1. Introduction
OpenZilo provides development hardware, software development kits (SDKs) and related technical resources for product developers, software developers, system integrators and researchers.
This Privacy Policy explains how SYNCHORD PTE. LTD., trading as OpenZilo (“OpenZilo”, “we”, “us” or “our”), UEN 202630228G, collects, uses, discloses, retains and otherwise handles personal data in connection with openzilo.com (the “Website”), product enquiries and kit reservations, purchases, necessary purchasing-eligibility checks, and technical or after-sales support.
We are responsible for the personal-data processing described in this Policy to the extent that we determine its purposes and means or otherwise bear responsibility under applicable law. Our registered office is 18 KAKI BUKIT ROAD 3, #05-17, ENTREPRENEUR BUSINESS CENTRE, SINGAPORE 415978.
“Personal data” means information relating to an identified or identifiable individual, as defined under applicable data-protection law. This Policy describes our data-handling practices. Where applicable law requires separate notice, consent or other safeguards for particular processing activities, we will provide or implement them as required.
2. Scope and Responsibilities
2.1 Our activities
This Policy covers personal data that we receive or control through Website visits, enquiries, reservations, purchases, invoicing, communications, and technical or after-sales support. Our Terms and Conditions govern purchases and the contractual use of our products and services separately.
2.2 Independent development and research
Developers, researchers, organisations and other third parties that independently collect or use personal data through their own applications, studies or integrations are responsible for their own processing, notices and legal obligations. Providing hardware, SDKs, documentation or links does not, by itself, make us responsible for data that we neither receive nor control. If we process personal data on behalf of an organisation, the relevant arrangement will be addressed in a separate agreement where required.
3. Information We Collect
The information we collect depends on how you interact with us and may include the following categories:
(a) Contact and business information: your name, email address, relevant telephone number, organisation, role and professional contact details.
(b) Order, billing and delivery information: purchased items, order references, purchaser and recipient details, billing and delivery addresses, invoice information and information reasonably required for customs clearance.
(c) Payment information: payment status, amount, currency, transaction references, and limited payment-method, refund or payment-dispute information made available through our payment integration.
(d) Enquiries and support information: messages, reservation details, issue descriptions, attachments, product identifiers, firmware or SDK versions, error reports and diagnostic information that you provide.
(e) Purchasing-eligibility information: professional affiliation, project details and intended use, where reasonably necessary to assess purchasing eligibility or applicable product restrictions.
(f) Website and preference information: IP address, browser and device information, pages accessed, access times, referral information, access or security logs, and preference or consent records, depending on the technologies actually deployed.
We obtain information from you, your authorised representatives, and payment, fulfilment or logistics providers as relevant to the transaction. Please provide accurate information and ensure that you are entitled to provide another person’s data. Do not send passwords, full payment-card details, unnecessary identity documents or unrelated sensitive information.
4. Purposes and Legal Grounds
4.1 Purposes
We use personal data as reasonably necessary to:
(a) respond to enquiries, manage reservations and assess purchasing eligibility;
(b) process orders and payments, issue invoices, arrange delivery and facilitate customs clearance;
(c) provide technical and after-sales support and address product issues;
(d) operate, maintain, secure and troubleshoot the Website and improve our products, support and business processes;
(e) prevent fraud, misuse and security incidents and verify relevant transactions;
(f) send order, delivery, product-safety, support or other necessary service communications;
(g) maintain business, accounting and tax records, meet legal obligations, and establish, exercise or defend legal claims; and
(h) send optional marketing communications where permitted and subject to applicable consent and opt-out requirements.
If information necessary for a transaction or service is missing or cannot reasonably be verified, we may be unable to proceed. Consent to optional marketing is not a condition of purchase.
4.2 Legal grounds
Under Singapore law, we rely on consent, deemed consent or applicable statutory exceptions only where the relevant conditions are met. Where the GDPR or comparable laws apply, our grounds may include performing a contract with you or taking requested pre-contractual steps, complying with legal obligations, pursuing legitimate interests subject to the required balancing of rights, or obtaining consent for optional activities.
Relevant legitimate interests may include business administration, security, fraud prevention, customer support, proportionate service improvement and legal claims. Where sensitive data requires an additional legal condition or separate consent, we will satisfy that requirement before the relevant processing.
4.3 Anonymised information
We may lawfully create and use irreversibly anonymised information for analysis, improvement or development. Information that can still be linked to an individual remains subject to applicable personal-data protections.
5. Payments Disclosures and International Transfers
5.1 Payment processing
Payments are processed through Stripe. Payment credentials submitted through its payment interface are handled by Stripe and relevant payment providers. We receive the transaction and limited payment information described in Section 3. Stripe’s handling of personal data is explained at https://stripe.com/privacy.
5.2 Service providers and other recipients
We disclose relevant information where reasonably necessary to payment, fulfilment, logistics, customs, hosting, security, communications, IT, accounting and professional-service providers. Providers processing data on our behalf are subject to appropriate contractual restrictions. Recipients acting independently may process data under their own legal obligations and privacy notices.
5.3 Legal and business circumstances
Where lawful and necessary, we may disclose information to respond to valid legal or regulatory requests, investigate fraud or security matters, enforce agreements, or protect legal rights and safety. Information may also be disclosed in connection with a proposed or completed merger, acquisition, restructuring, financing or business transfer, subject to appropriate confidentiality, purpose restrictions and any legally required notice or safeguards.
5.4 International transfers
Information may be processed in Singapore, China and other countries where relevant providers operate. Order and recipient information may be provided to fulfilment and logistics providers in China to arrange shipment. The locations and recipients depend on the services actually used.
Where required, we implement applicable transfer safeguards, including measures providing protection comparable to Singapore’s requirements and, for relevant EEA or UK transfers, adequacy decisions, approved contractual safeguards or other lawful mechanisms. Contact us for information about relevant safeguards or copies where available; lawful redactions may protect confidential information and others’ rights.
6. Local Device Data and External Platforms
6.1 Local storage
Under our current product configuration, ring recordings and sensor data are stored locally on the ring or connected device. They are not automatically uploaded to an OpenZilo cloud service or otherwise transmitted to us merely through ordinary use of the hardware or SDK.
You or the independent developer control local collection, access, security and backups, including any recording notices, permissions and legal requirements applicable to your activities. We cannot access, export, correct or delete data held solely on devices or systems outside our control.
6.2 Support files and returned hardware
If you voluntarily send files or return hardware containing accessible data, we may receive that data as part of support. Remove unnecessary information beforehand where safely practicable. Do not send identifiable recordings, health information or participant data unless necessary and separately arranged with us. We may request redacted materials or decline unnecessary uploads and will limit any processing to lawful support or related purposes.
We do not provide a data-storage, backup or recovery service. Inspection, repair or resetting may erase local data, subject to applicable law and any agreed handling instructions.
6.3 AI and research use
We do not access locally stored ring recordings or sensor data for AI training. Purchasing or using a product does not grant us unrestricted permission to use personal data for model training or research. Any separate activity involving such data will require its own appropriate notice, legal basis and consent where required.
6.4 Independent platforms and integrations
Third-party applications, AI services, integrations and repositories operate under their own terms and privacy notices. Enabling, connecting, modifying or publicly sharing through them may transmit data to those parties. Compatibility or a link alone does not give us control over an independent provider’s processing; our responsibility for processing that we actually conduct remains unaffected.
8. Retention and Security
8.1 Retention principles
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, applicable legal requirements and legitimate business needs. Different categories are subject to different periods.
8.2 Normal retention periods
Subject to Section 8.3, the following periods apply:
(a) Financial and transaction records: necessary order, payment, invoice, fulfilment and supporting accounting or tax records are retained for the applicable statutory period. Singapore requirements generally require relevant records to be kept for at least five years, calculated from the relevant Year of Assessment or accounting period, as applicable.
(b) General enquiries and reservations that do not result in a purchase: up to 12 months after the last substantive communication.
(c) Ordinary technical and after-sales support records: up to 24 months after the matter is closed. Necessary transaction evidence or dispute records may be retained separately under the applicable legal or claims-related period.
(d) Recordings and sensitive diagnostic attachments submitted for support: deleted as soon as reasonably practicable after resolution, normally within 30 days, unless a specific lawful reason requires longer retention. Non-sensitive findings may remain in the support record.
(e) Routine Website access logs: up to 90 days. Security-incident records are subject to Section 8.3.
(f) Backup copies: maintained on a rolling cycle normally not exceeding 90 days. Copies specifically preserved for legal or security reasons are restricted and retained only as necessary.
(g) Consent and preference evidence: retained as reasonably necessary to demonstrate permission, meet compliance requirements or address claims. Limited marketing-suppression records may be kept for as long as needed to respect an opt-out.
(h) Local ring and connected-device data: controlled by you or the relevant developer. Our server-retention periods do not apply to data that we neither receive nor control.
8.3 Exceptions and disposal
We may extend a normal period where specifically necessary for tax or regulatory obligations, investigations, security incidents, payment disputes or legal claims. Any extension must remain proportionate to its lawful purpose and duration. A deletion request does not require destruction of information that we are lawfully entitled or required to retain.
When retention is no longer necessary, we delete, securely dispose of or irreversibly anonymise the data. Residual backup data is restricted from ordinary use and removed through the applicable overwrite cycle.
8.4 Security
We use reasonable technical and organisational measures appropriate to the data and risks. No system is completely secure, and we cannot guarantee that unauthorised access or loss will never occur. We assess incidents, take appropriate remedial action and provide notifications where legally required. Please protect your devices, accounts, credentials and backups, and report suspected issues without publicly disclosing sensitive information.
9. Your Rights and Requests
9.1 Available rights
Depending on applicable law, you may have rights to access or obtain a copy of personal data, correct it, request deletion, restrict or object to processing, obtain portability, withdraw consent, or challenge certain automated decisions producing legal or similarly significant effects. Regional laws may also provide controls over sale, sharing, targeted advertising or sensitive information, and protection against unlawful discrimination for exercising privacy rights.
9.2 How to submit a request
Email openzilo@ziloring.com, describe your request and mark it “For the attention of the Data Protection Officer.” We may seek clarification, reasonable identity verification or evidence of an agent’s authority where needed and legally permitted. We will not impose verification where applicable law prohibits it, including for certain opt-out requests.
9.3 Conditions and response
Rights are subject to applicable conditions and exceptions. We may retain information required for financial compliance, security, fraud prevention or legal claims, and make lawful redactions to protect others’ rights, confidentiality or legal privilege. Where permitted, manifestly unfounded or excessive requests may be refused or subject to a reasonable fee, with an explanation. We will respond within applicable legal time limits and explain any lawful extension, refusal or available appeal route.
9.4 Withdrawal and complaints
Withdrawing consent does not affect prior lawful processing. Where another valid legal basis permits continued processing, we may continue to that extent and provide any required information. You may contact us about a concern and, where applicable, complain to a competent data-protection authority. Requests concerning data held solely by an independent platform or on local devices should be directed to the relevant party or handled through the available device controls.
10. Children Minors and Research Participants
Direct purchasers must be at least 18 years old or meet any higher applicable age of legal capacity. Our Website and direct sales are intended for adult professional users and are not directed at children.
An adult’s purchase does not constitute consent to collect a child’s personal data. Where children’s or minors’ data is involved, applicable age thresholds, parental permissions, transparency requirements and safeguards must be observed. If you believe we have improperly received such data, contact us so that we can investigate and take appropriate action, including deletion where required.
Independent developers and researchers working with minors or other participants are responsible for required notices, permissions, ethics approvals and safeguards. Do not send participant data to us merely because you use our hardware or SDK. If OpenZilo separately undertakes research involving personal data, an appropriate study notice, legal basis and required permissions will apply.
11. Changes and Contact
We may update this Privacy Policy from time to time to reflect changes in our practices, products, services or legal requirements. We will publish the revised Policy on the Website and update its effective date. For material changes, we will provide additional notice through the Website, email or other appropriate means where required by applicable law.
The revised Policy applies from its stated effective date. To the extent permitted by law, continued use after that date acknowledges the update and the application of the revised Policy to subsequent use. Where a change requires consent, we will obtain it separately before the relevant processing. Continued use does not replace legally required consent or authorise incompatible new uses of previously collected data.
Data Protection Contact
Our Data Protection Officer oversees personal-data protection matters. For privacy enquiries, rights requests or complaints, please contact legal@ziloring.com and mark your message “For the attention of the Data Protection Officer.”
If the English and Chinese versions are inconsistent, the English version prevails to the extent permitted by applicable law.