Effective Date: 10 September 2026
This Policy explains how UNPROMPTED PTE. LTD. ("UNPROMPTED", "we", "us") processes personal information through Wellknown, our websites, platform, APIs, Model Context Protocol (MCP) connections and other interfaces we provide (the "Service"). The Service is for business customers and their authorized users.
We act as controller for account administration, billing, business communications and our own security and website operations. For personal information in customer project content, we act as processor, subprocessor or data intermediary under the customer's instructions and our Data Processing Addendum (DPA). That content may concern users or other individuals.
We use personal information to provide and maintain the Service, administer accounts and payments, communicate and provide support, analyze usage and improve functionality, protect security, prevent misuse and comply with law. Customer content is processed under the DPA and customer instructions; these purposes do not authorize using it to train general AI models or improve services for other customers.
We use infrastructure, AI, large language model (LLM), search and other providers to deliver the Service. Providers we engage to process customer content must be contractually prohibited from using it to train their AI models, as set out in the DPA. Our Subprocessor List describes these providers.
Customers may authorize support personnel to access workspaces for onboarding, troubleshooting or support. Access is limited to authorized personnel and treated as confidential under the DPA.
When customers connect their own AI assistants or other services, authorized requests may send information to and from those services. Those separately contracted providers process received information under the customer's arrangements with them. Disconnecting a connection prevents future authorized access but does not delete copies already transferred.
We may disclose personal information at your or the customer's direction; to the relevant business customer and its authorized users; to providers supporting the Service; in connection with a merger, acquisition or business transfer; or where necessary to comply with law, enforce our terms or protect rights and security. Disclosures of customer content remain subject to the DPA. We do not sell personal information.
We retain personal information for as long as needed for its purpose, taking account of account activity, support needs, legal retention requirements and the establishment or defense of legal claims. Customer content is returned or deleted under DPA Section 3.4, including its provisions for backups and legally required retention.
We use appropriate technical and organizational safeguards, including encryption, access controls and risk-based security assessments. No method of transmission or storage is completely secure.
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing of your personal information, receive a portable copy, withdraw consent and complain to the relevant data protection authority. Withdrawal does not affect the lawfulness of earlier processing. These rights are subject to applicable legal conditions and exceptions and may apply to personal information in uploaded content and AI outputs.
For customer-controlled content, contact the relevant customer's privacy representative; we assist that customer as required by law. For processing we control, contact us directly using Section 10. We may request information needed to verify identity and respond within applicable legal time limits.
You may opt out of direct marketing using the message's unsubscribe option or by contacting us. Where required, we obtain consent for non-essential cookies or similar technologies; available browser or consent controls let you manage them.
Customers are responsible for lawful instructions, necessary notices, permissions and legal bases for information they submit or authorize the Service to access, including information about clients and other individuals. Customers manage user and integration permissions, respond to rights requests concerning their processing and act as the primary contact for affected individuals. This does not limit our own legal obligations.
We comply with data protection laws applicable to the processing, including the Singapore PDPA and, where applicable, the GDPR and UK GDPR. Where a legal basis is required for processing we control, we rely on legitimate interests in administering and improving our business, supporting customers and securing the Service; performance of a contract with the individual concerned; legal obligations; or consent where required. We balance legitimate interests against individuals' rights. Customers determine the legal bases for processing under their instructions.
Information may be processed in Singapore and other countries where we or our providers operate. Where required, we use recognized transfer safeguards, such as Standard Contractual Clauses and the UK Addendum, or applicable adequacy arrangements. Customers' agreed residency restrictions remain binding. You may contact us for information about applicable safeguards or a copy, subject to lawful redactions.
We may update this Policy by posting the revised version and effective date on this page. We provide additional notice or obtain consent where required by law.
For privacy questions or requests, contact UNPROMPTED's data protection contact at dpo@unprompted.app. For customer-controlled information, the relevant customer's privacy representative is normally your first contact.
Designed for consulting firms