Privacy policy — Jumborca

1. Scope and effective date

This policy covers jumborca.com, the Jumborca customer portal, Jumborca Neo (“Neo CRM”) and other online services, and your correspondence with us by form or email. Data that Jumborca software processes inside a customer’s own environment is controlled by that customer and governed by the signed contract and data-processing terms, not by this policy.

This version (v2.1) takes effect on 2026-10-15 and replaces v2.0 of 2026-09-20. This revision brings Neo CRM within scope, adds clauses on AI processing, customer data and breach notification, and moves the list of processors to a separate sub-processors page.

2. Who is responsible, and our two roles

Mainland China: Suzhou Jumborca Software Technology Co., Ltd., Room 1907, GCL Plaza, Suzhou Industrial Park, Jiangsu.
Singapore and other regions: Jumborca Pte. Ltd., 6 Raffles Quay, #14-02, Singapore 048580.

Both entities share responsibility for personal data handled through this site, the portal and Neo CRM; the single point of contact is compliance@jumborca.com.

For data about our own visitors, customers and their users (contact details, accounts, billing, support tickets, usage), we are the personal information processor under PIPL (the responsible organisation under Singapore’s PDPA) and this policy applies in full.

For the content our customers put into their Neo CRM workspaces, such as their own customers’, contacts’, staff and partners’ details (“Customer Data”), we act as an entrusted party under article 21 of the PIPL (a data intermediary under the PDPA) and process it only on the customer’s instructions. The customer is the controller / responsible organisation and must obtain consent or rely on another lawful basis; questions about that data are best sent to the customer first.

3. What we collect

Access logs: IP address, browser type, request path and time, used for security analysis and troubleshooting.
Forms and email: the name, work email, company, title, phone (optional) and message you provide through the contact form, a demo booking or email.
Portal accounts: the email, name, company, title and role of a customer portal account, plus the time, IP and browser of each sign-in.
Neo CRM accounts: the email, name, identity-directory user ID and sign-in records used to create your account, sign you in and keep it secure.
Workspace and billing: workspace name and identifier, contracting entity, billing contacts, invoices and payment records, to provide the service, bill you and meet tax obligations.
Usage: which features are used and how many Credits they consume, to meter, plan capacity and prevent abuse. Each AI call is logged with workspace, feature, model, token counts, duration and outcome; prompt text is not logged.
Support: the content and attachments of support tickets.
Third-party channel bindings: the application identifier and secret reference of a channel such as Feishu that you connect yourself, used for message push.
Cookies and local storage: necessary items only; the full list is in the cookie policy. Neo CRM uses the session credentials needed for sign-in and your browser’s local storage for interface preferences (language, current workspace).

We do not collect sensitive personal data through this site or the services, and we do not use any third-party advertising or behavioural analytics script.

4. Why we use it

To reply to your enquiry, arrange demos and POCs, and deliver the software and services agreed in your contract;
To create and secure accounts and workspaces, provide the features of Neo CRM, and meter and bill usage;
To operate and secure the site, portal and Neo CRM, and to detect and prevent abuse;
To meet legal, regulatory, financial and audit obligations;
To improve the site and our products.

We do not sell your personal data to anyone, and we do not use it for automated decision-making unrelated to the purposes above.

5. Legal bases

Personal Information Protection Law of the People’s Republic of China (PIPL): your consent; necessity for concluding or performing a contract; necessity for meeting legal obligations; and the other circumstances the law provides.
Singapore Personal Data Protection Act 2012 (PDPA): your consent or deemed consent, and the statutory exceptions. Jumborca has completed a PDPA compliance assessment.
If you are in the EU, the UK or another jurisdiction, we process your data in line with GDPR / UK GDPR and the applicable local law.

6. AI processing

Content you submit to AI features (the assistant Aira, smart capture from screenshots and files, document and receipt recognition, voice transcription, drafting and similar) is processed by Azure OpenAI, Azure AI Document Intelligence and Azure AI Speech services that we deploy on Microsoft Azure. These services run inside our own Azure subscription and act as processors; under Microsoft’s product terms your input is not used to train models and is not made available to other Microsoft customers.

Our language models use Azure global deployments, so content submitted to AI features may be processed in any Azure region worldwide. Document recognition and speech transcription run in Azure’s Southeast Asia (Singapore) region.

AI output is a draft that a person reviews. We do not use AI to make decisions about individuals that have legal or similarly significant effects.

7. How long we keep it

Access logs: 30 days.
Forms and email correspondence (prospect data): 24 months from the last contact.
Business information of contracted customers: three years after the end of the relationship, or longer where Chinese law requires it.
Portal accounts: for the life of the account; kept for 30 days after closure, then deleted or anonymised.
Sign-in session records: 30 days.
Neo CRM workspace data: for the life of the subscription. After termination you have 30 days to export it; we then delete it from the live systems within 30 days.
Database backups: a rolling 35-day window, cleared automatically; backups are taken at server level, with no per-workspace purge.
File soft delete: 30 days.
Platform operational logs: 90 days.
Billing and payment records: as long as Chinese and Singapore tax and accounting rules require.

We share data only as needed to provide the service, with our processors. The full list and each one’s processing location are on the sub-processors page, where we announce changes at least 30 days in advance. In short: Microsoft Azure hosts the site, portal, Neo CRM, databases, file storage and logs; Azure OpenAI and other Azure AI services process the content of AI features; Azure Communication Services sends notification emails; Google Fonts serves web fonts (your browser sends your IP address to Google and the service sets no cookies).

Third-party channels that you connect to your workspace yourself (for example Feishu) are chosen by you, share data as you configure them, and are not our processors.

We disclose personal data to no other third party except where the law requires it, in a regulatory investigation, or to protect the legitimate interests of Jumborca and its users. In the event of a merger, acquisition or asset transfer we will tell you in advance, and the successor will be bound by this policy.

9. Where it is stored and cross-border transfers

The site, portal and Neo CRM are hosted in Microsoft Azure’s Asian regions: the website and application front ends in East Asia (Hong Kong); the backend, databases, file storage and the AI document-recognition and speech services in Southeast Asia (Singapore). Data you submit through the site, portal and Neo CRM is therefore stored and processed outside mainland China. Some processing takes place outside Singapore: AI language-model processing (clause 6) and Microsoft’s global identity and email infrastructure.

For users in mainland China, we obtain your separate consent to the cross-border transfer before your personal data is transferred. Where a customer organisation in mainland China places personal information about its own customers, staff or others into a workspace, that customer, as the controller, is responsible for meeting the PIPL’s notice, separate-consent and other statutory requirements for providing personal information outside China; we assist as its entrusted party under the contract.

For transfers out of Singapore we follow section 26 of the PDPA and the Personal Data Protection Regulations 2021, relying on our providers’ contractual commitments, including Microsoft’s Data Protection Addendum, to ensure the recipient provides a comparable standard of protection.

10. Your rights

Under PIPL and PDPA you can:

Access and obtain a copy of your personal data;
Ask us to correct or complete it;
Ask us to delete it, or to restrict processing where the law allows;
Withdraw consent, without affecting processing carried out before withdrawal (withdrawing consent for data we need to run your account may mean we can no longer provide the service);
Close your portal account or Neo CRM account;
Ask us to explain our processing rules;
Under PDPA, ask how your personal data has been used or disclosed within the past year.

Email compliance@jumborca.com with the subject “Personal data request”. We reply within 15 working days of verifying your identity. Cookie preferences can be changed at any time via “Cookie settings” in the footer.

If your data sits in one of our customers’ workspaces, please contact that customer first; we help them respond. If you are not satisfied with our response, you may complain to the data protection authority where you are; users in Singapore may contact the Personal Data Protection Commission (www.pdpc.gov.sg).

11. Security

TLS 1.2+ in transit; encryption at rest for the database and object storage (platform-managed keys); Microsoft Entra identities with enforced multi-factor authentication for portal accounts and staff; services authenticate to each other with managed identities and password authentication is disabled on the database; Neo CRM workspaces are isolated in the database and storage layers (row-level security policies and composite foreign keys), with an isolation regression on every code change and a daily cross-workspace probe in production; sensitive actions are logged, and production access follows least privilege with full audit trails. Details are in the security notes.

12. Data breaches

If a personal data breach could affect your rights, we notify the regulator and you as the law requires: under PIPL we take remedial measures and notify immediately; under PDPA, if a breach is assessed as notifiable, we notify the Personal Data Protection Commission within 3 calendar days of that assessment. Where a breach affects workspace data we hold for a customer, we notify that customer within 72 hours of becoming aware of it.

13. Children

The site and services are intended for business users and not for anyone under 18. We do not knowingly collect personal data from minors; if you believe we have, contact us and we will delete it.

14. Changes to this policy

Material changes are reflected in the version and effective date in the header and communicated to contracted customers and workspace administrators at least 30 days in advance by email or in-app notice. Earlier versions are available on request. This policy is published in Chinese and English; if they differ, the Chinese version prevails.

15. Contact

Email: compliance@jumborca.com (the former privacy@ alias is no longer in use)
Mainland China: Suzhou Jumborca Software Technology Co., Ltd., Room 1907, GCL Plaza, Suzhou Industrial Park, Jiangsu
Singapore: Jumborca Pte. Ltd., 6 Raffles Quay, #14-02, Singapore 048580