and it only reaches us if you press send in your mail app.

The draft email puts your ident in the subject line and lists what you entered in the body, followed by a note that it was sent via our site. If you leave the reply-to field empty, the draft asks us to reply to the email address you send it from.

The status messages shown after you press TRANSMIT are decorative. The site does not encrypt your message. Once you press send, it travels as a normal email through your own email provider, which handles it under its own privacy policy, and arrives in our mailbox. From then on, we handle it as described in this policy.

You can also skip the form and email signal@obscuravertex.com directly. If pressing TRANSMIT does nothing, your device may not have a default mail app set up, and emailing us directly is the simplest option.

06 // USE.CONSENT

Why we use your data, and your consent

We use personal data only for purposes that a reasonable person would consider appropriate in the circumstances, and that we have told you about. These are:

• To read and reply to your message, using the contact details you gave us.
• To discuss and assess possible projects, partnerships or other work you raise with us.
• To keep a record of our correspondence with you.
• To deliver the website and keep it secure (this is what our host's technical request data is used for).
• To comply with the law, respond to lawful requests from authorities, and protect our legal rights.

We do not have a newsletter or mailing list, and we do not use your personal data for advertising.

When you email us, whether directly or through the form, you choose to give us your details so that we can respond. Under the PDPA, this means you are deemed to consent to us collecting and using them for that purpose, and to us disclosing them to the service providers described below so that we can do so. If we want to use your data for a purpose you have not agreed to, we will tell you and ask for your consent first, unless the PDPA allows us to proceed without it.

When you visit the site, your browser has to send technical request data to our host for the pages to load at all. By using the site, you are deemed to consent to that data being processed to deliver the site and keep it secure. Because the site cannot be delivered without it, the only way to withdraw this consent is to stop using the site.

In limited cases, the PDPA permits collection, use or disclosure of personal data without consent, for example where it is required or authorised by law. We rely on these exceptions only where they genuinely apply.

If your message includes personal data about someone else, such as a colleague, please make sure you are entitled to share it with us for the purposes in this policy and that they are aware you are doing so.

If you contact us on behalf of an organisation, contact details you give us for business purposes (such as your work email address) are business contact information. Most of the PDPA's data protection obligations do not apply to business contact information, but we still handle it with the same care described in this policy.

07 // DATA.OUT

Who processes your data, and where

We use a small number of service providers, who process personal data to provide their services to us:

• Vercel Inc. (United States) hosts the website on its global edge network and processes the technical request data described above to deliver and secure the site.
• Proton AG (Switzerland) provides our email service, Proton Mail. Emails you send us, and our replies, are stored with Proton.

Your own email provider also handles any email you send us, under its own terms. If you give us a Telegram handle or phone number and we reply there, Telegram or the phone or messaging service used for that reply will also process the messages, under its own policies.

We may also disclose personal data:

• To our professional advisers, such as lawyers or accountants, where needed for the purposes in this policy.
• To a buyer or successor if our business or its assets are sold or transferred, to the extent the PDPA permits.
• Where the law requires or permits it, for example to comply with a court order or a lawful request from a public authority.

Apart from the cases described in this policy, we do not share your personal data with anyone.

Because our providers are based or operate outside Singapore, your personal data may be transferred to and processed in other countries, including the United States (Vercel), Switzerland (Proton) and the locations from which Vercel's edge network serves the site.

When we transfer personal data outside Singapore, we take the steps the PDPA requires to make sure it is protected to a standard comparable to the PDPA. If you would like more information about this, contact us at signal@obscuravertex.com.

08 // RETENTION

How long we keep it

We keep personal data only for as long as it serves the purpose we collected it for, or as long as we need it for legal or business reasons, such as keeping records of our dealings or resolving a dispute. When we no longer need it, we delete it or anonymise it so that it can no longer be linked to you.

For example, we may keep correspondence while we are discussing your enquiry or working with you, and for a reasonable period afterwards for our records.

You can ask us to delete your correspondence at any time. We will do so unless we need to keep it for a legal reason or an ongoing matter between us, and if that is the case we will tell you why.

Technical request data is processed and kept by Vercel, as our host, under its terms with us and its own policies. We do not use it to identify, profile or track visitors.

09 // SECURITY

How we keep it safe

We make reasonable security arrangements, as the PDPA requires, to protect the personal data we hold against unauthorised access, collection, use, disclosure, copying, modification or disposal, and against the loss of any device or storage medium on which it is stored.

Our main safeguard is the way the site is built. It does not collect data through accounts, forms that submit to a server, cookies or third-party scripts, so there is very little personal data on the site to protect. The personal data we do hold is mostly email correspondence, which is kept with our email provider, Proton Mail.

No website, email service or method of storage is completely secure, so we cannot guarantee absolute security. Email in particular is not a good channel for sensitive information. Please do not send us identity card or passport numbers, financial details, health information or similar sensitive data unless we have agreed a suitable way to do so.

10 // USER.RIGHTS

Your rights and how to use them

Under the PDPA, you can:

• Access: ask us for the personal data about you that we hold or control, and for information about how it has been or may have been used or disclosed in the year before your request.
• Correct: ask us to correct an error or omission in your personal data.
• Withdraw consent: tell us at any time, with reasonable notice, that you no longer consent to us collecting, using or disclosing your personal data for a particular purpose.

You can also ask us to delete your correspondence at any time, as explained in the section on how long we keep it.

If you withdraw consent, we will tell you the likely consequences, and then we (and anyone processing the data on our behalf) will stop collecting, using or disclosing your personal data for that purpose. This may mean we can no longer reply to your enquiry or continue a discussion with you. Withdrawal does not affect anything we did before it, and it does not stop us keeping or using data where the law requires or allows us to do so without consent.

To make a request, email signal@obscuravertex.com, addressed to our Data Protection Officer, and tell us what you are asking for. We may need to verify your identity before we act, so that we do not disclose your data to someone else.

We will respond to access and correction requests as soon as reasonably possible, generally within 30 days. If we need longer, we will tell you within that time when we expect to be able to respond. If we cannot fulfil a request, for example because an exception under the PDPA applies, we will tell you why, unless the law prevents us from doing so.

When we correct your personal data, we will also send the corrected data to any organisation we disclosed it to in the year before the correction, unless that organisation does not need it for any legal or business purpose.

We do not charge for correction requests or for withdrawing consent. For an access request, the PDPA allows us to charge a reasonable fee to cover the incremental cost of responding. If we plan to charge one, we will give you a written estimate first, and we will not charge more than that estimate without telling you beforehand.

We make a reasonable effort to keep the personal data we hold accurate and complete. Because it mostly comes from you, please make sure the contact details you give us are correct, so that our reply reaches you, and tell us if they change. We will update our records when you do.

11 // BREACH.PROTOCOL

If there is a data breach

If we have reason to believe that a data breach involving personal data we hold has occurred, we will act promptly to contain it, and we will assess, reasonably and without delay, whether it must be notified under the PDPA.

If a breach is likely to result in significant harm to the people affected, or affects 500 or more people, we will notify the Personal Data Protection Commission (PDPC) as soon as practicable, and in any case no later than 3 calendar days after we assess that the breach is notifiable. Where a breach is likely to result in significant harm to you, we will also notify you, unless an exception under the PDPA applies, and tell you what happened and what you can do to protect yourself.

If a breach affects one of our service providers, we will work with them to assess it and respond.

12 // MINORS

Children

The site is about our studio and our work. It is not directed at children, and we do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has sent us personal data, contact us and we will delete it.

13 // EXT.LINKS

Links to other sites

The site links to other websites, including the Apple App Store and Google Play (where Nafs is available) and https://www.getnafs.com.

When you follow one of these links, you leave our site and this policy no longer applies. The App Store and Google Play are operated by Apple and Google under their own privacy policies. Nafs has its own privacy policy at https://www.getnafs.com/privacy/. Please read the privacy policy of any site you visit.

14 // CHANGELOG

Changes to this policy

We may update this policy from time to time, for example if we change how the site works, add a service provider, or the law changes. When we do, we will post the new version on this page and update its effective date.

If a change materially affects how we handle personal data you have already given us, we will take reasonable steps to let you know, such as by email if we are in contact with you. Where the PDPA requires your consent for a new purpose, we will ask for it before using your data for that purpose.

This version is effective from 29 September 2026.

15 // CONTACT.DPO

Contact us and complaints

For any question, request or complaint about this policy or your personal data, contact our Data Protection Officer. As the PDPA requires, we make these contact details publicly available.

• Data Protection Officer, Obscura Vertex Pte. Ltd.
• Email: signal@obscuravertex.com
• Address: 68 Circular Road, #02-01, Singapore 049422
• UEN: 202622039R

The same email address works for general enquiries too.

We will do our best to resolve any concern you raise. If you are not satisfied with our response, you can complain to the Personal Data Protection Commission (PDPC) of Singapore at https://www.pdpc.gov.sg.