Mesy Data Processing Agreement

Provider: Majulah SG Pte Ltd (UEN 202129171K), 6 Ubi Road 1, #06-10, Wintech Centre, Singapore 408726 (“Majulah SG”, “we”, “us”). Customer: the organisation that has accepted the Mesy Terms of Service (“you”). Effective: 21 September 2026

This agreement is part of the Terms of Service. By accepting the Terms you accept it; no signature is needed. A signed counterpart is available on request from dpo@mesy.ai. On the handling of personal data, this agreement prevails over the Terms.

1. What it covers

This agreement covers Customer Data: the personal data you and your users put into or sync into your Mesy workspace. It does not cover the data we collect to run your account (who you are, your logins, how you use the product). That data is ours to protect under the full PDPA, and the Privacy Policy is our notice for it.

Sections 5, 8, 10, 11 and 13 survive termination for as long as we hold any Customer Data.

2. Our two roles

You are the organisation responsible for Customer Data under the Personal Data Protection Act 2012 (PDPA). You decide what goes into Mesy and why. You are responsible for your lawful basis, your notices to individuals, and for answering their access and correction requests.

We are your data intermediary (PDPA s.4(2) and (3)). For Customer Data our obligations are Protection (s.24), Retention Limitation (s.25) and breach notification to you (s.26C). We do not decide the purposes for which Customer Data is processed.

Business contact information. Under PDPA s.4(5) the Data Protection Provisions do not apply to a person’s name, title, business phone, business email and similar. Much of a CRM is exactly that. We apply the same security and retention rules to it as to all other Customer Data.

3. What we process

Individuals concerned: your own users, and the people whose data you place in Mesy: your customers, prospects, suppliers and their staff, and the correspondents in the mailboxes and channels you connect.

Sensitive data. Mesy does not detect, mask or specially handle NRIC/FIN numbers, financial account data or health data. What you put in is your decision and your responsibility.

4. We act on your instructions

We process Customer Data only to provide, secure and support the Service under the Terms and this agreement, on your further written instructions where we have agreed to them, or where the law requires it. Where the law requires it, we tell you first unless the law forbids that.

We do not use Customer Data for our own purposes, do not sell it, do not use it for advertising, and do not train our own models on it. Aggregated operational data that identifies no one (feature usage counts, error rates) is outside this restriction.

We do not read workspace content in the ordinary course of operating Mesy. A person at Majulah SG can see it only in a support session shown to your workspace by a visible banner and recorded in an audit trail, when investigating abuse, fraud or a security incident, or when the law requires it.

If we believe an instruction of yours would breach the PDPA, we tell you without undue delay and may pause the affected processing.

5. Security

We keep reasonable security arrangements to protect Customer Data against unauthorised access, use, disclosure, copying, modification or loss (PDPA s.24). At the effective date they include:

• Tenant isolation in the database. Workspace content is segregated by PostgreSQL row-level security, bound to the authenticated workspace on every request. A small enumerated set of connection and routing tables is reached before workspace context exists (sign-in, webhooks) and is scoped by explicit filtering instead; those tables hold credentials and routing data, not workspace content.
• TLS in transit for all access and all provider traffic.
• Encryption at rest. The database and object storage providers encrypt stored data at rest. Integration tokens and secrets are additionally encrypted with a separately held key; passwords are stored only as bcrypt hashes; refresh tokens only as hashes, in HttpOnly cookies scripts cannot read.
• Multi-factor authentication (TOTP and passkeys), role-based access control, per-record sharing rules.
• Signed webhooks, verified with constant-time comparison, for every inbound integration.
• An append-only change log; AI actions recorded against the user who initiated them; rate limiting; secret scanning, dependency audits, and static and test gates in the build pipeline.
• Nightly backups and a backup before each release, with an off-site copy; restores are drilled.
• Restricted administrative access; support access to customer content is banner-visible and audited (section 4).

A fuller description of these controls, with the evidence for each, is available on request from dpo@mesy.ai. We may change the controls over time without reducing the overall level of protection.

Your side. You are responsible for your users’ credentials, for configuring roles and sharing, for removing departed users promptly, and for deciding which mailboxes, calendars and channels to connect.

6. Sub-processors

You authorise us to engage sub-processors to provide the Service. The list, with what each one processes and where, is published at https://mesy.ai/subprocessors.

Change notice. Before a new sub-processor begins processing Customer Data we update that list and give your workspace administrators at least 30 days’ notice. If you object on data-protection grounds within that period and we cannot resolve the objection, you may terminate the affected part of the Service and we refund prepaid fees for the unused term.

We bind each sub-processor to protection obligations comparable to this agreement and remain responsible to you for its processing.

Providers you connect yourself (your Google Workspace, Microsoft 365, Telegram, Meta accounts) are your own sources. We access them only under the authorisation you grant and only to the scopes the Service requests.

7. AI providers

Mesy’s AI features send Customer Data to third-party AI providers as it is, not anonymised. Which provider receives what depends on the model your workspace administrator selects. Two flows ignore that choice: voice transcription always goes to OpenAI, and web research, where configured, goes to Tavily. Image capture can reach your configured fallback model, which may be from a different provider. The Privacy Policy (section 6) and the sub-processor list state this per feature and per provider, and are derived from the same server registry that drives the “Powered by this model” panel in admin settings.

Content sent to these providers can include full email bodies, images, voice audio and any personal data in CRM fields. Our contracts with each provider govern what it may do with that content. We do not train our own models on it.

AI output can be wrong. What an AI action needs before it takes effect is set by the permission tiers you configure; a fixed set of actions always requires human confirmation, and nothing AI-initiated leaves for the outside world without a human send. Reviewing AI output before acting on it is your responsibility.

8. Transfers outside Singapore

Our primary database and application servers are in Singapore, and our object storage is placed in Cloudflare’s Asia-Pacific region. Several providers process Customer Data outside Singapore, principally in the United States: every AI provider, the providers whose accounts you connect, and our monitoring providers. The sub-processor list names the location for each.

Where Customer Data leaves Singapore we transfer it only where the recipient is bound to a standard of protection comparable to the PDPA (s.26), which we establish through each provider’s data processing agreement and standard contractual clauses. For data you put into Mesy you remain the transferring organisation and keep your own s.26 obligations.

9. Helping you with individuals’ requests

Mesy gives you the means to read, correct, delete and export Customer Data so you can answer access and correction requests yourself. Where the product has no self-service means for a request, we help on reasonable notice; we may charge for help that is disproportionate in scope or frequency, and we say so first.

If an individual contacts us directly about data in your workspace, we do not answer substantively. We refer them to you and tell you they wrote to us.

10. Data breaches

If we have credible grounds to believe a breach has affected Customer Data, we notify your workspace administrators without undue delay (PDPA s.26C(3)(a)) with what we know: the nature and cause, the categories and approximate number of individuals and records affected, the likely consequences, and what we have done or plan to do. Where we do not yet know everything, we notify on what we have and add to it as the investigation progresses.

You decide whether the breach is notifiable and you notify the PDPC and affected individuals. A breach is notifiable when it is likely to result in significant harm to an individual, or affects 500 or more individuals; the PDPC expects the assessment within 30 days of becoming aware, and notification no later than 3 calendar days after you determine it is notifiable. We assist with your assessment and notification.

11. Export and deletion

Export. During your subscription and for 30 days after it ends, you may export Customer Data. The self-service export today is a per-object-type CSV of record fields, capped at 10,000 rows per type. Files, synced mail and calendar content, chat messages, notes, tasks and change history are provided as an operator-assisted extract on request.

Deletion. Within 30 days after the export window, we delete Customer Data from the live database, except what the law requires us to keep. Deleted data remains in backups until they age out on rotation, at most 30 days; we never selectively edit backups. Deletion of a workspace removes its files, media, change history and AI transcripts with the rest.

What deletion cannot do before then. The change log is append-only, so a value you correct or delete in a record can persist in the log until the workspace is deleted. When you disconnect a mailbox, calendar or channel, we stop syncing and delete its synced messages, events and metadata from the database; files already stored from it persist until the workspace is deleted.

The full retention schedule is in the Privacy Policy, section 12.

12. Audit

On request we provide what a service of this size can reasonably show: the security description in section 5, the sub-processor list, the retention schedule, and written answers to a security questionnaire.

You may audit our processing of your Customer Data once in any 12-month period, on 30 days’ written notice, during business hours, under confidentiality, at your cost, and not extending to other customers’ data or to sub-processors’ premises. We may meet an audit request with the documentation above. One further audit is permitted after a breach affecting your data.

13. General

Liability. The limitations of liability in the Terms apply to this agreement.

Governing law. Singapore law; the dispute provisions of the Terms apply.

Changes. We may change this agreement where the law or the Service changes, on 30 days’ notice to your workspace administrators, without reducing your protections. The current version is always at https://mesy.ai/dpa.

Contact. Data protection notices and enquiries: dpo@mesy.ai, Data Protection Officer, Majulah SG Pte Ltd, 6 Ubi Road 1, #06-10, Wintech Centre, Singapore 408726.