Version 1 · 22 October 2026

Privacy Policy

This policy explains what personal data KYM collects, why, who sees it, how long we keep it, and what you can ask of us. It covers kymregistry.com, the registry at registry.kymregistry.com, the merchant and admin consoles, KYM's public API and its MCP server for AI agents. We handle personal data under Singapore's Personal Data Protection Act 2012 (PDPA).

Who we are

KYM Registry ("KYM", "we", "us") is based in Singapore. KYM verifies online businesses and the web domains they control, and tells AI buying agents and payment providers which merchants it has verified. For anything in this policy, write to our Data Protection Officer at hello@kymregistry.com.

What we collect, and why

If you visit kymregistry.com

• Anonymous visit counts. We count page views, referring sites and page speed with Vercel's analytics. It uses no cookies and does not identify you.
• Google Analytics, only if you accept it. With your OK, Google Analytics (through Google Tag Manager) uses cookies to count visits and see how people use the site, including when someone joins the waitlist. It records your device's general location, browser and the pages you view, never your name or email. Until you accept, nothing from Google loads at all.
• Your colour theme and your cookie choice are remembered in your own browser and never sent to us.

If you join the waitlist or request access

• Your name, work email, and, if you give them, phone number, organisation, domain, country, role and message. They reach us by email. We use them to reply to you and to decide whom to onboard. We do not send marketing you didn't ask for.

If your company registers with KYM

• Company details: legal name, registration number, company register, country and website domains.
• The people who act for it: name and email address of the owner and any contacts, and a sign-in account tied to that email. We sign you in with one-time codes sent by email; we never hold a password for you.
• Documents you upload so we can verify the company, such as its registration certificate, a proof of address or a director's ID. If a document contains someone else's personal data, you confirm you have their consent to share it with us for this purpose.
• Proof that you control your domain (a DNS record or a file on your site) and, when you approve your credential, the time, a one-way hash of your IP address and your browser's name, as a record that the approval was yours.
• Your listing: category, description, products, where you sell, languages, currencies, how agents can buy, and your logo.
• Support requests you send us from your KYM page, and our replies. They are kept with your company's record. When we reply, we email you only that there is a reply, never its words.
• A log of changes to your record: who changed what, and when.

We use these to verify that the business is real and controls its domain, to issue and keep its credential up to date, to list it for agents, to contact you about your record, and to keep the service secure.

When AI agents check or visit a merchant

• We count when an agent asks KYM about a merchant and when someone follows a KYM link to a merchant's site: which merchant, when, through which channel, and the name of the calling software. We record nothing about the person behind the agent, and these counts hold no IP address.
• Agents may file reports about the outcome of purchases from merchants KYM has verified. Each report is tied to an on-chain payment record; we don't ask who the buyer is, and the public never sees buyers, wallets or amounts.

Every request to our servers

• Like any web server, ours see the IP address and browser of each request. We use them to stop abuse, for example to rate-limit the public API, and to keep the service secure, in short-lived server logs.

Reading a merchant's own website

• With the merchant's agreement (Merchant Terms), KYM-Registry-Bot reads up to about ten public pages of its proven domain to draft its listing, and keeps copies of those pages as a record of where each fact came from. It obeys robots.txt and never logs in.

Cookies and similar storage

• Strictly necessary, no choice needed: your cookie choice and colour theme, kept in your browser; the sign-in pages, run by Amazon Cognito, set security cookies while you sign in; and on the admin console, a secure cookie that keeps a KYM admin signed in for up to 30 days when they tick "Remember this computer".
• Analytics, only with your consent: Google Analytics cookies (_ga and _ga_…), which last up to 2 years. We never use them for advertising, and Google signals and ad personalisation are off.

The banner asks once, with Accept and Reject side by side, and asks again after 12 months. Change your mind at any time with Cookie settings at the bottom of every page: rejecting turns Google Analytics off and removes its cookies. If your browser sends a Global Privacy Control signal, we treat it as Reject.

What is public

A KYM credential exists to be checked, so some of it is public by design: the company's legal name, registration number and register, its verified domain, the credential's level, status and expiry, its listing and its accepted logo. Anyone can read these through KYM's API, its MCP server and the directory on kymregistry.com. The people behind a company, their emails and the documents are never public.

Who we share it with

We don't sell personal data. We share it only with the providers that run KYM for us, under contracts that require them to protect it, and only as far as each needs:

• Amazon Web Services, in Singapore: our database, encrypted document storage, sign-in and email delivery. To draft a company's listing from its public web pages, we use Anthropic's Claude models on Amazon Bedrock, which may process those pages outside Singapore. They only ever see public web pages, never your documents or personal details, and they do not keep or learn from what they read.
• Vercel: hosting for our websites and API (served worldwide; the registry runs in Singapore).
• Google: only if you accept analytics cookies, Google Analytics and Google Tag Manager.

Some of these providers may process data outside Singapore. Where they do, we make sure it is protected to a standard comparable to the PDPA. We may also disclose data where the law requires it, or to protect people from fraud.

How long we keep it

• Waitlist and access requests: up to 24 months after we last heard from you, or less if you ask.
• A registered company's record, its people, documents, approval records and change log: while the company is registered with KYM and for 5 years after its last credential ends, so we can show what was checked and when. A company that never received a credential is kept for 5 years after its record last changed. Then we delete its documents and sign-in accounts and anonymise its people. The company's name and its past credentials stay, as the registry's record of what was issued.
• Documents and logos we didn't accept (the wrong file, an unreadable scan): deleted 30 days after we turn them down.
• Copies of pages our crawler read, and the listing drafts made from them: 12 months.
• Agent traffic counts: individual events for 13 months, then daily totals only.
• Server logs with IP addresses: up to 30 days.
• Google Analytics (only with consent): event data for 2 months and user data for 14 months, deleted by Google after that.

Sensitive data stays in Singapore

The documents a company uploads, such as its registration certificate, proofs of address and identity documents, are the most sensitive data we hold. They are:

• stored only in Singapore, encrypted;
• opened only from Singapore, by a KYM admin, when needed to verify the company. KYM's systems refuse to open a document from anywhere else;
• logged every time one is opened, or someone tries to: who, when and from which country.

A registered company may ask us at any time for that log of every view of its documents. We provide it within 7 working days.

How we protect it

Data is encrypted in transit and at rest; documents are stored encrypted with keys only KYM's service can use; KYM admins sign in with multi-factor authentication, and only they can open documents; every change to a company's record is logged.

Your choices and rights

• Access and correction: ask us what personal data we hold about you and how we have used it in the past year, or ask us to correct it. We reply within 7 working days.
• Withdrawing consent: you can withdraw your consent at any time. We will stop using your data for that purpose; if it is needed to keep a company verified, the company's credential may have to be revoked, and we will tell you before we do.
• Leaving KYM: a registered company can ask us to revoke its credentials and close its record at any time. We then keep it only as long as stated above.
• If you are not satisfied with how we handled a request, you may contact Singapore's Personal Data Protection Commission.

Children

KYM is a service for businesses and is not meant for anyone under 18.

Changes

We may update this policy. The version and date at the top change when we do, and registered companies are told by email and asked to agree to any change that affects them.

Contact

Data Protection Officer, KYM Registry: hello@kymregistry.com. See also the Merchant Terms.