Octling Privacy Policy

Effective: October 22, 2026 · Last updated: October 22, 2026

This policy explains what personal data Octling (“we”, “us”) collects when you use the Octling website, workspace, agent software and related services (the “Service”), why we collect it, how we use and share it, where it is stored, how long we keep it, and the rights you have. It forms part of our Terms of Service. We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA) and other laws that apply to us.

1. What we collect
2. How we use it
3. Service providers and disclosure
4. Where data is stored
5. How long we keep it
6. Security
7. Your rights
8. Cookies and local storage
9. Organization accounts
10. Children
11. Changes to this policy
12. Contact

1. What we collect

We only collect what we need to provide the Service.

Account information

• Email address, name and password (stored only as a salted hash; we never see the plain text);
• If you log in with Google: your Google account ID, email address and name as provided by Google;
• Language and time zone preferences, the IP address you signed up from, and referral relationships (whose invite link you used);
• For organization accounts: the organization name, its members and their roles.

Content you provide or generate

• Your conversations with the AI, your instructions, and the AI's replies and plans;
• Files and images you upload to the library or to conversations;
• Prompts, memories, device notes, scheduled tasks and self-service tasks you save;
• Webhooks, notification channels and MCP servers you configure;
• Model endpoints and API keys you add yourself (API keys are stored encrypted).

Device and execution data

On devices where you install the agent, we collect:

• Hostname, operating system, architecture, agent version, system account names and a machine identifier;
• Online status, the IP address the device connects from, and CPU, memory and disk usage collected during inspections;
• Commands run on the device, their output and exit status, screenshots taken by the AI, and files transferred;
• Audit records of command approvals and execution.

Command output and screenshots can contain anything on the device, including file contents, other people's personal data or credentials. Only let the AI handle what the task needs, and get consent before working on someone else's device.

Payment information

Online payments are handled by PayPal. We never see or store your card number or PayPal password. We store subscription and transaction IDs, plan, amount, currency, payment time and status, which we use to show your billing history and issue invoices.

Usage and log data

• Access logs: IP address, browser type, time of access, pages and API endpoints requested;
• Usage and billing records: models used, token counts, credit changes;
• Error and operational logs used for troubleshooting.

We do not use advertising trackers or third-party analytics.

2. How we use it

• To provide the Service: creating and managing your account, processing your instructions, running commands on your devices, storing sessions and files, sending notifications;
• For security: sign-in, email verification codes, bot protection, and detecting unusual sign-ins and abuse such as bulk sign-ups or referral fraud;
• For billing: measuring usage, deducting credits, handling subscriptions and invoices;
• To choose a language: using the country of your IP address to decide whether the website shows Chinese or English by default;
• To improve the Service and fix problems: diagnosing failures and improving performance;
• To communicate with you: verification codes, invoices, service changes and security notices (no marketing email unless you opt in);
• To comply with law: meeting legal obligations and responding to lawful requests from authorities.

We do not sell your personal data, and we do not use your content to train our own models. If we want to use data for a purpose not described here, we will ask for your consent first.

3. Service providers and disclosure

We use the following kinds of service providers to run the Service. They receive only what they need for their function and are required to protect it.

Platform-provided models are processed by providers we configure. For models you add yourself, content is sent directly to the endpoint you specify and handled under that provider's policies. Model providers may be located in different countries, and whether they retain or use data depends on their own policies.

Apart from the providers above, we only share or disclose your data:

• when you direct us to, for example through webhooks, notification channels and MCP servers you configure, or files you send to other devices;
• to admins of your organization, within their permissions (see Section 9);
• when required by law or by a lawful request from authorities;
• when necessary to protect the safety, rights or property of you, other users, us or the public;
• in a merger, acquisition or asset transfer, where the recipient remains bound by this policy or asks for your consent again.

4. Where data is stored

Our servers and object storage are located in Singapore. When the Service calls an AI model, the relevant content is also transferred to the country where that model provider operates. Where we transfer personal data outside Singapore, we take steps to ensure it receives a standard of protection comparable to the PDPA, including contractual commitments from our providers.

5. How long we keep it

• Account information and your content: for as long as your account exists. When you delete sessions, files or other content, we stop using and delete it. Files deleted from the library go to the trash first and are permanently deleted after 30 days;
• Audit records: for as long as the account (or organization) exists, so that operations on devices can be traced;
• Access and operational logs: generally no more than 6 months;
• Transaction and invoice records: as long as accounting and tax laws require;
• When you close your account, the content in your personal workspace is deleted immediately and your account information is anonymized. Content you created in an organization stays with that organization (see Section 9). Transaction and invoice records are kept as the law requires but are no longer linked to your email. Data in backups is removed within 30 days as backups rotate.

6. Security

• All traffic between the website, the agent and our servers is encrypted with TLS;
• Passwords are hashed, and API keys you add are stored encrypted;
• Agent tokens are bound to the device, so they cannot be reused on another machine;
• Data is isolated by account and organization, and internal access is strictly limited;
• Command approvals, high-risk command blocking and full audit logging.

No system on the internet is perfectly secure. If a data breach occurs, we will act immediately to contain it and notify you and the relevant authorities as the law requires.

7. Your rights

• Access: you can view your profile, sessions, files, devices and invoices in the workspace, and ask us for a copy of other personal data we hold about you;
• Correction: you can change your name, password, language and time zone in settings, or ask us to correct other data;
• Deletion: you can delete sessions, files, memories, devices and other content yourself, and ask us to delete your personal data;
• Withdrawing consent: you can stop using a feature at any time, for example by uninstalling the agent or removing a model or webhook you added. Withdrawal does not affect processing that happened before it, and some features may stop working;
• Closing your account: delete it yourself in Settings → Account security; it takes effect immediately after you confirm with your current password or an email code. If you can’t do it there, email [email protected]. Once closed, your content and any unused credits or subscription entitlements cannot be recovered;
• Complaints: you can contact us first, and you also have the right to complain to the Personal Data Protection Commission of Singapore or your local data protection authority.

We may need to verify your identity before acting on a request. We reply within 15 business days.

8. Cookies and local storage

We only use cookies and browser storage that the Service needs to work:

• A sign-in cookie that keeps you logged in and cannot be read by page scripts;
• A temporary cookie during Google sign-in that prevents forged sign-in requests and expires right after;
• A language cookie that remembers which language the website shows;
• Browser local storage for interface preferences such as language, sidebar state and unsent drafts.

We do not use advertising or cross-site tracking cookies. You can clear them in your browser; clearing the sign-in cookie will log you out.

9. Organization accounts

If you use the Service through an organization, the organization controls the data you create within it: its admins can view and manage members, devices, sessions, audit records and billing within the organization, and may remove you from it. The organization's handling of that data is governed by its own policies; please contact your organization's admin first with questions about it.

10. Children

The Service is intended for adults and organizations and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We will publish the updated version on this page and change the “Last updated” date. For changes that materially affect your rights, such as new purposes or new categories of recipients, we will notify you in advance in the product or by email, and ask for consent again where required.

12. Contact

For questions, requests or complaints about this policy or your personal data, including requests to our data protection contact, email [email protected]. We reply within 15 business days.