Privacy policy
Last updated: 26 October 2026
This policy explains how Nine Scrolls Pte. Ltd. (Nine Scrolls Private Limited, UEN 202529756C, "Nine Scrolls", "we") collects, uses and protects personal data when you use our website and our services: ReplyMate (WhatsApp assistant), Wes (websites), Echo (social media posting and analytics) and Victoria (short videos), and our employment agency services. We follow Singapore's Personal Data Protection Act 2012 (PDPA).
Echo is also used by property agents on StyloProp (agents.styloprop.sg, also run by Nine Scrolls Private Limited): when an agent connects Instagram, a Facebook Page or YouTube on the StyloProp "Social accounts" page, Echo holds that connection and this policy applies to it.
In short
- We handle WhatsApp messages, and the Meta (Facebook, Instagram), TikTok and YouTube accounts you connect, only to run the services you pay us for.
- We post only what you approve, and read your posts' numbers (views, likes, reach) only to report them to you.
- We never sell your data or your customers' data.
- You can ask us to delete your data at any time: email [email protected] or use our data deletion page.
1. Who we are
Nine Scrolls Pte. Ltd., 48 Hillview Terrace, #02-06 Hillview Building, Singapore 669269. Data Protection Officer: [email protected].
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Your name, business name, phone, email, address | You, when you sign up or contact us | To set up and run your service, send quotes and invoices, and contact you |
| Invoices and payment records (amount, date, PayNow reference) | Our billing | Accounting and tax records. We do not receive your bank or card details. |
| WhatsApp messages between you and Nine Scrolls, including your APPROVE / REVISE replies | To get your approval before anything is posted, and to answer your requests | |
| Messages between ReplyMate and your customers, and the customer records it keeps for you | Your WhatsApp line | To run ReplyMate for you (see section 5) |
| TikTok account: TikTok user ID, display name, profile picture, list of your videos and their public counts (views, likes, comments, shares) | TikTok, after you sign in with TikTok and agree | To show you which account is connected, post the videos you approve, and report how they perform |
| Instagram professional account: Instagram user ID, username, account type, profile picture, your media and their counts | Instagram, after you sign in with Instagram and agree | Same as TikTok |
| Facebook Page you connect: Page ID, Page name, your Page's posts and their insights (reach, views, reactions, comments, shares, followers) | Meta, after you sign in with Facebook and agree | Same as TikTok |
| YouTube channel you connect: channel ID, channel name, your videos (title, length, date) and their counts (views, likes, comments) and YouTube Analytics numbers for them (views, watch time) | Google, after you sign in with Google and agree | To show you which channel is connected, upload the Shorts you approve, and report how they perform |
| Access tokens from TikTok, Meta (Facebook, Instagram) and Google (YouTube) | TikTok, Meta and Google | To post on your behalf and read your posts' numbers. Stored encrypted (AES-256-GCM). We never see or store your TikTok, Instagram, Facebook or Google password. |
| Videos, photos, captions and hashtags we make or you give us | You and our team | To make and post your content |
| Job candidates: name, contact details, CV, and identity and work pass documents (for example passport details) needed for an application | The candidate or the employer | To place candidates with employers and apply for Employment Passes and Work Permits with the Ministry of Manpower, which receives this data as part of the application |
| Website visits (IP address, browser, pages viewed) | Our hosting and network provider | Security and keeping the site working. We use no advertising cookies. |
3. How we use TikTok, Meta and YouTube data
- We only post content you have approved, to the account you connected.
- We read the numbers for your posts and account (analytics) only to show you how your content is doing and to plan better posts for you.
- We use the data only to provide the service to you. We do not sell it, rent it, use it for advertising, share it with other clients, or use it to train AI models.
- You can disconnect at any time (see our data deletion page). When you do, we delete the tokens at once.
- Our use of data from TikTok and Instagram also follows the TikTok Developer Terms and the Meta Platform Terms.
YouTube (YouTube API Services)
- Echo uses the YouTube API Services to upload the Shorts you approve to your channel and to read your videos' numbers. By connecting YouTube you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
- Echo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not let people read it except with your consent, for security or where the law requires it, and do not use it to train AI models.
- You can remove Echo's access at any time on your Google Account third-party connections page (or security.google.com/settings/security/permissions), or press Disconnect on your Social accounts page. We then delete the tokens at once, and the YouTube data we stored within 30 days.
- We refresh or delete stored YouTube numbers at least every 30 days.
4. Who we share data with
We share data only with service providers that help us run the services, and only what they need:
- TikTok, Meta (Facebook, Instagram, WhatsApp) and Google (YouTube): to post your content and send and receive messages.
- Anthropic (Claude) and OpenAI: to draft captions and ReplyMate replies. They process this text in the United States and do not use API data to train their models. They receive the video title and notes, never your access tokens.
- Cloudflare: website hosting and network security.
Our own systems run on our servers in Singapore. When data goes outside Singapore, we make sure it is protected to a standard comparable to the PDPA. We may also disclose data where the law requires it.
5. We do not sell your data
We do not sell, rent or trade personal data, yours or your customers', to anyone. We do not use it for advertising.
6. Data about your customers (ReplyMate)
When ReplyMate talks to your customers, you decide what it collects and why, and we process that data on your behalf. You are responsible for telling your customers that an AI assistant answers your WhatsApp and for having a lawful reason to keep their data. We keep it only to run ReplyMate for you and delete it when you ask or when your service ends.
7. Where and how we store data
Your data is kept in databases on our own servers in Singapore. TikTok, Meta and Google tokens are stored encrypted (AES-256-GCM). Each client's WhatsApp line, settings and records are kept separate from every other client's. Backups follow the same rules and are deleted on the same schedule.
8. How long we keep data
- TikTok, Meta and Google tokens: until you disconnect or your service ends, then deleted at once.
- Post and video numbers (views, likes, watch time): while the account is connected; deleted when you disconnect it.
- Videos, captions, messages and customer records: while your service runs, then deleted within 30 days after it ends, unless you ask us to delete them sooner.
- Invoices and payment records: 5 years, as required for Singapore tax and company records.
9. How we protect data
Tokens are encrypted. Access to our systems is limited to Nine Scrolls staff who need it, with separate logins. Salespeople only see their own clients. If a data breach is likely to harm you, we will tell you and the Personal Data Protection Commission as the PDPA requires.
10. How to ask for deletion
- Use the form on our data deletion page, or email [email protected] from the email address on your account and write "Delete my data".
- You can also remove our app at any time in your Facebook, Instagram, TikTok or Google Account settings. We then delete that account's tokens and the data we got from it.
- We confirm by email, give you a confirmation code, and finish the deletion within 30 days. Only invoices and payment records we must keep by law stay for 5 years.
- Your customers can ask you, or us directly, to delete their ReplyMate records.
11. Your rights under the PDPA
You can ask to see the personal data we hold about you, ask us to correct it, or withdraw your consent (which may mean we can no longer provide a service). Email our Data Protection Officer at [email protected]. We reply within 30 days.
12. Children
Our services are for businesses. They are not meant for anyone under 18.
13. Changes
We may update this policy. The date at the top shows the latest version. If a change is important, we will tell clients on WhatsApp or by email.