Privacy Policy
This policy explains what personal data we collect through this website and through the Kai Dojo service, why we collect it, who else can see it, and what you can require us to do about it. It is written to be read, not to be skimmed past.
Effective 10 September 2026.
1. Who we are
Kai Dojo is a product of Cortex Lab AI, UEN 202546841R, with a registered address at 12 Woodlands Square, #13-79 Woods Square Tower One, Singapore 737715.
We handle personal data under the Personal Data Protection Act 2012 of Singapore (the PDPA). Where this policy says "we" or "us", it means Cortex Lab AI.
2. The two roles, and which one applies to you
This is the part most privacy policies get wrong, and it changes what you can ask of whom. Kai Dojo is sold to businesses, and those businesses use it to answer members of the public. Those are two different relationships.
| If you are | Then | Ask about your data |
|---|---|---|
| A visitor to this website, or a business enquiring about Kai Dojo | Cortex Lab AI is the organisation responsible for your data | Ask us. See section 12. |
| A member of the public who messaged a gym's WhatsApp number | That gym is the organisation responsible. We act as its data intermediary, handling the data on its instructions | Ask the gym first. We will help them answer you. |
| A coach or owner signing in to the Kai Dojo app | Your business is responsible for your account existing; we hold it on their instructions | Ask your business, or us. |
3. What we collect, and why
We collect only what a given interaction needs. You can read this entire website without giving us anything at all.
| What | When | Why |
|---|---|---|
| Your WhatsApp phone number and the contents of your messages | When you message a business that uses Kai Dojo | To answer the question you asked, and to show the conversation to that business's team |
| Business information a client gives us — website content, timetables, prices, FAQs, uploaded files | When a client sets up or updates their account | So the assistant answers from the client's own information rather than inventing one |
| Name and email address of a coach or owner | When an account is created for them | To let them sign in and to attribute replies to a person |
| Your name, business and message | When you contact us through WhatsApp or email | To reply to you |
| IP address, browser type and requested page | Automatically, when a page loads | Security and availability |
We do not run advertising pixels, and we do not buy, sell, rent or trade personal data. At the time of writing this website carries no analytics or tracking cookies.
4. The assistant, and what it does automatically
One part of this service involves automated processing, and we would rather be explicit about it than bury it.
- When you message a business that uses Kai Dojo, your message is sent to a large language model, which composes a reply from that business's own information.
- It makes no decision that has a legal or similarly significant effect on you. It answers questions and passes on the ones it should not answer.
- It declines and hands over to a person on anything it is not equipped for — injuries, medical advice, and any price it has not been given. When it does, it says so rather than guessing.
- A member of the business's team can take over the conversation at any moment, and the assistant stops when they do.
Do not send confidential information, credentials, payment details, or other people's personal data to the assistant. It is a first-line enquiry channel, not a secure one.
5. Who else can see it
We use a small number of service providers to run Kai Dojo. They act on our instructions and are not permitted to use your data for their own purposes.
| Provider | What they do | Where |
|---|---|---|
| Meta Platforms | Delivering and receiving messages on the WhatsApp Business Platform | Global |
| Supabase | Storing conversations, contacts and client knowledge | Singapore region |
| Google Cloud / Firebase | Sign-in for coaches, and the servers that run the service | Global |
| Google Cloud Vertex AI | Turning your knowledge into a searchable form, so the assistant can find the right passage to answer from | Singapore region (asia-southeast1) |
| Anthropic | Generating replies, using the Claude models | United States |
| OpenRouter | Only where a client is configured to use a model other than Claude — Google's Gemini, for example. OpenRouter passes the message to that model's provider | United States |
We use the AI providers on their business API tiers, configured so that messages sent to them are not used to train their models. We cannot control what a provider does outside the terms of our agreement with them.
Which model answers a given client is a configuration choice, and the default is Claude. If a client is moved to another model we will say so, because it changes which of the companies above sees their contacts' messages.
We will also disclose personal data where the law requires it, or where it is necessary to establish or defend a legal claim. If our business is ever sold or merged, personal data may transfer to the acquirer, and this policy continues to apply until you are told otherwise.
6. Stopping the assistant
If you have messaged a business that uses Kai Dojo and you do not want an automated reply, send STOP — or an equivalent short phrase such as "unsubscribe" or "opt out".
- The assistant stops replying on that conversation.
- Your opt-out is recorded against your number, with the date and the phrase you used.
- A person at that business can still reply to you, because your opt-out is from the automation, not from the business.
This is enforced in the software itself rather than by a policy someone has to remember to follow.
7. How long we keep it
We stop keeping personal data once the purpose it was collected for has ended and we have no legal reason to retain it.
These periods are being finalised. We would rather show you an unfilled figure than publish one the system does not yet enforce. Until each is set here, data is retained for as long as the client relationship requires it, and you can ask us to delete yours at any time under section 10.
| What | Kept for |
|---|---|
| Conversations and messages between a Contact and a client business | to be set |
| Contact phone numbers where the conversation did not continue | to be set |
| Opt-out records | Kept indefinitely, because forgetting an opt-out would mean messaging someone who asked us not to |
| Client knowledge sources, after a source is superseded or removed | to be set |
| Coach accounts, after a person leaves a client business | to be set |
| Records relating to a paid engagement | 5 years after the engagement ends, to meet accounting and limitation-period requirements |
| Server logs containing IP addresses | to be set |
8. Sending data outside Singapore
Conversations, contacts and client knowledge are stored in Singapore, and the search over that knowledge runs in Singapore too. What leaves is the message being answered: the model that composes a reply processes it in the United States, and Meta operates the WhatsApp Business Platform globally.
Where that happens we take reasonable steps, as section 26 of the PDPA requires, to satisfy ourselves that the recipient is bound to a standard of protection comparable to the PDPA — ordinarily through the contractual terms in our agreement with them.
9. How we protect it
This site and the Kai Dojo app are served over HTTPS, and traffic between our servers and our providers is authenticated and encrypted in transit. Each client business is isolated from every other one: a coach at one gym cannot see another gym's conversations. Access to systems holding personal data is limited to the people who need it, and removed when they no longer do.
No system is perfectly secure, and we will not claim otherwise. If a data breach occurs that is likely to result in significant harm to you, or that affects 500 or more individuals, we will notify the Personal Data Protection Commission within three calendar days of assessing it as notifiable, and notify you as required under Part VIA of the PDPA.
10. Your rights
Under the PDPA you may ask us to do any of the following, and we will respond within 30 days or tell you when to expect an answer.
- Access — ask what personal data we hold about you and how it has been used or disclosed in the past year.
- Correction — ask us to correct anything inaccurate or incomplete.
- Withdraw consent — tell us to stop using your data for a stated purpose. We will act on it, and tell you plainly if it means we can no longer provide something.
- Deletion — ask us to erase data we have no legal or business reason to keep.
Send any of these to the contact in section 12. We may need to verify your identity first. If your data sits with a client business — see section 2 — we will pass the request to them and help them answer it.
If you are unsatisfied with how we have handled a request, you may refer the matter to the Personal Data Protection Commission at pdpc.gov.sg.
11. Children
Kai Dojo is sold to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, contact us and we will delete it.
12. Contact
Our Data Protection Officer is the point of contact for anything in this policy, including access, correction, withdrawal and deletion requests, and complaints.
- Data Protection Officer: Darrel Liew
- Phone and WhatsApp: 9616 9607
- Email: contact@cortexlab-ai.tech
- Post: Cortex Lab AI, 12 Woodlands Square, #13-79 Woods Square Tower One, Singapore 737715
13. Changes to this policy
We update this policy when what we do changes. The effective date at the top always reflects the current version. Where a change materially affects how we use data you have already given us, we will tell you directly rather than rely on you noticing this page.