How Two Prune handles personal data.

This notice applies when Two Prune determines why and how personal data is processed. When a customer administers an assessment, the customer ordinarily determines the assessment purpose and Two Prune processes participant data for that customer. The customer's privacy notice and instructions may also apply.

Two Prune remains responsible for account administration, security, service telemetry, support, billing, direct communications, and other processing for which Two Prune determines the purpose.

Identity and account data: name, email, organization, role, authentication identifiers, account status, and preferences.

Assessment data: invitations, assessment materials, instructions, submissions, notes, messages, saved sources, checklist state, calculations, scores, reports, risks, and customer review activity.

Workspace activity: opened documents and messages, tool usage, AI prompts and responses, research activity, edits, revisions, navigation events, timestamps, submission events, and integrity or operational-risk signals. Within the assessment workspace, this may include coarse response visibility, revisit, scroll-coverage, and text-selection measurements. Selection telemetry records location and length rather than the selected text, and Two Prune does not collect unrelated clipboard contents, eye tracking, webcam attention, or cursor-movement profiles.

Technical and support data: IP address, browser and device information, session and request metadata, diagnostic records, security events, integration data, and communications with Two Prune.

Inferences: assessment scores, pillar-level observations, evidence strength, score confidence, benchmark comparisons, calibration notes, and other analysis derived from assessment data.

We receive data from you, the customer administering an assessment, authorized workspace users, your use of the service, connected service providers, and publicly available sources used in the research sandbox. Customers are responsible for lawfully providing participant data and required notices before inviting a participant.

For the public AI Workflow Trial, we create an anonymous assessment session after you accept the Terms and acknowledge this notice. After you submit, we collect your name and result-delivery email to personalise, process, and deliver your private result. We do not require or collect a LinkedIn profile for trial enrollment. Agreeing to receive the result does not subscribe you to marketing; marketing consent is a separate, optional choice.

Your AI Workflow Trial result link is private, access-controlled, and expires. When your result is ready, Two Prune may automatically send that private link to the result-delivery email you provide. We do not automatically publish a public result. Workspace activity, AI interactions, submitted work, and evidence-based assessment outputs are processed as described elsewhere in this notice.

We process data to provide and administer assessments; authenticate users; generate submissions, scores, and reports; provide AI and research features; maintain integrity and security; prevent misuse; support users; bill customers; comply with law; establish or defend claims; and improve reliability and service quality.

Depending on the jurisdiction and context, processing is based on performance of a contract, steps requested before a contract, legitimate interests, compliance with law, customer instructions, consent where required, or another lawful basis. Two Prune will not rely on consent where the law requires a different or more appropriate basis.

Our legitimate interests include operating and securing the service, supporting customers, improving assessment quality, preventing fraud and misconduct, and developing de-identified analytics and benchmarks. We balance those interests against individual rights and expectations.

On our public landing page, we measure page visits, referral hostnames and campaign sources, active engagement time, scroll depth, approximate country, and clicks on access-request links. We do not set an analytics cookie or persistent browser identifier. For approximate daily visitor counts, the server converts request IP and browser information into a pseudonymous value that changes each Singapore calendar day; the underlying IP and browser information are not stored in the analytics record. Global Privacy Control signals are honored. You may also Opt out of landing-page analytics.

Two Prune may use rules, statistical methods, and AI-assisted analysis to create assessment scores, observations, and reports. Those outputs can evaluate aspects of work performance, but Two Prune does not itself make an employment or other legally significant decision.

Customers must provide meaningful human review where required and remain responsible for decisions made using assessment evidence. Where applicable law provides rights concerning automated decisions, explanations, objections, or human review, requests may be directed to the customer or to Two Prune for routing.

We may disclose data to the customer administering the assessment; authorized users; infrastructure, hosting, database, AI, communications, analytics, and support providers; professional advisers; auditors; insurers; financing or transaction counterparties under confidentiality; and authorities or other parties where required to comply with law, protect rights, investigate abuse, or secure the service.

A current provider overview is available on our Subprocessors page. We do not sell personal data for money. If a jurisdiction treats particular advertising or cross-context disclosures as a sale or share, Two Prune will provide any legally required notice and opt-out mechanism before engaging in that activity.

Two Prune operates from Singapore and uses providers that may process data in other countries. We use contractual, organizational, and technical measures intended to provide protection comparable to Singapore's PDPA and, where applicable, recognized transfer mechanisms such as standard contractual clauses. Local authorities may have lawful access rights in those countries.

We retain personal data only while needed for the stated purpose, customer instructions, security, dispute resolution, legal compliance, backup cycles, or another legitimate business purpose. Retention depends on the data type, contract, assessment lifecycle, sensitivity, and legal requirements.

Assessment records are generally retained for the customer's configured service period and a limited period afterward for export, recovery, disputes, and compliance. Security and audit records may be retained longer where needed to investigate incidents or demonstrate integrity. Data may persist in protected backups until scheduled deletion. De-identified information may be retained without a fixed period where lawful.

Detailed landing-page analytics visits are retained for no more than 31 days. Daily statistical summaries that do not contain visitor identifiers are retained for up to 13 months.

Public AI Workflow Trial private result credentials are configured to expire after 90 days unless a shorter period is required or the credential is revoked earlier. The underlying assessment, result, and operational records follow the assessment-retention rules above and may be retained longer where needed for security, fraud prevention, legal compliance, or a documented deletion process.

We use administrative, technical, and organizational safeguards designed for the nature of the data and service. No system is completely secure. See our Security page for current practices and reporting guidance.

Rights vary by location and role. They may include notice, access, correction, deletion, restriction, portability, withdrawal of consent, objection, appeal, human review, and complaint to a regulator. These rights can be limited by exceptions for evaluative material, legal claims, security, another person's rights, or other grounds provided by law.

Singapore residents may request access to personal data under Two Prune's possession or control and information about use or disclosure during the preceding year, and may request correction, subject to PDPA exceptions. Consent may be withdrawn with reasonable notice, but withdrawal may prevent continued service use and does not affect prior lawful processing.

EEA and UK residents may have additional rights under applicable data-protection law. California residents may have rights to know, delete, correct, limit certain sensitive-data uses, opt out of sale or sharing, and receive non-discriminatory treatment, where the relevant law applies to Two Prune.

Submit a privacy request with your name, email, relationship to Two Prune, and request type. We may verify identity, request authorization for an agent, deny or limit a request where law permits, and retain a record of the request. If Two Prune processes data only for a customer, we may direct the request to that customer and assist it as required.

You may complain to the Personal Data Protection Commission of Singapore or another competent regulator. Please contact us first so we can investigate.

Two Prune uses cookies and similar storage needed for authentication, session continuity, security, preferences, and core service operation. We will request consent before using non-essential cookies where required. You can unsubscribe from marketing messages, but we may still send service, security, assessment, and legal communications.

Two Prune is not directed to children. Customers must not invite anyone under 18, or under the applicable age of legal majority, without first entering a written arrangement with Two Prune that addresses authorization, notices, consent, and additional safeguards.

We may update this notice to reflect changes in law, providers, or the service. Material changes will be communicated through the service, email, or another reasonable method and will state a new effective date.

The Data Protection Officer for PRUNE PTE. LTD. can be contacted at hello@twoprune.com. This address also accepts privacy requests, complaints, and questions about this notice.