Privacy Policy

1. Introduction

Sybil Pte Ltd ("we," "our," or "us"), operating under the brand name QuantQuest, is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our QuantQuest financial planning platform.

This policy applies to all users of QuantQuest, including financial advisers, their clients, and members of the public who access adviser profile pages or complete assessments. We capture your consent at specific points: account creation (Terms of Service acceptance), AI Copilot activation (AI Copilot Terms acceptance), Public Hub testimonial submission, and Lead Generation Tool submission (when you tick “may contact me” and send). This Privacy Policy explains how data collected at these points is processed.

2. Information We Collect

3. How We Use Your Information

We use the collected information for the following purposes:

• Providing and maintaining our financial planning services
• Processing transactions and managing subscriptions
• Personalizing user experience and improving our platform
• Communicating updates, features, and support
• Complying with legal obligations and regulatory requirements
• Detecting and preventing fraud or security issues
• Analyzing usage patterns to enhance service quality
• Facilitating connections between public users and financial advisers through our Lead Gen Tools

3A. Aggregated and Anonymised Data

We may create and use fully anonymised and aggregated data derived from use of our Service — with all identifiers removed in accordance with the PDPC Guide to Basic Anonymisation — for purposes including product improvement, research, model training and evaluation, benchmarking, and business operations. Once data is properly anonymised, it is no longer personal data under the PDPA and is not subject to the consent, access, or correction obligations applicable to personal data.

If we materially change how we use anonymised or aggregated data in a way that would affect you, we will update this Privacy Policy and notify you in accordance with Section 14.

4. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With your consent: When you explicitly agree to share information
• Service providers: With trusted third parties who assist in operating our platform (under strict confidentiality agreements)
• Legal requirements: When required by law, court order, or governmental request
• Business transfers: In connection with a merger, acquisition, or sale of assets
• Protection of rights: To protect our rights, privacy, safety, or property
• Lead Generation: When you submit your contact information through a quiz or assessment, your information will be shared with the specific financial adviser as described in Section 5 below

5. Lead Generation and Adviser Referrals

When you complete a quiz or assessment from a financial adviser (on their Hub page or through a link they shared) and choose to send your answers, the following applies:

Self-Tests and Check-Ins

• Self-tests (such as Money Personality and Lifestyle Discovery): Your result is yours. You see it without giving contact details, and you choose whether to send it to the adviser.
• Check-ins: A check-in from an adviser asks who you are first, so the adviser knows whose answers they are.
• Your client record: If you are already that adviser's client, your answers can be filed into the client record the adviser keeps about you. We match them by your name and mobile number. The adviser confirms any match that is not certain, and can undo a match that is wrong.
• AI snapshot: An AI may write a short snapshot from your answers. It is not financial advice.
• No codes: You never need a one-time code to send your answers.

Information Shared with Advisers

When you send your answers or result, we share the following with that financial adviser:

• Your name
• Your mobile number
• Your email address (if provided)
• Your quiz responses and results
• Your personality type and associated insights (for personality quizzes)
• The record of your consent to be contacted
• The date and time of your submission

How Advisers May Contact You

On a quiz anyone can open (an adviser's Hub page or a shared quiz link), you agree to be contacted by ticking “may contact me” and sending. The box starts unticked, and you cannot send your answers or details until you tick it. Ticking it is your clear and unambiguous consent for that financial adviser to contact you about that quiz or assessment by:

• WhatsApp messages
• Phone calls
• Email (if provided)

We keep a record of your consent: the exact words you ticked and the time you sent them, and where available the version of that wording and the IP address it came from.

A quiz your adviser sent only to you, as their client, goes straight to them when you finish. They already hold your details under the consent you gave them as their client.

Do Not Call Registry: The adviser remains responsible for following the Do Not Call provisions of Singapore's PDPA, including where your number is on the Do Not Call (DNC) Registry.

Adviser Responsibilities

Financial advisers receiving your information through QuantQuest have agreed to:

• Handle your data in accordance with Singapore's PDPA
• Contact you only for legitimate financial advisory purposes
• Respect your right to withdraw consent at any time
• Cease contact within 10 business days of receiving a withdrawal request
• Not share, sell, or transfer your information to any third party
• Maintain appropriate records of consent and communications

Withdrawing Consent

You may withdraw your consent to be contacted at any time by:

• Informing the financial adviser directly (via WhatsApp, phone, or email)
• Emailing us at dpo@quantquest.sg with the subject line "Withdraw Lead Gen Consent"

Upon receiving your withdrawal request:

• We will notify the adviser within 2 business days
• The adviser must cease all contact within 10 business days
• We will keep a record of your withdrawal request, and delete your quiz answers and contact details if you ask us to

Please note that withdrawing consent does not affect the lawfulness of any contact that occurred before the withdrawal.

Data Retention for Leads

• Your answers, contact details and consent record: Kept in the adviser's account until the adviser deletes them, you ask us to delete them, or the adviser's account closes (see Section 8)
• If you are or become the adviser's client: Answers filed into your client record are kept according to the adviser's client data retention policy
• If you withdraw consent: We keep a record of your withdrawal request

5A. Testimonial Collection

When you submit a testimonial through our authenticated testimonial link, the following applies:

• Your name and testimonial content will be displayed publicly on the requesting adviser's Hub page once the adviser approves it. Until then it is not shown
• The “Client-submitted” label on your testimonial indicates only that it was submitted through our platform — it does not verify or endorse the content
• You may withdraw your consent and request removal of your testimonial at any time by contacting the adviser directly or emailing dpo@quantquest.sg
• Upon receiving your withdrawal request, we will remove the testimonial within 5 business days
• Testimonial data will be deleted when the adviser's profile is deactivated or upon your withdrawal of consent, subject to any legal retention requirements

5B. Google Calendar Integration

When you choose to connect your Google Calendar to QuantQuest, we access your calendar events using the Google Calendar API. Specifically:

• We access the scope “calendar.events” which allows us to view and manage events on your Google Calendar, including creating events from within the QuantQuest platform.
• Your calendar events are cached securely on our servers to display them alongside your client schedules within the QuantQuest platform.
• We do not share, sell, or transfer your Google Calendar data to any third parties.
• We do not use your Google Calendar data for advertising or any purpose other than displaying it within your QuantQuest calendar view.
• You can disconnect your Google Calendar at any time from Settings → Calendar → Disconnect. Upon disconnection, all cached calendar data is immediately and permanently deleted from our servers.
• Google Calendar data is encrypted at rest on our servers.
• Google Calendar data is stored in a separate database table from all other application data and is never transmitted to, processed by, or used as input for any AI or machine learning service, including our AI Copilot feature.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data Security

We implement robust security measures to protect your information:

• TLS 1.2 or 1.3 (with AES-256 cipher suites) for all data in transit
• AES-256 encryption at rest for sensitive financial information
• Regular security audits and vulnerability assessments
• Access controls and authentication protocols
• Employee training on data protection practices

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but commit to using industry best practices.

Data Breach Notification: In the event of a data breach that meets the notifiability threshold under PDPA Part 6A, we will notify the Personal Data Protection Commission (PDPC) as soon as practicable, and in any case no later than 3 calendar days after completing our assessment that the breach is notifiable. Where the breach is likely to result in significant harm to affected individuals, we will notify those individuals as soon as practicable.

7. Your Rights Under PDPA

Under Singapore's Personal Data Protection Act (PDPA), you have the following rights:

• Access: Request access to personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Withdrawal: Withdraw consent for data collection and use
• Data portability: Request your data in a structured format
• Deletion: Request deletion of your personal data (subject to legal obligations)

To exercise these rights, please contact our Data Protection Officer at dpo@quantquest.sg.

For Lead Gen participants: You may also exercise these rights by contacting the financial adviser directly. The adviser is obligated to respond to your request or forward it to us for processing.

8. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Active account data: Retained while your account is active
• Financial records: Retained for 7 years per MAS requirements
• Communication records: Retained for 5 years
• Quiz and lead data: Kept in the adviser's account until the adviser deletes it, the person who sent it asks us to delete it, or the adviser's account closes. The record of each person's consent to be contacted is kept with their answers
• Adviser Hub terms acceptances (advisers only): Kept after the adviser's account closes, as evidence of the attestations the adviser gave (who accepted, the version, a fingerprint of the exact words, the time and the IP address)
• Testimonial data: Retained while the adviser's profile is active, deleted within 90 days of profile deactivation or upon withdrawal of consent by the testimonial submitter
• AI Copilot conversation data: Retained while the adviser's account is active. Individual sessions may be deleted by the adviser at any time through the AI Copilot interface. Upon account closure, AI conversation data is deleted within 90 days unless retention is required by law.
• Anonymized analytics data: May be retained indefinitely

Upon account closure, we will delete or anonymize your data within 90 days, except where retention is required by law or is described above.

9. International Data Transfers

Your data is primarily stored in Singapore. If we transfer data outside Singapore, we ensure:

• The receiving country has adequate data protection laws
• Appropriate contractual clauses are in place
• Your rights remain protected regardless of location

One-Time Codes: We use a third-party messaging provider to send one-time codes by WhatsApp when advisers sign up or sign in. The provider may process the adviser's phone number on servers located outside Singapore. The provider is bound by contractual obligations to protect your data in accordance with standards comparable to Singapore's PDPA. People who answer a quiz are never sent a code.

Payment Processing: Our third-party payment processor may process payment data on servers located outside Singapore. Transfer is governed by the provider's standard data processing agreement and PCI-DSS Level 1, SOC 1/2 Type II, and ISO 27001 certifications.

AI Processing Services: The following text-inference description does not cover Meetings Preview audio transcription. The AI Copilot uses a third-party large language model (LLM) service operating from a Singapore-region deployment. The underlying infrastructure holds MTCS SS 584 Level 3, ISO 27001 / 27017 / 27018 / 27701, and SOC 2 Type II certifications. Before transmission, Client Data passes through automated identifier-masking that removes NRIC numbers, FIN numbers, Singapore mobile numbers, email addresses, bank account numbers, and Singapore 6-digit postal codes. This masking does not constitute anonymisation under the PDPC Guide to Basic Anonymisation; residual personal data may be transmitted in masked form. By design, prompts and outputs are not retained at the inference layer, customer data is not used for model training, and cache content is isolated per-tenant. Inference compute may be scheduled across a global compute pool excluding mainland China; this transient cross-border processing is governed by contractual data processing terms and APEC CBPR/PRP certifications, both recognised mechanisms under PDPA Section 26. Provider, infrastructure, and certification details are available to financial-adviser firms on request at dpo@quantquest.sg under NDA. For full details on AI data processing, refer to the AI Copilot Terms of Use.

Quiz Snapshots: Where an adviser's quiz offers a short AI snapshot, it is written by the same Singapore-region AI service described above, from your answers and your first name. NRIC-style numbers, bank account numbers and long runs of digits are removed from free-text answers before they are stored.

Meeting Audio Transcription: Meeting audio, live from the phone and again after the meeting, is sent to a third-party speech-to-text provider. Its processing may take place outside Singapore, including in the United States or the European Union. The provider receives the actual audio, including voices and anything said in the meeting, and the phone's IP address. Audio is not masked before it is sent. With the final transcript we also send a list of words to listen for (the names of the client, family members and the adviser, and insurer and plan names), so names are spelled correctly; the live words get only insurer, plan and common Singapore terms. The provider is bound by contractual data-protection terms, and we ask it to delete each transcript as soon as we have received it. We do not promise that it keeps no copy of the audio. Deleting a meeting in QuantQuest does not delete data the provider keeps under its own terms.

Our Service Providers: We use carefully selected service providers for hosting, storage, AI processing, meeting transcription, messaging, email and payments. Each is bound by contractual data-protection terms. To find out which providers handle your data and where, email our Data Protection Officer at dpo@quantquest.sg.

Frontend Hosting: Our third-party frontend hosting provider may process requests through servers located outside Singapore for performance purposes. No personal data is stored at these locations beyond transient request processing.

10. Children's Privacy

Our Service is designed for and marketed to financial advisers and adult clients seeking financial planning services, and is not intended for individuals under 18. While we do not implement active age verification at every submission point (such as Lead Generation Tools), we do not knowingly collect personal data from individuals under 18. If we become aware that we have collected personal data from someone under 18, we will promptly delete the data and any associated account. Parents or guardians who believe their child has submitted personal data may contact dpo@quantquest.sg for immediate removal.

11. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in securely
• Remember your preferences and settings
• Analyze platform usage and performance
• Provide personalized features
• Track quiz completion for analytics purposes

On our public website we use the following third-party analytics and advertising measurement tools:

• Third-party website analytics — to understand website traffic and how visitors use our pages.
• Third-party advertising measurement — to measure the performance of our advertising and attribute sign-ups to our ads. The pixel collects information such as your IP address, browser information and the pages you visit. If you create an account, a hashed (non-readable) version of your email address may be shared with the advertising measurement provider to improve measurement accuracy.
• Third-party experience analytics — to analyse how visitors interact with our pages so we can improve the experience.

These tools operate on our public website only and are separate from the client data our platform processes on behalf of advisers, which is never used for advertising.

You can manage cookie preferences through your browser settings or ad-blocking tools, and the advertising providers offer their own preference controls. For provider details or help finding those controls, contact dpo@quantquest.sg. Disabling cookies may limit some features of our Service.

12. Third-Party Links

Our Service may contain links to third-party websites, including financial adviser websites and social media profiles. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

13. Adviser Profile Pages

Financial advisers may create public profile pages on QuantQuest that are accessible without login. These pages may display:

• Adviser's name and professional title
• Profile photo
• Professional biography and specializations
• Years of experience and credentials
• Testimonials the adviser has approved (if enabled; see Section 5A for testimonial collection terms)
• Links to quizzes and assessments

Information displayed on adviser profile pages is provided by the adviser and is their responsibility to keep accurate and compliant with applicable regulations.

14. Updates to This Policy

We may update this Privacy Policy periodically. For changes that materially affect how we collect, use, or disclose personal data, we will:

• Post the updated policy on this page with a new version reference
• Update the “Last updated” date
• Notify affected users by email
• Where the change introduces new processing purposes or new data categories, require re-acceptance via the next login or platform interaction before continued use of affected features

Changes that do not materially affect personal data practices (such as clarifications, formatting, or contact information updates) will be notified by the methods above without requiring re-acceptance.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

For Lead Gen specific inquiries:

• The financial adviser directly (their contact details are on their profile page)
• Our DPO at dpo@quantquest.sg