Privacy Policy

Service Operator

• Company / 회사명: WILLDCARD PTE. LTD.
• Company type / 회사 형태: Private Limited Company (Singapore) · 싱가포르 유한회사(Private Limited Company)
• Registration No. (UEN) / 등록번호: 202622439N
• Place of business / 사업장 주소: 111 Somerset Road, #06-01W, 111 Somerset, Singapore 238164
• Contact / 문의: hello@willdcard.com

The Lazzy service is operated by the company above (WILLDCARD PTE. LTD.).

WILLDCARD PTE. LTD. ("Company") values the privacy of Lazzy users. This policy explains what information we collect and how we use it.

Google User Data (Google Drive · Google Calendar)

When you connect your Google account to Lazzy as a connector, we access your Google data solely to carry out the tasks you ask your AI agent to perform. The scopes and their uses are:

· Google Drive (drive.file): for both personal and team Drive connections, we access only the files and folders you pick with the Google file picker (Picker) and files Lazzy creates. We read them to carry out your request, and create or update documents when you ask.
· Folder sharing (optional): if you want a whole folder available, you can share that folder in Google Drive with Lazzy's service account address yourself. Lazzy then accesses only the folders you explicitly share (and the subfolders and files inside them), within the permission you chose when sharing (view/edit), and access ends when you stop sharing.
· Google Calendar (calendar.readonly, calendar.events): read your calendars and events to answer your questions or summarize your schedule. We create, update, or delete events only when you ask.

If you set up a scheduled task (e.g., a daily morning schedule summary), Google data is accessed during its automatic runs under the same principles and only within the scope you configured. You can stop a scheduled task at any time.

Data received from Google is used only to fulfill your requests. We do not use it for advertising, do not sell it to third parties, and do not use it to train generalized artificial intelligence or machine-learning models. Human access is limited to the narrow circumstances described in "Conversation Log Access" below (lawful legal requests, security audits, debugging). You can revoke access at any time from your Google account permissions page or from Lazzy's connector settings.

Lazzy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How We Protect Your Data (including Google user data)

· Encryption in transit: all traffic between your browser or app and Lazzy, between Lazzy and Google APIs, and between your crew (AI agent) and Lazzy is encrypted with HTTPS (TLS).
· Encryption of stored credentials: the OAuth refresh tokens issued when you connect Google are encrypted with AES-256-GCM before being stored in our server database, and the encryption key is kept in server configuration separate from the database.
· Tokens are never exposed: Google tokens are used only on our servers and are never sent to your browser or to your crew (AI agent). Your crew calls Lazzy with its own per-crew service key; Lazzy calls the Google API on the server side and returns only what the request needs. We do not share tokens with third parties.
· Scoped access: Google data can be requested only by crews belonging to the user who connected that Google account. For Google Drive, access is limited to the files and folders, and the permission level (read/edit), you have granted to each crew; requests outside that scope are refused by our servers.
· Least privilege: we request only the Google permissions a feature needs (for example, drive.file for Google Drive, which covers only files you pick).
· Purpose limitation: Google data is passed only to your own crew, and the AI model that powers it, to the extent needed to fulfill the request you made. It is not sold, not used for advertising, and not used to train generalized artificial intelligence or machine-learning models.
· Internal access controls: only a small number of authorized operations staff can access production systems, and human access to data is limited to the narrow circumstances described in "Conversation Log Access" below.

Retention and deletion: Lazzy does not keep separate copies of your Drive files or calendar events; they are fetched from Google at the time of a request and passed to your crew. If your crew includes that content in a reply to you, it remains part of your conversation history. Disconnecting a connector in Lazzy's connector settings immediately deletes the stored Google token, and deleting your account deletes your account data, including tokens, connector settings, and conversation history (see "Data Retention" below). To fully disconnect Lazzy on Google's side, remove Lazzy from your Google account permissions page. You can also request deletion at hello@willdcard.com.

Lazzy Browser Extension (Chrome)

The Lazzy browser extension works only in a Chrome browser that you have paired yourself with a pairing code. The extension reads page content and URLs only from pages inside the "Lazzy" tab group it creates, and uses them solely to carry out the tasks you give your crew (AI agent). It does not read any other tabs, your browsing history, or your bookmarks.

Data between the extension and your crew travels only through our relay server. We do not sell it, do not use it for advertising, and do not use it to train generalized artificial intelligence or machine-learning models. You can disconnect the extension or stop your crew at any time, and removing the extension ends the connection completely.

1. Information We Collect

When you sign up, we collect your email address and name (for Google sign-up, the name and email of your Google account). If you connect Telegram, we also collect your Telegram user ID, username, and display name. Payment information is processed by Stripe — we do not store card details directly. Agent usage logs (runtime, cookies used), conversation history with the agent, and execution records are retained.

2. How We Use Your Information

Collected information is used to provide the service, authenticate accounts, process payments, provide customer support, and improve the service. We do not sell your personal information to third parties for marketing purposes.

3. Information Sharing

Information is shared only in the following cases: with third-party services required to provide the service (Stripe, Anthropic, AWS, Meta, etc.), to comply with legal requirements, and for fraud prevention and security.

When you sign up, your email address and name are sent to the service operator's marketing analytics tool (operated by WILLDCARD PTE. LTD.) and used to analyze sign-up trends.

To measure ad performance, we send Meta Platforms sign-up and purchase events with hashed email and account ID, IP address, browser user agent, and Meta cookie values (_fbp, _fbc) via the Meta Pixel and Conversions API. Turning off analytics in the Cookies section below stops this.

4. Conversation Log Access

We may access agent conversation records and activity logs solely in the following circumstances: (1) a lawful request from law enforcement, courts, or other competent authorities; (2) responding to a reported Terms of Service violation or conducting an internal security audit; (3) where reasonably necessary for service operation, debugging, security, or to protect the safety and integrity of the service. Access is limited to the minimum scope required and conducted in compliance with Singapore's Personal Data Protection Act (PDPA) and applicable law.

5. Data Retention

Account data is deleted within 30 days of account deletion. Data may be retained longer if required by legal obligations or dispute resolution.

6. Your Rights

You may request access, correction, or deletion of your data. Send requests to hello@willdcard.com.

7. Cookies

Essential cookies keep you signed in and remember your language, theme, and your analytics choice below (lz_consent). They are required for the service and cannot be turned off.

Analytics cookies: Google Analytics cookies for visit statistics, referral values (lz_src, lz_ft, lz_lt — the ad/search source, campaign and ad name, ad click ID, and the first page and time of your visit, kept 90 days), a visitor identifier (lz_vid), and Meta Pixel cookies (_fbp, _fbc) for ad measurement. They are on by default and contain no personal details such as your name or email.

How to opt out: click "Turn off" below to stop analytics cookies in this browser and delete any existing values. You can also block cookies in your browser settings, but blocking essential cookies may prevent sign-in.

8. International Data Transfers

Data may be stored in Singapore and on global cloud infrastructure. Appropriate safeguards are in place for secure processing.

9. Policy Changes

We will notify you of material changes via in-service notice or email.

10. Contact

For privacy inquiries, contact hello@willdcard.com.