PRIVACY POLICY

Effective Date: 7 May 2026
Last Updated: 7 May 2026

Alphazyl Pte. Ltd. ("Alphazyl", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store, and safeguard information when you visit alphazyl.com, interact with our advertising and marketing services, engage with our advertisements on third-party platforms (including Meta/Facebook, Instagram, Google, and affiliate networks), or otherwise communicate with us (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with these practices, please do not use our Services.

CONTENTS

1. About Us
2. Scope of This Policy
3. Information We Collect
4. How We Collect Information
5. How We Use Your Information
6. Legal Bases for Processing
7. How We Share Information
8. Advertising Platforms & Meta Compliance
9. Cookies & Tracking Technologies
10. International Data Transfers
11. Data Retention
12. Data Security
13. Your Rights & Choices
14. Regional Privacy Disclosures
15. Children's Privacy
16. Third-Party Links & Services
17. Changes to This Policy
18. Contact Us

1. ABOUT US

Alphazyl Pte. Ltd. is a private limited company incorporated and registered in Singapore. We operate as a digital marketing and performance advertising business, providing services that include media buying, campaign management, affiliate marketing, lead generation, and online customer acquisition across platforms such as Meta (Facebook and Instagram), Google, and various affiliate networks.

For the purposes of applicable data protection laws — including the EU and UK General Data Protection Regulation ("GDPR"), Singapore's Personal Data Protection Act 2012 ("PDPA"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and India's Digital Personal Data Protection Act 2023 ("DPDPA") — Alphazyl Pte. Ltd. acts as the data controller (or equivalent) for personal data collected through our Services, except where we expressly act as a processor or service provider on behalf of a client or business partner.

2. SCOPE OF THIS POLICY

This Privacy Policy applies to:

• Visitors to alphazyl.com and any subdomains, microsites, or landing pages we operate;
• Individuals who interact with our advertisements or sponsored content on Meta platforms (Facebook, Instagram, Messenger, Audience Network), Google, YouTube, TikTok, affiliate networks, and other third-party media;
• Individuals who submit information through lead-generation forms, contact forms, surveys, or instant forms (including Meta Lead Ads);
• Customers, prospects, business partners, vendors, and applicants who communicate with us by email, phone, messaging apps, or other channels; and
• Visitors to landing pages and websites that we operate as part of paid media campaigns.

This Policy does not apply to third-party websites, products, or services that are not owned or controlled by Alphazyl, even when accessed through a link from our Services.

3. INFORMATION WE COLLECT

We collect information that identifies, relates to, describes, references, or could reasonably be linked, directly or indirectly, with a particular individual or device. The categories of information we may collect include:

3.1 Information You Provide Directly

• Identity & contact data: name, email address, phone number, postal address, country, ZIP/postal code, date of birth (where required by an offer or vertical, such as insurance or financial products).
• Account & profile data: username, password (hashed), preferences, and any information you voluntarily provide.
• Lead-form responses: answers to questions submitted through Meta Instant Forms, Google Lead Forms, contact forms, surveys, or sign-up pages on our landing pages.
• Commercial inquiries: business name, role, project details, and any information shared as part of a service inquiry or contract.
• Communications: the content of emails, messages, and other communications you send to us.

3.2 Information Collected Automatically

• Device & technical data: IP address, device type, operating system, browser type and version, screen resolution, language settings, and mobile network information.
• Usage data: pages visited, referring/exit pages, click-through paths, time spent on pages, scroll depth, button clicks, form interactions, and timestamps.
• Identifiers: cookie IDs, pixel IDs, mobile advertising identifiers (such as IDFA and Android Advertising ID where permitted), and click identifiers (such as fbclid, gclid, and affiliate sub-IDs).
• Approximate location: derived from IP address (typically at city or region level).

3.3 Information from Third Parties

• Advertising platforms: Meta, Google, and other ad networks may share aggregated or pseudonymous campaign performance data, audience insights, and conversion events.
• Affiliate & tracking partners: networks such as ClickBank, Impact, Everflow, Sedo, and similar partners may share click and conversion data (including click IDs, transaction IDs, payout amounts, and consumer attributes provided by the advertiser).
• Lead-buyer and advertiser partners: where we operate lead-generation campaigns on behalf of an advertiser, the advertiser may share lead validation, suppression, or conversion outcome data.
• Service providers: analytics, fraud prevention, identity verification, and similar providers.

3.4 Sensitive Information

We do not knowingly collect special categories of personal data (such as health information, racial or ethnic origin, religious beliefs, biometric data, or sexual orientation) unless strictly necessary for a specific lawful purpose, with appropriate safeguards and, where required, your explicit consent. We do not use Meta tools to send sensitive personal information.

4. HOW WE COLLECT INFORMATION

We collect information through:

• Direct submissions on our websites and landing pages (forms, sign-ups, account registrations);
• Meta Lead Ads, Instant Forms, and similar lead-capture tools on Facebook and Instagram;
• The Meta Pixel, Conversions API, Google Tag, and other tracking technologies described in Section 9;
• Server-side tracking and conversion APIs that send hashed or pseudonymous event data from our servers to advertising platforms;
• Cookies, web beacons, SDKs, and similar technologies;
• Communications with us by email, phone, or messaging applications; and
• Third-party data sources as described in Section 3.3.

5. HOW WE USE YOUR INFORMATION

We use personal data for the following purposes:

Providing the Services — Operating our websites, responding to inquiries, fulfilling lead deliveries to advertisers, and performing the contracts we have with clients and partners.

Advertising & Marketing — Planning, executing, optimizing, measuring, and reporting on advertising campaigns; building lookalike and custom audiences; retargeting; and attribution.

Analytics & Performance — Understanding how users engage with our Services and creatives, measuring campaign ROI, and improving creative, copy, targeting, and landing-page experience.

Fraud Prevention & Compliance — Detecting bot traffic, click fraud, lead fraud, and other suspicious activity; complying with platform policies (including Meta and Google policies), advertiser compliance requirements, and applicable law.

Communication — Sending transactional messages (e.g., responses to inquiries) and, where permitted, marketing communications about products and services that may interest you.

Legal & Security — Establishing, exercising, or defending legal claims; responding to lawful requests; and protecting the rights, property, and safety of Alphazyl, our users, and others.

6. LEGAL BASES FOR PROCESSING (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Consent — for non-essential cookies, certain marketing communications, and any processing of special-category data.
• Contract — to deliver services you have requested or perform a contract with our clients/partners.
• Legitimate interests — for analytics, fraud prevention, business development, and improving our Services, where these interests are not overridden by your fundamental rights.
• Legal obligation — to comply with tax, accounting, and other legal requirements.

You may withdraw consent at any time by contacting us at privacy@alphazyl.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

7. HOW WE SHARE INFORMATION

We do not sell personal data for monetary consideration. We may share personal data in the following circumstances:

• Advertisers and lead-buyer partners: when you submit a lead-generation form, your information may be shared with the advertiser whose product or service the form was promoting, who will use it under their own privacy policy.
• Advertising platforms: Meta, Google, and similar platforms — typically as hashed identifiers and event data — for purposes of conversion measurement, optimization, and audience building.
• Affiliate networks & tracking providers: ClickFlare, ClickBank, Impact, Everflow, Sedo, and similar partners, for click and conversion tracking and payout reconciliation.
• Service providers: hosting, email, analytics, customer support, payments, fraud prevention, and similar vendors acting on our instructions under written contracts.
• Professional advisors: auditors, lawyers, accountants, and insurers under appropriate confidentiality obligations.
• Corporate transactions: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to standard confidentiality protections.
• Legal & safety: where required by law, court order, or to protect rights, property, or safety.

Some sharing may constitute a "sale" or "sharing" of personal information under the CCPA/CPRA when it involves transfers to advertising platforms or partners. See Section 14 for your rights to opt out.

8. ADVERTISING PLATFORMS & META COMPLIANCE

Alphazyl runs paid campaigns on Meta platforms (Facebook, Instagram, Messenger, and Audience Network) and uses Meta Business Tools, including the Meta Pixel, Conversions API, Custom Audiences, Lookalike Audiences, and Lead Ads. Our use of these tools complies with Meta's Business Tools Terms, Custom Audiences Terms, Data Processing Terms, and the Meta Platform Terms and Developer Policies.

8.1 Meta Pixel and Conversions API

We use the Meta Pixel and Conversions API to measure the effectiveness of our advertising and to deliver more relevant ads. These tools may collect information such as IP address, browser/device data, page URLs, button clicks, form submissions, and pseudonymous identifiers. Where required, we obtain consent before activating these tools.

We may share hashed contact information (such as email addresses and phone numbers) with Meta solely for the purpose of building Custom Audiences, deduplicating events between browser and server, and improving conversion measurement. We do not share information about sensitive matters (including, without limitation, financial account numbers, government-issued identifiers, health or medical information, or information about children) with Meta through these tools.

8.2 Lead Ads & Instant Forms

When you submit a lead through a Meta Lead Ad or Instant Form, the information you provide is transmitted to us (and, where applicable, to the advertiser whose offer the form was promoting). We use this information to follow up with you about the offer, deliver the lead to the relevant advertiser, and measure campaign performance. The advertiser's own privacy policy governs how they will use the information after receipt.

8.3 Custom & Lookalike Audiences

We may upload hashed customer or website-visitor lists to Meta to create Custom Audiences and Lookalike Audiences for advertising purposes. You may opt out of seeing these ads at any time by adjusting your Facebook Ad Preferences or by emailing privacy@alphazyl.com to request that we remove your information from our advertising audiences.

8.4 Other Advertising Platforms

We use similar tools on Google (Google Tag, Google Ads conversion tracking, Customer Match), and may use comparable tools on other platforms such as TikTok, Microsoft Advertising, and affiliate networks. Each platform's own privacy policy governs how it processes data once received.

9. COOKIES & TRACKING TECHNOLOGIES

We and our partners use cookies, pixels, web beacons, SDKs, server-side tracking, and similar technologies to operate our Services, remember your preferences, measure performance, prevent fraud, and deliver relevant advertising. Categories include:

• Strictly necessary — required for our Services to function (e.g., session management, security).
• Analytics — help us understand site usage (e.g., Google Analytics).
• Advertising — used for measurement, retargeting, and optimization (e.g., Meta Pixel, Google Ads, affiliate trackers, ClickFlare).
• Functional — remember preferences and improve user experience.

Where required by law (such as in the EU, UK, and certain other jurisdictions), non-essential cookies are loaded only after you provide consent through our cookie banner. You can manage your preferences at any time through the cookie settings on our website, your browser settings, or platform-level controls (e.g., Meta Ad Preferences, Google Ad Settings, your device's "Limit Ad Tracking" setting).

10. INTERNATIONAL DATA TRANSFERS

Alphazyl is headquartered in Singapore, and our team and partners operate from multiple countries, including India and the United States. Your personal data may be transferred to, stored, or processed in countries other than your own, including jurisdictions that may not provide the same level of data protection as your home country.

When we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms required by applicable law. You may request a copy of the safeguards we use by contacting us.

11. DATA RETENTION

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, tax, accounting, or reporting requirements, and to resolve disputes and enforce our agreements. Typical retention periods include:

• Lead-form data: up to 24 months after submission, or until the lead is delivered and reconciled with the advertiser, whichever is longer.
• Advertising and analytics data: in aggregated or pseudonymous form, up to 26 months (Google Analytics default) or as configured by the platform.
• Customer and contractual records: for the duration of the contractual relationship plus the period required by applicable tax and accounting laws (typically 5–7 years in Singapore).
• Communications: as long as reasonably needed to respond to and document the inquiry.

When personal data is no longer needed, we securely delete or anonymize it.

12. DATA SECURITY

We implement administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit (TLS/HTTPS), access controls, role-based permissions, secure cloud infrastructure, and regular review of our security practices.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security. You are responsible for keeping any account credentials confidential.

13. YOUR RIGHTS & CHOICES

Subject to applicable law and certain exceptions, you may have the following rights with respect to your personal data:

• Access — request confirmation of, and a copy of, the personal data we hold about you.
• Rectification — request that we correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Restriction — request that we restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Portability — receive a copy of your data in a structured, machine-readable format.
• Withdraw consent — at any time, where processing is based on consent.
• Opt out of ad targeting — opt out of personalized advertising and audience-based targeting.
• Lodge a complaint — with a supervisory authority in your country.

To exercise any of these rights, please email privacy@alphazyl.com. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before fulfilling certain requests.

14. REGIONAL PRIVACY DISCLOSURES

14.1 European Economic Area, United Kingdom, & Switzerland

If you are located in the EEA, UK, or Switzerland, the GDPR (or UK GDPR) gives you the rights described in Section 13. You have the right to lodge a complaint with your local Data Protection Authority — for example, the UK Information Commissioner's Office (ICO), Ireland's Data Protection Commission (DPC), or your country's equivalent regulator.

14.2 California, USA

Under the CCPA/CPRA, California residents have the right to:

• Know what categories of personal information we have collected and how we use them;
• Request access to, deletion of, or correction of their personal information;
• Opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising; and
• Be free from discrimination for exercising their privacy rights.

To opt out of the sale/sharing of personal information for advertising purposes, please email privacy@alphazyl.com with the subject line "Do Not Sell or Share My Personal Information," or use the Global Privacy Control (GPC) signal in your browser, which we honor as an opt-out request.

14.3 Singapore

If you are located in Singapore, the PDPA gives you rights of access and correction with respect to personal data held by us. Our Data Protection Officer can be contacted at dpo@alphazyl.com.

14.4 India

If you are located in India, you may have rights under the Digital Personal Data Protection Act, 2023, including the right to access, correct, and erase personal data, the right to grievance redressal, and the right to nominate. To exercise these rights or file a grievance, contact our Grievance Officer (see Section 18).

15. CHILDREN'S PRIVACY

Our Services are not directed to children under the age of 16 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@alphazyl.com and we will take steps to delete it.

16. THIRD-PARTY LINKS & SERVICES

Our Services may contain links to third-party websites, products, or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing any personal information.

17. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other reasons. When we make material changes, we will revise the "Last Updated" date at the top of this Policy and, where appropriate, provide additional notice (such as by email or a prominent notice on our website). Your continued use of the Services after any update constitutes acceptance of the revised Policy.

18. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us:

Alphazyl Pte. Ltd.
Registered Office: Singapore

General Privacy Inquiries: privacy@alphazyl.com
Data Protection Officer (Singapore PDPA): dpo@alphazyl.com
Grievance Officer (India DPDPA): grievance@alphazyl.com
Website: alphazyl.com

This Privacy Policy is provided in English. In the event of any conflict between this English version and any translated version, the English version shall prevail.