Privacy policy

Draft · Last updated 15 October 2026

Ohayo helps people send short, personal hello videos to the people who are new to them. This policy explains what information Ohayo handles, why, who helps us handle it, and what you can ask us to do with it.

I’ve tried to write it in plain English. If anything is unclear, email me at hi@ambidextrouslabs.com.

Who we are

Ohayo is run by Ambidextrous Labs, a sole proprietorship registered in Singapore (UEN 53366238M), registered at 14 Robinson Road, #08-01A, Singapore 048545. In this policy, “we” and “us” means Ambidextrous Labs.

Ambidextrous Labs is a sole proprietorship (Mel decided 15 October). Please confirm how a sole proprietorship should name itself here, and whether we need to name a Data Protection Officer contact (PDPA section 11). Mel is the contact for now.

Two kinds of people

Ohayo handles information about two groups, and our role is different for each.

• Customers are the businesses and people who sign up for Ohayo and send hellos. For your account details, we decide how the information is used.
• Recipients are the people our customers welcome: their new signups, clients and leads. A customer decides who to add and what to send. We handle recipients’ information on the customer’s behalf, only to deliver and track their hellos.

If you got a hello and have a question about why, the quickest route is to reply to that email, which goes to the person who sent it. You can also email us and we’ll help.

We think we are a “data intermediary” under Singapore’s PDPA for recipients’ data, and a “processor” under the GDPR, with each customer as the organisation or controller. Please confirm, and tell us whether we need a separate data processing agreement for customers, and whether EU or UK recipients mean we need an EU/UK representative.

What we collect

About customers

• Account details: your name, email address and, if you sign in with Google, your Google profile name and picture.
• Business details: your business name, legal name and postal address (these go in the footer of every email, as anti-spam laws require), your logo, colours and email wording.
• Billing: your plan and billing history. Payments are handled by Stripe. We never see or store your full card number.
• Your phone: a notification token, if you turn on notifications, so we can tell you when someone new arrives or watches.
• Feedback you send us from Settings, with the app version, screen and browser type so we can fix things.

About recipients, on our customers’ behalf

• Who they are: name, email address, which product or business they joined, and when. This comes from the customer, their app or form, an import, or Zapier or Make.
• Last active date, if the customer’s app sends it, so the customer can see whether people they greeted stay.
• The video recorded for them, plus a still picture and a short moving preview made from it.
• What happened: whether the email was delivered and opened, whether the link was clicked, whether the video was played and how much of it, any emoji or note they send back, and whether they unsubscribed.

From the “Want to see one first?” form

Your name, email, anything you write in the note, and which page or email sent you to us. We use it to send you a hello about Ohayo. Your network address is held in memory for a few minutes to stop spam, and isn’t stored.

Videos and faces

Videos are recorded on the customer’s phone. The touch-up effects (background blur, soft glow and virtual makeup) run on the phone itself. We don’t analyse faces on our servers, and we don’t use videos to identify anyone.

Each video is only reachable through its own private, unguessable link. Search engines are told not to index watch pages.

The makeup and blur filters find a face on the phone using Google MediaPipe. Nothing about the face leaves the phone except the finished video. Please check whether this needs any extra wording for biometric laws, for example in Illinois or Texas if we have US customers.

How we use it

• To run Ohayo: line people up, store and process videos, send emails and show watch pages.
• To show customers how their hellos are doing.
• To bill customers and keep records the law requires.
• To keep Ohayo safe, stop abuse and fix problems.
• To tell customers about important changes to Ohayo.

We don’t sell personal information, we don’t use it for advertising, and we don’t use customers’ videos or recipients’ details to train AI models.

Who helps us

We use a few trusted companies to run Ohayo. They only get what they need to do their part.

Please check the wording on overseas transfers (PDPA Transfer Limitation Obligation and GDPR Chapter V). Ohayo’s database, video storage and processing are all in Google’s Singapore region (asia-southeast1). Resend and Stripe are in the US. Please advise whether to rely on each provider’s standard contractual clauses.

Emails we send for customers

Every hello goes out with the customer’s name as the sender and their own email for replies. Each one includes the customer’s business name and postal address, why the person is getting it, and a one-click unsubscribe link. Once someone unsubscribes, Ohayo won’t let that customer send them another hello.

Customers agree in our terms to only send hellos to people who have signed up, become a client or asked to hear from them.

Please check this against Singapore’s Spam Control Act, the US CAN-SPAM Act and the EU and UK rules on electronic marketing, and whether a welcome video counts as a marketing message.

How long we keep it

• Customer accounts: while the account is open, then for 90 days after it closes in case you change your mind, then deleted.
• Videos and recipients’ details: while the customer’s account is open, unless the customer deletes them sooner. Deleting someone in Ohayo hides them straight away and removes them for good after 30 days.
• Billing records: for five years, as Singapore tax law requires.
• Unsubscribes: kept so we keep honouring them.

These periods are proposals. Ohayo currently keeps deleted people as a soft delete with no automatic purge, so we need to build the clean-up before we can promise these numbers. Please also confirm the record-keeping period.

Cookies and storage

This site and the app don’t use advertising or tracking cookies. The app keeps you signed in using your browser’s storage. This site remembers which email or page sent you here for 30 days, in your browser only, so we know how people find Ohayo.

Keeping it safe

Information is encrypted on its way to us and while stored. Each customer’s data is kept separate, and only that customer’s team can see it. Watch links are long, random and private to one person. If something ever goes wrong, we’ll tell affected customers and the authorities as the law requires.

PDPA requires notifying the PDPC within 3 calendar days of assessing a notifiable breach. Please confirm what we should promise customers in the terms or a DPA.

Your choices and rights

You can ask us to see, correct or delete the personal information we hold about you, or to stop using it. Customers can do most of this themselves in Settings.

If you’re a recipient, the customer who sent your hello controls your information, so we’ll pass your request to them and help them answer it. You can unsubscribe from any hello with the link at the bottom.

Email hi@ambidextrouslabs.com and we’ll reply within 30 days. If you’re not happy with our answer, you can complain to the Personal Data Protection Commission in Singapore, or your local data protection authority.

Children

Ohayo is for businesses and isn’t meant for anyone under 18 to use. Customers shouldn’t send hellos to children.

Please confirm the age wording. Customers like Chico (a parenting app) greet parents, not children, but a customer could add a child’s email.

Changes

If we change this policy in a way that matters, we’ll email customers at least 14 days before it takes effect. The date at the top shows when it last changed.

Contact

Ambidextrous Labs (UEN 53366238M) · 14 Robinson Road, #08-01A, Singapore 048545 · hi@ambidextrouslabs.com