Privacy notice

Last updated: 23 October 2026

This notice explains how Mihu AI Pte. Ltd. (UEN 202644374E) ("Mihu AI", "we", "us") collects, uses, discloses and protects personal data under Singapore's Personal Data Protection Act 2012 ("PDPA"). It covers visitors to this website, business contacts, and the people who contribute to our projects ("contributors").

1. Personal data we collect

Website visitors. This site does not use cookies, analytics or tracking scripts. Our hosting provider may keep standard server logs (such as IP address, browser type and time of request) for security and operations.

Contact form. If you use the contact form, we collect your name, email address, organisation (if given) and message, and use them only to respond to your enquiry. The form is processed by Web3Forms, a third-party form service, which delivers the message to us by email.

Business contacts. Name, job title, organisation, email address, phone number and the content of our correspondence.

Contributors. These include:

• identity and contact details: name, email address and country of residence;
• academic and professional background: institution, programme, year of study, degrees, CV and results of screening tasks;
• documents used to verify enrolment or qualifications;
• payment details needed to pay you;
• records of your work: tasks completed, review results and time records.

We do not collect NRIC, FIN, passport or similar national identification numbers, or copies of those documents, unless the law requires it or it is necessary to verify identity with a high degree of accuracy. In that case we will tell you why before collecting it.

2. How we use it

We use personal data to:

• respond to enquiries and manage business relationships;
• assess, onboard and verify contributors;
• assign, review and pay for work;
• maintain quality and keep a record of who wrote and reviewed each item;
• meet our contractual, accounting, tax and other legal obligations.

We collect, use and disclose personal data only with consent, or where the PDPA otherwise permits it, and only for the purposes we have told you about. We do not sell personal data.

3. Disclosure

We may disclose personal data to:

• service providers who support our operations, such as hosting, contact-form, email, payment and accounting providers;
• clients, where a project needs it, for example when a client asks for an anonymised contributor ID or a description of a contributor's qualifications for audit or quality purposes;
• professional advisers;
• authorities, where the law requires it.

We give clients the minimum needed and, where possible, use pseudonymous identifiers instead of names.

4. Transfers outside Singapore

Some of our service providers and clients are located outside Singapore, including in the United States. When we transfer personal data overseas, we take steps to make sure it receives protection comparable to the PDPA, as the PDPA requires, for example through contractual safeguards.

5. Protection

We use reasonable administrative, physical and technical safeguards. These include limiting access to staff and contributors who need it, signed confidentiality agreements, access controls and encrypted storage and transfer. No system is completely secure, but we review our safeguards regularly.

6. Retention

We keep personal data only as long as we need it for the purposes above or for legal and business reasons, such as tax and accounting records. After that, we delete it or anonymise it.

7. Client project data

When we process data on behalf of a client, we act as a data intermediary. That data is handled under the client's instructions and our agreement with them.

8. Data breaches

If a data breach is likely to cause significant harm or is of a significant scale, we will notify the Personal Data Protection Commission and, where required, the affected people, as the PDPA requires.

9. Your rights

You may ask to access or correct your personal data, or withdraw consent to its collection, use or disclosure, by contacting us through the contact form. If you withdraw consent, we may no longer be able to provide some services or continue a contributor engagement, and we will explain what that means for you. We will respond within a reasonable time and, for access requests, generally within 30 days.

10. If you are outside Singapore

Mihu AI is a Singapore company, and this notice is based on the PDPA. Depending on where you live, local law may give you additional rights. You can exercise those rights by contacting us through the contact form.

United States residents, including California. We do not sell personal information, share it for cross-context behavioural advertising, or use it to profile you for advertising. If a US state privacy law gives you the right to know, access, correct or delete your personal information, or to appeal our decision on a request, contact us through the contact form. We will not discriminate against you for exercising these rights. This site does not track visitors across third-party websites, so it does not respond differently to "Do Not Track" or Global Privacy Control signals.

11. Age

This site is not directed at children, and contributors must be at least 18 years old. We do not knowingly collect personal data from anyone under 18.

12. Changes

We may update this notice from time to time. The current version will always be on this page.