← VerityOS

Privacy Notice

Last updated 4 July 2026 · VerityOS is a product of Freemansland Creatives Pte. Ltd. (Singapore)

This notice explains how we collect, use, disclose, and protect personal data when you use the VerityOS website and platform. It is written to be honest and readable, and it reflects our obligations under Singapore’s Personal Data Protection Act 2012 (No. 26 of 2012) (the “PDPA”).

Who we are

VerityOS is built and operated by Freemansland Creatives Pte. Ltd. (UEN 202610025H), a company incorporated in Singapore (“Freemansland”, “we”, “us”). VerityOS is one of its products, and this notice is consistent with the Freemansland group’s data protection policy, adapted for VerityOS.

VerityOS helps companies and sustainability consultants produce climate reports (ISSB / IFRS S2) from their own compliance documents — utility bills, invoices, and emission figures.

What personal data we collect

Through the website and our contact and demo forms, we collect:

• Contact details you give us— your name, work email, company, and the service you’re interested in.
• Technical data collected automatically via server logs and cookies — your IP address, browser type, the pages you visit, the referring URL, and the time of your visit.

When you use the VerityOS platform, we also handle:

• Documents you upload — utility bills, invoices, and similar evidence. These may contain some personal data (for example, a name or address on a bill).
• The figures we extract from those documents (energy used, emissions, periods).
• Your account details — your email, your role, and which organisation you belong to. Passwords are stored hashed by our authentication provider; we never see them in plain text.
• Audit-trail activity — who approved a figure, who locked a reporting period, and when. This record is what makes your reports assurable.

We collect only what we need to respond to you and to produce and defend your reports. We do not collect sensitive data such as NRIC/FIN numbers, financial-account credentials, or health information through this website.

How we use your data

• To respond to your enquiries and run demos you request.
• To provide, secure, and support the VerityOS platform.
• To produce your climate reports and keep them assurable.
• To meet our legal, audit, and record-keeping obligations.
• To improve the website and platform, and to keep it secure (for example, using server logs to detect abuse).

Who processes your data on our behalf (sub-processors)

We use a small number of trusted, certified service providers to run VerityOS, in these categories:

• Managed database, authentication, and file storage — SOC 2 Type II certified; hosted in the Singapore region on AWS-backed infrastructure.
• Website and application hosting — a certified serverless cloud platform.
• Transactional and notification email — a managed email delivery provider.
• AI document processing — Anthropic, named plainly below because your data leaves Singapore for that step.

The fully named sub-processor register is provided with every Data Processing Agreement and is available on request.

How your documents are processed by AI

To read your uploaded documents and draft report text, VerityOS sends the document content and extracted text to our AI provider, Anthropic. We tell you this plainly because your data leaves our Singapore environment for that step.

• The AI provider does not use your data to train its models.
• A named person on your side reviews and approves every extracted figure — the AI does not finalise anything on its own.
• We do not currently guarantee zero-retention at the AI provider; if we enable a stricter no-retention setting in future, we will update this notice.

If your organisation cannot allow document content to be processed by a third-party AI provider, please tell us before you start.

Where your data lives

Your data is stored in Singapore(our database, login, and file storage are hosted in the Singapore region). Your files are kept in a private store that only your organisation can reach. Data is encrypted in transit (HTTPS/TLS) and at rest. Where personal data is transferred outside Singapore (for example, to the AI provider for the processing step above), we take steps to ensure a comparable standard of protection, consistent with the PDPA’s transfer requirements.

Who can see your data

• Only members of your organisation can see your organisation’s data.
• A consultant can see your data only while you have an active engagement with them — and only until you revoke it.
• We do not sell, rent, or trade your personal data, and we do not use it for advertising.

How long we keep it

• Contact and enquiry data — kept for 5 years from your last interaction with us, or until you withdraw consent, whichever is earlier.
• Server logs — kept for 90 days.
• VerityOS report and vault data — kept for the length of your engagement plus 7 years, so your reports stay defensible for audit and assurance, unless you ask us to delete it sooner.

Your rights under the PDPA

Under the PDPA (2012, No. 26 of 2012) you have the right to:

• Access the personal data we hold about you and how it has been used or disclosed.
• Correct any personal data that is inaccurate. (To correct an emission figure, we use a reversal-and-replace step inside the platform so the audit trail stays intact.)
• Data portability, where applicable, to have relevant data transmitted to another organisation in a commonly used format.
• Deletion— you can ask us to delete your organisation’s data at any time. We will remove your documents, figures, reports, and related records, and confirm this to you in writing. (Copies in encrypted backups age out on their normal cycle.)
• Withdraw consent for the collection, use, or disclosure of your personal data.

We aim to respond to any PDPA request within 30 days.

Cookies

We use essential cookies to make the site work and analytics cookies to understand how it is used. You can disable cookies through your browser settings; some parts of the site may not work as well if you do.

Do Not Call

We comply with the Do Not Call (DNC) provisions of the PDPA. We will not send you marketing messages to a Singapore telephone number registered on the DNC Registry without the consent the law requires.

Data breaches

We maintain safeguards to protect personal data. Consistent with the PDPA’s Data Breach Notification obligations (introduced by the 2020 amendments and in force from 2021), if a data breach occurs that is likely to result in significant harm to affected individuals, or affects 500 or more individuals, we will notify the Personal Data Protection Commission (PDPC) and the affected individuals as required by law and without undue delay.

Contact — Data Protection Officer

For any privacy question or request — access, correction, portability, deletion, or withdrawal of consent — contact Freemansland Creatives’s Data Protection Officer at privacy@freemanslandcollective.com, or use the contact form on this site.

If we cannot resolve your concern, you may escalate it to the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

This notice may be updated from time to time; the “last updated” date above reflects the current version. If it conflicts with your signed agreement or our full Data Protection Policy, those documents govern.