Privacy Policy
Last updated: October 11, 2026
This policy explains how Guni Innovations Pte. Ltd. (“Guni”, “we”, “us” or “our”) collects, uses, shares, keeps and protects personal data when you use gunix.io or work with us.
It is written to follow the laws that apply to us and our clients, including Singapore's Personal Data Protection Act 2012 (PDPA), the EU and UK GDPR where they apply, India's Digital Personal Data Protection Act, 2023 and California's CCPA as amended by the CPRA.
1. Who we are
Guni Innovations Pte. Ltd. (UEN 202302437E) is a privacy-focused AI engineering company. We operate gunix.io and build and run AI systems for our clients. We also make the products TamperCheck and OCRFire, which have their own sites and their own policies.
- Registered name: Guni Innovations Pte. Ltd.
- Registered address: 68 Circular Road #02-01, Singapore 049422
- Contact for privacy questions and requests: hello@gunix.io
2. Our role in processing personal data
Our role depends on the context.
- Controller. For the personal data we collect through this website, such as booking and contact forms and email, we decide why and how it is used, so we are the controller (or data fiduciary under India's DPDP Act).
- Processor. When we build or operate an AI system for a client, we process the client's documents and data on the client's instructions. The client remains the controller of that data, and our processing is governed by the written agreement for the engagement and, where required, a data processing agreement.
3. What we collect
| Category | Examples |
|---|---|
| Booking and contact forms | Name, work email, company, role and the description of your use case that you type in |
| Feedback form | Your message and any contact details you choose to include |
| Email and calls | The content of messages you send us and details you share on scoping calls |
| Abuse protection | Your IP address, used in memory to limit how often a form can be submitted. It is not written to our logs or stored with your submission |
| Website analytics | Aggregate, cookie-free usage events, only if our analytics script is enabled. It does not track individuals |
We do not run advertising or cross-site tracking, and this website does not set advertising cookies.
4. How we use personal data
- To reply to your enquiry and to arrange a demo or scoping call.
- To respond to feedback and support requests.
- To protect the website and our forms from abuse.
- To keep records we are legally required to keep.
- To understand how the website is used, in aggregate, if analytics is enabled.
We do not use form submissions, client documents or system data to train AI models, and we do not sell personal data.
5. Client documents and AI systems
Where we build or operate an AI system for you, we deploy it into your own cloud or onto your own servers, on-premise if you require it. We process your documents only to do the job you hired the system to do.
We never use your documents or system data to train models. When an engagement ends, you receive a documented handover and a full export of your data.
How each of our products handles files, including where processing happens, is described on its product page and on the product's own site.
6. Legal bases
Where the GDPR, UK GDPR or Singapore's PDPA applies, we rely on the following.
| Activity | Basis |
|---|---|
| Replying to your enquiry and arranging a call | Steps you ask us to take before a contract; our legitimate interests in running our business |
| Protecting forms from abuse | Legitimate interests |
| Aggregate website analytics | Legitimate interests, or consent where the law requires it |
| Records we must keep | Legal obligation |
| Processing client documents | The client's instructions, under our agreement with the client |
7. Who we share personal data with
We share personal data only with the following kinds of recipients, each under contractual safeguards, and only as far as needed:
- Resend, our email delivery provider, which sends form submissions to our inbox and the automatic reply to you.
- Our website hosting provider, which serves this website.
- Our analytics provider, if analytics is enabled.
- Professional advisers such as legal counsel and auditors, under confidentiality obligations.
- Regulators and law enforcement where the law or a valid legal process requires it.
We do not sell personal data.
8. International transfers
We are based in Singapore, and our providers may process personal data in other countries. Where data is transferred across borders, we use safeguards consistent with applicable law, such as contractual protections and, where the GDPR or UK GDPR applies, Standard Contractual Clauses or an equivalent mechanism.
9. How long we keep it
| Data | How long |
|---|---|
| Enquiries and email correspondence | As long as needed to deal with your request, plus a reasonable follow-up period, then deleted |
| Client engagement records | For the engagement, plus any period the law or the agreement requires |
| Client documents and system data | As set out in the agreement for the engagement; returned or deleted on exit |
| Aggregate analytics | In aggregate form only; it does not identify individuals |
10. Security
We design our products and engagements around minimal collection and keeping data where it already is: on your device, or inside infrastructure you control. We use technical and organisational measures appropriate to the sensitivity of the data. No system is perfectly secure, and we will tell affected parties about a breach as the law requires. Our security page explains our approach.
11. Your rights
Depending on where you are, you may have some or all of these rights over your personal data:
- To be informed about how it is used, and to ask for a copy.
- To have inaccurate data corrected.
- To ask us to delete it, or to restrict or object to its use, in the circumstances the law allows.
- To receive it in a portable form where the law provides for that.
- To withdraw consent where we rely on it, without affecting earlier processing.
- To complain to your data protection authority, such as Singapore's PDPC, the ICO in the UK, your EU supervisory authority, or the Data Protection Board of India.
California residents have rights under the CCPA, including the right to know, delete and opt out of sale or sharing. We do not sell or share personal information as the CCPA defines those terms, and we will not discriminate against you for exercising your rights.
To exercise any right, email hello@gunix.io. We respond within 30 days, or sooner where the law requires. We may need to verify your identity first. Where we hold your data as a processor for a client, we will direct you to that client and help them respond.
12. Automated tools and AI
Our products and systems use automated analysis, including AI models, to produce outputs such as flags, scores and extracted text. These outputs are assistive: they help a person decide and are not legal, compliance or investigative determinations. Decisions about people should involve human review.
13. Children
Our website and services are for businesses and professionals. They are not directed at children, and we do not knowingly collect personal data from children.
14. Changes to this policy
We may update this policy. We will post the new version here with a new date, and give extra notice by email for material changes where we have your address.
15. Contact
Questions, requests and complaints about privacy: hello@gunix.io. Guni Innovations Pte. Ltd., 68 Circular Road #02-01, Singapore 049422.
See also our Terms of Use.