Privacy Policy

Slash UI Pte. Ltd. ("Slash UI", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website or use our services.

We are a Singapore company and the controller of the data described here. We handle personal data in line with the Personal Data Protection Act 2012 (PDPA). Visitors in the European Economic Area and the United Kingdom have the additional rights set out in section 10, and residents of California have the rights set out in section 11.

We collect the following types of information:

• Enquiry information: when you submit the enquiry form on this site we collect your name, your business name, your email address, your mobile number, and your team size. Every one of these is a field you fill in yourself.
• Project information: details about your business or project that you share with us during consultations, by email, or on a call.
• Usage data: how you interact with this website, including the pages you view, the referrer that brought you, your approximate location, your device type, your browser, and events such as opening our enquiry or booking dialog. This is collected by Google Analytics, only where analytics is switched on, and is described in section 3.
• Technical data: your IP address and request headers, which our hosting, DNS and network providers process in order to serve the page to you and to protect the site from abuse. This happens for every visitor, because a page cannot be delivered without it.

We do not ask for, and this website does not collect, payment card details, government identifiers, or any special categories of personal data. We do not knowingly collect personal data from anyone under 16.

This site loads the Google tag (gtag.js) in order to run Google Analytics 4, under the measurement ID G-7XES5PEVDN. It is the only analytics or tracking tool on the site. There are no advertising, remarketing, conversion or social media tracking tags here, and the advertising signals in our tag configuration are switched off unconditionally, in every country, rather than left to a setting.

A notice asks for your choice, and where you are decides what happens before you answer:

• In the EEA, the UK and Switzerland, analytics is off until you accept it. No analytics cookie is set and no measurement is recorded while the notice is waiting. This is Google Consent Mode holding the tag in a denied state, not merely a banner drawn on top of a tag that is already running.
• Everywhere else, including Singapore, analytics starts on and the notice is your opportunity to turn it off. This is the notification and deemed consent the PDPA provides for, and the opt-out that California law requires.
• If your browser sends a Global Privacy Control signal, we treat it as an opt-out everywhere in the world, not only in California. Analytics stays off, and you are not shown the notice at all, because you have already answered.

Where analytics is on, Google Analytics sets two first-party cookies so that repeat visits can be recognised as the same session and the same visitor:

• _ga distinguishes one visitor from another. It expires two years after it is set or refreshed.
• _ga_7XES5PEVDN keeps the state of your current session. It expires two years after it is set or refreshed.

Alongside page views, we send Google Analytics a small, fixed set of named events so we can tell which parts of the site lead to a conversation: opening the booking dialog, opening the enquiry dialog, submitting the enquiry form, and an enquiry form that failed to send. These events record which page and which action they came from. They never include anything you typed into the form.

Google Analytics 4 uses your IP address to derive a coarse location and then discards it. It does not log or store your full IP address. Data collected under this property is retained by Google for 14 months, after which it is deleted automatically.

Changing your mind. Your answer is kept in your browser's local storage under slashui.consent.v1 for 365 days, after which we ask again. Nothing about that record leaves your browser. You can change your answer at any time using Cookie settings in the footer of any page, and declining is exactly one click, the same as accepting. You can also clear these cookies in your browser settings, or install the Google Analytics Opt-out Browser Add-on. No feature of this website depends on any of it. Google's own explanation of how it handles this data is at policies.google.com/technologies/partner-sites.

We keep this list short on purpose. These are the third parties that process data on our behalf when you use this website, and what each one does:

• Google Analytics (Google LLC and Google Ireland Limited) measures how the site is used, as described in section 3, and only where analytics is switched on.
• Google Cloud hosts and serves this website. It processes the IP address and request data needed to deliver each page, and keeps short-lived operational logs.
• Cloudflare, Inc. provides authoritative DNS for slashui.com, so it resolves the domain name when your browser looks it up. Where our content delivery and security proxy is enabled, Cloudflare also terminates the TLS connection and processes your IP address, request headers and request contents in order to route traffic, cache content, and filter malicious requests. Where the proxy is active Cloudflare may also set a __cf_bm cookie for bot management. That cookie is strictly necessary to keep the site available and is not used to profile you.
• Resend (Plus Five Five, Inc.) delivers the enquiry form to our inbox as an email. The contents of your submission pass through Resend in order to reach us. We do not operate a newsletter or a mailing list, and submitting the enquiry form does not subscribe you to marketing email.

Each of these providers acts on our instructions under its own data processing terms. We do not sell, trade, or rent your personal information to anyone.

We use your information to:

• Respond to your enquiries and provide our services
• Communicate with you about projects and engagements
• Understand which parts of the site are useful, and improve them
• Keep the site available and protect it from abuse
• Comply with legal obligations

We do not use your information to build advertising profiles, we do not make automated decisions that produce legal or similarly significant effects, and we do not profile you.

Where the GDPR or the UK GDPR applies, we rely on the following bases. They are listed here rather than left implied because the basis decides which of the rights in section 10 attach to which data:

• Consent (Article 6(1)(a)) for analytics cookies and the measurement they enable. You give it through the notice and can withdraw it at any time, with the same effort it took to give.
• Legitimate interests (Article 6(1)(f)) for keeping the site available, defending it from abuse, and replying to an enquiry you chose to send. Our interest is running a website and answering the people who contact us, weighed against a minimal and expected use of your data.
• Steps prior to a contract (Article 6(1)(b)) where your enquiry turns into a discussion about engaging us.
• Legal obligation (Article 6(1)(c)) where accounting, tax or another law requires us to keep a record.

Beyond the service providers named in section 4, we share your information only in the following circumstances:

• With your explicit consent
• To comply with legal requirements, a court order, or a lawful request from a public authority
• Where necessary to establish, exercise or defend a legal claim

We are a Singapore company, but the providers in section 4 operate globally, so your data may be processed on servers outside Singapore, including in the United States and the European Union. Where we transfer personal data out of Singapore we take reasonable steps to satisfy ourselves that the recipient is bound to a standard of protection comparable to the PDPA. Where personal data leaves the EEA or the UK, the transfer relies on the European Commission's Standard Contractual Clauses, or the UK Addendum to them, as incorporated into each provider's data processing terms.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This site is served over HTTPS, the enquiry endpoint accepts submissions only from this site and is rate limited, and access to enquiry email is restricted to the people who need it. However, no method of transmission over the internet is 100% secure.

Under the PDPA, and under the GDPR and UK GDPR if you are in the EEA or the United Kingdom, you have the right to:

• Access the personal data we hold about you, and ask how it has been used in the past year
• Request correction of inaccurate or incomplete data
• Request deletion of your data, where we have no continuing need or legal obligation to keep it
• Ask us to restrict how we use your data, or object to a use we base on legitimate interests
• Receive the data you gave us in a portable, machine-readable form, or have it sent to another controller
• Withdraw consent at any time, without affecting anything we did with it beforehand

To exercise any of these, email us at the address in section 13. We will respond within 30 days and will not charge you for it. Withdrawing consent may mean we can no longer progress an enquiry or an engagement with you, and we will tell you if that is the case.

If you are in the EEA or the UK and you think we have handled your data badly, you may complain to your local supervisory authority. We would rather you told us first, so we have the chance to put it right.

The California Consumer Privacy Act, as amended by the CPRA, gives California residents specific rights. In the last 12 months we have collected the categories of personal information listed in section 2: identifiers such as your name, email address and phone number; commercial information such as your business name and team size; internet activity such as the pages you viewed and the referrer that brought you; and coarse geolocation inferred from your IP address. We collect them for the purposes in section 5, from you directly and from the analytics described in section 3.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by the CCPA. We have not done so in the preceding 12 months, and we do not sell or share the personal information of minors under 16. We collect no sensitive personal information, so there is nothing for a right to limit its use to act on.

You have the right to:

• Know what personal information we have collected, used and disclosed about you, and to receive a copy of it
• Delete personal information we collected from you, subject to the exceptions the statute allows
• Correct inaccurate personal information we hold about you
• Opt out of any sale or sharing of your personal information, which for us means turning analytics off
• Not be discriminated against for exercising any of these rights. We offer no financial incentives, and the site works identically whichever way you answer the notice

We honour the Global Privacy Control signal as a valid opt-out request, as described in section 3, and we honour it worldwide rather than only for California residents. You can also opt out at any time through Cookie settings in the footer. To make any other request, email us at the address in section 13. We will verify your request against information we already hold, and you may use an authorised agent.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. In practice:

• Enquiries that do not become an engagement are kept for up to 24 months, so we can pick up a conversation where it left off, and are then deleted
• Records relating to an engagement are kept for as long as the engagement runs, and afterwards for the period our accounting and tax obligations require
• Google Analytics data is deleted by Google after 14 months
• Your answer to the cookie notice stays in your own browser for 365 days, and never reaches us

If you have any questions about this Privacy Policy, our data practices, or if you wish to exercise any of the rights in sections 10 and 11, please contact us at hi@slashui.com.

Slash UI Pte. Ltd.
Singapore

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Where a change materially affects how we handle data you have already given us, we will tell you directly, and where it widens what we do with analytics we will ask for your consent again rather than assume the old answer still stands.