Privacy Policy

Citruswind Pte. Ltd., Singapore (Citruswind, we, us or our), operates NanoMaxa, the B2B AI marketplace brand. This Privacy Policy explains our handling of personal information in connection with the website, business enquiries, provider applications and available account services.

Some features may be disabled or unavailable. References to forms, accounts or marketplace workflows describe processing when those features are enabled; this Policy does not enable them. Online payment processing, production verified-purchase reputation and AI matching are not currently offered.

• Public browsing: information needed to serve pages, searches and filters you request. Infrastructure may process network/IP information, request paths, timestamps, browser/device information, response codes and errors for delivery, security and troubleshooting.
• Business enquiries, when enabled: name, email, company name, website where supplied, job title and optional company/industry information; workflow and business requirements; current processes and systems; indicative volume, hours, expected users, budget and timeline; and any selected public Agent and demo/pilot interest.
• Related submission metadata: submission identifiers, timestamps, source/intent, limited registered campaign attribution, signed-form validation and retry records, keyed digests and short-lived abuse-control counters. Network/email rate-limit keys are HMAC-derived rather than raw IP/email values. Enquiry contact details are stored separately in the enquiry itself. Private related-enquiry grouping is a possible-correlation signal, not verified identity or company ownership.
• Provider applications, when enabled: individual/company applicant details, declared country, contact name/email, website/GitHub links, proposed Agent descriptions and value proposition, model/provider information, integrations, data access, permissions, human-approval declarations, proposed pricing, demo link and support details.
• Accounts and authentication, when enabled: email, account/profile identifiers, stored role and company association, sign-in/session information and security records. An enquiry alone does not create an account or assign company membership.
• Available account workflows and correspondence: information you provide in proposals, agreed scope, authorized order/delivery interactions or messages to us, together with records necessary to administer those interactions. This does not imply that production transaction features are available.

Please provide only information needed for the request. Do not submit passwords, API keys, production access tokens, identity documents, payment-card or bank credentials, customer datasets or other unnecessary sensitive information. If you provide someone else's information, ensure you have authority to do so and have given any required notice.

We use enquiry information to evaluate and respond to business requests and operate the marketplace. Depending on the service you use, purposes include:

• Understanding requirements, evaluating relevant solutions, preparing or discussing proposals and coordinating an agreed engagement.
• Assessing provider applications and declarations, administering listings and communicating about participation.
• Operating accounts and authorized workflows, maintaining business records and supporting users.
• Preventing abuse, validating submissions, ensuring retry consistency, protecting access and investigating technical or security issues.
• Measuring limited marketplace activity and improving the website using the first-party measurements described below.
• Meeting applicable legal requirements, responding to lawful requests and establishing, exercising or defending legal claims.

We collect, use and disclose information for notified purposes with consent where required, or as otherwise permitted or required by applicable law. We do not treat this Policy as blanket consent to unrelated uses. We do not sell personal data.

Access is limited to authorized personnel and service providers who need information for the purposes above. Current infrastructure includes Vercel for application hosting and Supabase for database, authentication and private storage services, together with their relevant infrastructure subprocessors.

We may share relevant request information with an independent solution provider where you request an introduction or where sharing is necessary for an engagement you have agreed to pursue. We limit sharing to what is needed and provide additional notice or obtain consent where required. Submitting an enquiry does not make its contents public or automatically disclose it to every provider.

Professional advisers and authorities may receive information where reasonably necessary for advice, legal obligations or claims. We require service providers handling information on our behalf to use it for the authorized services and protect it under appropriate contractual arrangements.

Internal review findings, private enquiry histories and operational security records are not public listing information. Following an external demo or provider link takes you to that third party's service and its own privacy terms. We do not currently send enquiries to an AI matching service or a live payment processor.

Our infrastructure and service providers may process or store information outside Singapore. We do not promise Singapore-only storage. Where personal data is transferred overseas, we will take steps required under Singapore's Personal Data Protection Act, including appropriate contractual or other legally recognized safeguards to ensure a comparable standard of protection. Processing locations and arrangements must be considered when appointing or changing service providers.

When authentication is enabled and you sign in, necessary authentication/session cookies support sign-in and protected account access. They are separate from analytics. You can manage cookies through browser settings; blocking necessary cookies may prevent account functions from working.

Homepage action clicks may generate first-party structured events containing fixed action/placement/destination information and a timestamp. Optional first-party public activity measurement, when enabled, records bounded page/Agent/form-start events and limited registered campaign parameters. Enabled business submissions record a conversion event with the committed submission. Public activity storage is disabled by default; a disabled public-analytics setting does not suppress operational logs or conversion records for enabled submissions.

Application analytics does not use tracking cookies, persistent visitor IDs, fingerprinting, cross-site tracking or third-party analytics SDKs. It does not include names, emails or requirement text in event payloads, or store full referrers as analytics attribution. Technical infrastructure logs are separate and may contain request/network information as described above.

We use reasonable technical and organizational measures appropriate to the information, including restricted access, tenant authorization, private storage for private files and server-side submission checks. No website, transmission or storage system can be guaranteed completely secure.

We do not intentionally place form contents, credentials or sensitive documents in application diagnostic or analytics logs. We assess suspected personal-data incidents and make notifications where required by applicable law. Please use the contact below to report a privacy concern without sending sensitive evidence through an unagreed channel.

Our default retention period for inactive enquiries is 12 months after the last meaningful contact. We then delete or anonymise the enquiry information unless it remains reasonably necessary for an active business relationship, a legal obligation, or the establishment, exercise or defence of legal claims. We review any longer retention against that continuing need.

This is an operational retention policy, not a claim that the website automatically deletes records on a fixed date. Related correspondence, private notification records and submission/retry evidence are considered when carrying out retention or deletion. Limited records needed to honour a legal obligation or protect against abuse or repeated processing may need to be retained separately.

Provider applications, account records and other operational information are kept only for as long as reasonably needed for the notified purposes and legitimate legal or business requirements. Detailed analytics and technical logs should be retained for a proportionate period rather than indefinitely. Short-lived rate-limit records are subject to expiry and operational cleanup. We do not claim that all hosting logs or backups use a single retention period.

Deletion from active systems may not immediately remove restricted backup copies, which are removed through the applicable backup lifecycle. Retained backup information should not be restored to ordinary use except for recovery or other necessary legal/security purposes, with applicable deletion requests reapplied where appropriate.

You may contact us to request access to personal data we hold about you, information about its use or disclosure as provided by applicable law, or correction of inaccurate or incomplete information. You may also request deletion or anonymisation, or withdraw consent to future collection, use or disclosure where processing depends on consent.

Requests are subject to applicable law, identity/authority verification and relevant exceptions. Deletion is not an unconditional right to remove records that must lawfully be retained. We will explain relevant limitations and any consequences for providing a service. We respond within applicable statutory timeframes; if an access request cannot be completed within the applicable period, we will provide the required notice. Any permitted access fee will be explained before proceeding.

Please identify the information or service concerned and provide enough detail for us to locate the record. We do not need your password. You can raise concerns through the same privacy contact, and this Policy does not limit your ability to contact Singapore's Personal Data Protection Commission.

Direct privacy requests, questions and business enquiries to Citruswind Pte. Ltd., Singapore, using the published business contact below. Please identify your request as a privacy request where applicable.

Contact configuration pending: PUBLIC_BUSINESS_EMAIL must be set to an approved Citruswind business/privacy contact address. No contact email has been published yet. Contact details will appear here and on our Contact page when configured.

Do not include passwords, API keys, identity documents, bank details or customer datasets in a request. We may ask for proportionate information to verify a request and protect others; do not send sensitive documents unless a separately agreed secure process requires them.

We may update this Policy to reflect changes in our services, processing or legal requirements. The effective date above identifies this version. Material changes will be communicated as required by law, including additional notice or consent where necessary before a new purpose is introduced.