Privacy Policy

1. Who we are

Savin Labs Pte. Ltd. is a company registered in Singapore ("Savin Labs", "we", "us"). We build and run booking and operations software for tour companies. We are the controller of the personal data described in this policy, unless a section says otherwise.

For any privacy question or request, write to ivan@savinlabs.com.

2. This website (savinlabs.com)

Contact form. When you send the form we receive your name, email address, company, country, the topic you chose and your message. We use these details only to reply to you and to continue the conversation you started. The message is delivered to our own mailbox; we do not add you to a mailing list.

While you type, the form keeps a copy of your entries in your browser tab (session storage) so they are not lost if the page reloads after an error. It is cleared when the message is sent or the tab is closed, and it never leaves your device on its own.

Server logs. Like any web server, ours records technical data for each request: IP address, date and time, requested address, browser user agent and response status. We use logs only to keep the site secure, stop abuse and fix errors. The contact form logs only the outcome of a submission, never the message text.

No tracking. The marketing site does not set cookies and does not use analytics, advertising or social media trackers.

3. The client portal (app.savinlabs.com)

Portal accounts are created by invitation for our business clients, or when a business signs up on the portal for the hosted plan. To run the portal we process:

account data: name, email address, password (stored only as a one-way hash) and sign-in activity;
sign-up details when you start a trial: your name, email address, company, country, the site address you chose, and the IP address and browser used to sign up (to prevent abuse);
company billing details: legal name, address, tax or registration identifiers and billing contacts;
invoices, plans, payment status and receipts;
support and service emails we exchange with you.

Payments by card or bank transfer are processed by Airwallex. Card details are entered with Airwallex and we never see or store full card numbers; we receive only the payment result and reference details such as the amount and status.

The portal uses only the cookies needed to keep you signed in and to protect forms against forged requests.

4. Booking engine licences and hosted sites

Our booking engine, Sava, runs on a client's own server or, on the hosted plan, on ours. To issue and check licences and deliver updates, a licensed site contacts our licence server and sends the site address, the licence key and status, and the installed software versions. Our server logs these requests, including the IP address of the site's server.

Bookings, guests and other data that tour operators manage in the engine belong to the operator. For that data the tour operator is the controller and is responsible for its own privacy policy towards its guests. On the hosted plan we keep that data on our servers in the region nearest to the operator (Singapore, Frankfurt or Northern Virginia, USA) and back it up daily to Amazon S3 in Singapore; there, and whenever we provide support or managed services, we handle it only on the operator's instructions.

5. Google Calendar

The booking engine can add tour bookings to a guide's Google Calendar. This connection is optional and is switched on only when a tour operator or one of its guides connects a Google account in the booking engine.

What we receive. When you connect, Google asks for your consent and then gives Savin Labs an OAuth authorization with these scopes:

openid and email — to identify which Google account is connected and show it to you in the booking engine;
https://www.googleapis.com/auth/calendar.events — to create, update and delete calendar events.

What we store. We store the email address of the connected Google account and an encrypted refresh token on our servers. We do not store your Google password and never see it.

How we use it. We use this access only to create, update and delete the calendar events for that guide's tour bookings on the operator's site, in the calendar the user chose. An event contains the tour name, the date and time, the number of guests and the meeting point. We do not read your other events beyond what the Google Calendar API needs to update the events we created.

What we never do. We do not use Google user data for advertising, do not sell it, do not transfer it to anyone except as needed to provide this feature, and do not use it to develop, improve or train artificial intelligence or machine learning models. People at Savin Labs do not read this data except with your permission, when needed for security or to investigate abuse, or where the law requires it.

Who else gets access. To update the calendar, short-lived access tokens (valid for up to one hour) are passed only to that operator's licensed site. Refresh tokens never leave our servers.

Disconnecting. You can disconnect at any time in the booking engine, or remove Savin Labs' access in your Google account at https://myaccount.google.com/permissions. When you disconnect in the booking engine we revoke the token with Google and delete it and the stored account email from our servers. If you remove access in your Google account, the token stops working and we delete it when we detect this. Events already created stay in your calendar until you delete them.

Savin Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Why we may use your data

We process personal data to provide the services you or your company asked for and to perform our agreements; to reply to enquiries you send us; with your consent, such as when you connect a Google account; to meet legal duties, such as keeping accounting records; and for our legitimate interest in keeping our services secure and working. We do not use personal data for automated decisions that have legal or similarly significant effects on you.

8. How long we keep data

contact form messages and emails: for as long as the conversation and any resulting business relationship need them;
server logs: only as long as needed for security and troubleshooting, then deleted on a rolling basis;
portal accounts: while the account is active; invoices and payment records: for the period required by Singapore accounting and tax law (currently at least five years);
licence records: while the licence is active and for a reasonable period after it ends;
hosted sites: while the plan or the trial is active and for 30 days after it ends; backups of the last 7 days and of the last 4 weeks, and the last backup of a deleted site for one year;
Google Calendar connection: until you disconnect it or the operator's licence ends, after which the token is revoked and deleted.

Backups follow the same rules and expire on a rolling schedule.

9. Security

We use HTTPS for all our services, encrypt Google refresh tokens at rest, store passwords only as one-way hashes, limit access to people who need it and keep backups. No system is completely secure; if a breach affects your personal data we will tell you and the authorities where the law requires it.

10. International transfers

Our main servers are in Singapore; hosted client sites may run in Frankfurt or Northern Virginia, USA, and are backed up in Singapore. Our clients and their guides are often in other countries, and our providers (for example Google and Airwallex) may process data in other countries. When data leaves your country, we rely on contracts with our providers and on their safeguards to protect it to a standard comparable to this policy and to Singapore's Personal Data Protection Act 2012.

11. Your rights

You can ask us to give you access to the personal data we hold about you, to correct it, to delete it, or to stop using it where you gave consent. Email ivan@savinlabs.com from the address connected to your data. We will reply within 30 days and may need to confirm your identity. We may keep data that the law requires us to retain.

If you are a guest of a tour operator that uses our booking engine, please contact that operator first; we will help them respond.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Commission of Singapore or to the data protection authority where you live.

12. Children

Our services are for businesses and are not directed to children. We do not knowingly collect personal data from children under 18. If you believe a child has sent us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as our services change. We will publish the new version on this page with a new effective date and, if the change is significant, tell our clients by email before it applies.

14. Contact

Savin Labs Pte. Ltd., Singapore — ivan@savinlabs.com.