ABURA Data Exchange privacy notice

Last updated: 21 October 2026

Who we are

ABURA Data Exchange is run by 12BUTTERFLIES PTE. LTD., a Singapore company (UEN 201934184R), registered office 111 North Bridge Road, #08-11 Peninsula Plaza, Singapore 179098 ("we"), until ABURA has its own company.

Our data protection officer: jps@12butterflies.life, or by post to the address above. This is also our contact under Brazil's and Québec's privacy laws.

What we collect, and why

Starting: when you begin as a scout, data owner or buyer, we ask for your name and email, or take them from your sign-in, before the first question, and keep them at once with the role you chose and the time. That tells us who started, so we can help you finish, in our legitimate interests. If you do not finish, we delete them after 90 days, or at once if you ask us to.
One reminder: if you stop part-way, we may send you one email within 7 days with a link to finish. It has nothing promotional in it, we never add you to a mailing list, and the email itself tells you how to stop. Tick "Don't email me if I stop part-way" when you give your details and we will not send it.
Signing in: with Google, Microsoft, Apple, LinkedIn, GitHub, Hugging Face or Discord, we receive only your name and the email the provider has verified. With a passkey, we keep only its public key, with your name and email; the private key never leaves your device.
Scouts: name, email, city and country; if you choose, WhatsApp, LinkedIn and who introduced you; your network, your personal link code, and your agreement to the programme. To run the programme and reward you, under our agreement with you.
Introductions: when someone reaches ABURA through a scout's link, or a scout or our team tells us about them, we record which scout introduced them and as what (data owner, buyer or scout), their email, company and web domain, how they arrived, the time they first reached us, and our decision on the introduction. An introduction lasts 24 months. We use it to decide which scout, if any, earns a reward, under our agreement with that scout; to show each scout how far their introductions have gone; and to settle any question about who introduced whom, in our legitimate interests in paying scouts fairly and keeping evidence. Rewards paid to scouts are recorded with the amount and the date.
People at companies a scout tells us about: the company's details and, about you, only your role, how the scout knows you and their notes. To assess the company and contact it at work contact details, in our legitimate interests in finding data to list. We tell you in our first message, and within one month; you can object or ask us to delete it at any time.
Data owners: name, email, role, company and, if you give it, phone; your owner check and listing answers; preview-set files, checked automatically for personal data before anyone sees them; and your chat with our automated concierge. To list your data and match it to buyers, in our legitimate interests in working with your company through you, or under our agreement if you act for yourself.
Buyers: name, email, role and organisation; the data you need and what for; our approval; and the listings you ask about. To vet buyers before they see any listing, in our legitimate interests.
Valuation requests: company, your name, role and email, who introduced you, and your answers to 15 questions. To answer your request through our sister company that carries out valuations, in our legitimate interests.
Messages between owners and buyers: each message and when it was sent. Before delivery we automatically take out email addresses, phone numbers, web links, social handles and either side's names, and tell the sender; when something is taken out, we keep the original for our team only. Our team can read conversations and joins when asked, or after three removals in one conversation. To keep both sides anonymous, prevent fraud and dealing around ABURA, and keep evidence for disputes, in our legitimate interests.
Acceptances: the terms and version you accepted, a fingerprint of the words shown, the boxes you ticked, the time, your IP address, its country and your browser. To prove what was agreed, in our legitimate interests.
Signatures on our signing page: your name, title, company and email; each step (opening, confirming your email, signing or declining) with its time, IP address, country and browser; your typed name; and the document's fingerprint. To carry out and prove the agreement, in our and the other parties' legitimate interests. When everyone has signed, we seal the record with our digital key and each party receives a sealed copy.
Activity records: each action on the platform, with the account and the time. They show when an owner and a buyer were first introduced, in our legitimate interests.
Sanctions checks: the names of people and companies, and for a few countries under broad sanctions the country given, checked on our own computer against the UN, EU, UK and US sanctions lists when they reach us, daily, and before we pay, list or release anything. A person reviews any possible match, usually within two business days, and we tell you if we cannot go ahead. In our legitimate interests and, where it applies, to meet a legal obligation.
Every submission: its time and the country it came from.

Your name and email are needed to register you or reply; everything else is optional unless a form marks it as required. Please leave out health and other sensitive details.

Under Singapore's Personal Data Protection Act, we rely on your consent, including the consent the Act treats you as giving when you send us information for a purpose described here, and, where we say legitimate interests, on the Act's legitimate interests exception, which we have assessed and never use for marketing. Business contact details given for business are largely outside the Act.

Our automatic checks only take out or hold back details: they decide nothing about you, and a person looks at anything flagged or anything you ask us to review. A person approves buyers. The owner check gives an indicative read, never a decision. Our concierge answers only from our own library, using an AI model run by our hosting provider to read your answers. We never sell personal data.

Your right to object

Where we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling grounds or need the data for a legal claim. You can always object to emails from us: reply "no thanks" to any of them, or write to us, and we stop within 10 business days.

Who sees it

Our service providers, on our instructions: Cloudflare, Inc. (hosting, database, files, sending our emails and the concierge's AI model), Google (our mailboxes), PostHog, Inc. (site analytics, under "Cookies, storage and visit counts" below) and the AI assistants our team uses.
Our sister company that carries out valuations, for valuation requests only; we tell you its name on request.
Buyers: anonymised listings only, with the owner's agreement, never a scout's name, and an owner's name only in a deal they both sign.
The other side of a conversation: your messages after the check, without your name or contact details. An owner and a buyer are named to each other only in the deal they sign. We never show a buyer the name of a scout, or a scout the name of a buyer.
Scouts: for each introduction they made, how far it has gone (signed up, listed, deal agreed, paid) and their own rewards; the company name of a data owner they introduced, but for a buyer only its region, never its name, and never the name of the other side of a deal.
The other parties to an agreement you sign: the sealed copy, showing every signer's name, title, company, email, typed name, signing times, identity check, IP address, country and browser. An owner and a buyer sign together only the deal itself, so that is where each first sees the other's name and signing details. You agree to this when you sign, and anyone you show your copy to can check it against our published key.
Your sign-in provider, if you use one, and authorities where the law requires.

An hourly copy of new submissions and our daily backups sit on our secured computer, outside shared drives and code repositories.

Transfers abroad

We are in Singapore; our providers process data in the United States and in Cloudflare's data centre nearest you, and PostHog holds site analytics in its EU region, in Frankfurt, Germany. Neither the EU nor the UK has found Singapore's law equivalent to its own, so we apply their safeguards ourselves: for Cloudflare, Inc. we rely on the EU-US Data Privacy Framework and its UK and Swiss versions, with the European Commission's standard contractual clauses and the UK addendum as the fallback; for Google, on the standard contractual clauses in its data processing terms; for PostHog, Inc., a US company, on the standard contractual clauses and the UK addendum in its data processing agreement, for any access from outside the EU. For data leaving Singapore, every recipient is bound to comparable protection: Cloudflare by its Global CBPR and PRP certifications, the others by contract. Ask us for a copy of any safeguard.

How long we keep it

Started, not finished: 90 days, or until you ask us to delete it.
Scouts, data owners, buyers and concierge chats: 2 years after your last activity; a buyer we do not approve, 1 year. Once you accept our terms, your name, email, company and role, and your concierge chats, are kept as long as your acceptance records.
Leads and introductions: 3 years after we first record them; one whose client joins ABURA within its 24 months, 7 years after the last reward it can earn falls due. A scout's link code, and the email it belongs to: as long as any introduction or reward made under it is kept. Owner checks and valuation requests: 2 years after our last contact, unless an agreement follows.
Preview-set files: deleted within 30 days after you ask or the listing stops.
Site analytics, if you allow it: recordings of your visits, 30 days; other records of how you used the site, 1 year; the identifier on your device, up to 365 days.
Acceptance and activity records: 10 years after your account closes or the protection period ends, whichever is later. Messages, and the originals of any we changed: the same, counted from whichever side's account closes last.
Signing records: 10 years after the agreement ends; a declined or cancelled deal confirmation, 9 years; any other declined or cancelled document, 2 years.
Records of payments to scouts: 7 years after the financial year of payment.
Sanctions checks: 12 months if you do not go on to work with us; otherwise for as long as you do and 10 years after; a reviewed possible match, 10 years after the decision, or longer if your other checks are kept longer.
Backups: 14 days. Data you asked us for: until we answer, or 30 days after we refuse. Anything a claim or complaint needs: until it is settled.

A contract claim can be brought for 6 years under Singapore law, and our terms keep confidentiality for 3 years after an account or agreement ends, so we keep what proves an agreement for 7 years after the last day it could be broken. US sanctions law allows 10 years. Acceptance, signing and activity records cannot be changed while we keep them; when their time is up, we erase the personal details and keep only fingerprints. Everything else is then deleted or anonymised.

How we keep it safe

Our team reaches the data only through our hosting provider's sign-in. Sign-in links, signing links and codes are kept only as one-way fingerprints, files are checked before anyone sees them, and our private copies sit in a folder only our team can open. If a breach could cause you significant harm, we will tell you, and the authorities the law requires, without undue delay.

Your rights

Wherever you live, you can ask whether we hold your data, for a copy, where it came from and how we used or disclosed it over the past year, and to correct it. Depending on your law, you can also ask us to delete, anonymise, restrict or transfer it. You can withdraw consent at any time; we tell you the effect and stop within 10 business days. Acceptance, signing and activity records, and message originals, are evidence of what happened, so we add your correction alongside rather than change them, and keep them while a legal claim may need them.

We may need to confirm who you are. We reply free of charge within the time your law sets: 15 days in Brazil, one month in the EU and the UK, 30 days in Singapore and Canada, and otherwise one month. If we cannot act, we tell you why and that you can complain.

Complaints

Write to us with "Complaint" in the subject line; we acknowledge it within 30 days. You can also complain at any time to the authority where you live: Singapore's Personal Data Protection Commission, your EU data protection authority (in Portugal, the CNPD), the UK's Information Commission, Brazil's ANPD, Switzerland's FDPIC or Canada's Privacy Commissioner.

Cookies, storage and visit counts

We set three strictly necessary cookies, only when you sign in: abura_id keeps you signed in for 30 days or until you sign out; abura_state secures a sign-in with a provider, for at most 10 minutes; abura_pk secures a passkey sign-in, for at most 5 minutes. The only other cookie is the analytics cookie below, set only if you allow it.

Your browser keeps your form answers on your device so you can come back to a form, and they stay there after you send them until you clear this site's data; signing out removes your scout profile. Your name and email reach us as soon as you give them, before the first question.

If you open ABURA through a scout's link, your browser keeps that scout's link code, and the time you arrived, on your device, so that if you register or send us anything within 24 months we know which scout introduced you. It reaches us only with something you send us, the page ignores it after 24 months, and a later scout's link replaces it. You can remove it at any time by clearing this site's data.

We count visits with no cookies and nothing stored on your device. The page sends one count when you arrive and one for each section you read; we keep only daily totals by country and which website or scout link a visit came from, never your IP address or browser. You can object by writing to us.

Separately, to improve the site, we use PostHog, run for us by PostHog, Inc., which holds the data in its EU region, in Frankfurt, Germany. Your browser sends everything through abura.io, never to PostHog directly, and our sign-in cookie is never passed on. A small banner asks you once whether we may record how you use the site. Until you choose, nothing is stored on your device and nothing is recorded.

If you allow it, PostHog stores an identifier on your device, in a cookie whose name begins ph_ and ends _posthog and in your browser's local storage, for up to 365 days. It records the pages you open, where you click and how far you scroll, and recordings of your visits with everything you type hidden. This rests on your consent.

If you say no, nothing is stored on your device except your choice, which stays in your browser's local storage, and nothing is sent to PostHog. If your browser sends Global Privacy Control or Do Not Track, we take it as a no and show no banner.

Whatever you choose, we never record the sign-in pages, the owner, buyer and scout areas or the signing pages: if you allowed it, they send PostHog only a count of the pages opened, never a recording. PostHog keeps no IP address with what it records. We do not create a profile of you in PostHog or tell it who you are, so we can find what it holds about you only if you send us the identifier from your browser. To change your mind, use "Privacy choices" at the foot of any page, or clear this site's data; if you withdraw, we remove the identifier and from then on treat you as a no.

Children

ABURA is not for anyone under 18; if we find we hold data from someone under 18, we delete it.

Changes

We will update this notice and its date when our practices change, email you about important changes, and tell you first if ABURA's own company is to take over.

Back to ABURA