Privacy Notice

This Privacy Notice explains how Kai ("I", "me") collect, use, disclose, and protect personal data when you visit TaleWave at talewaveprox.life or contact me through the reach form. TaleWave is a personal blog operated from Singapore. I handle personal data in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA") and related guidance issued by the Personal Data Protection Commission ("PDPC").

1. Data controller

The data controller for TaleWave is Kai, reachable at Blk 558 Woodlands Drive 16, #04-11, Singapore 730558, telephone +65 6382 4715, email [email protected]. TaleWave is not a registered company; it is an individual-operated static website publishing personal essays and a contact channel for reader correspondence.

2. Scope

This notice applies to personal data collected through talewaveprox.life, including data submitted via the reach form processed by send.php, cookie preferences stored in your browser, server logs maintained by the hosting provider, and any email correspondence you initiate with me. It does not govern third-party websites linked from TaleWave, including Google Maps embedded on each page. Those services maintain their own privacy policies.

3. What personal data I collect

3.1 Data you provide directly

When you submit the reach form, I collect your name, email address, selected subject category, message content, and confirmation that you consent to processing under this notice. I do not collect payment details, identification numbers, or employment records through TaleWave because the site offers no checkout, subscription checkout, or account registration.

3.2 Data collected automatically

When you browse TaleWave, standard web server logs may record your IP address, browser type, referring URL, requested page, and timestamp. I do not operate first-party analytics on TaleWave unless you opt in to analytics cookies via the cookie banner. Hosting infrastructure may retain logs for security and troubleshooting for a limited period defined by the host.

3.3 Cookie and local storage data

If you interact with the cookie banner, a preference record is stored locally in your browser indicating whether you accepted, rejected, or customised analytics cookies. See the Cookie Policy for detail. Google Maps embeds may set third-party cookies or use similar technologies when maps load.

4. Purposes of collection, use, and disclosure

I collect and use personal data only for purposes a reasonable person would consider appropriate in the circumstances, including:

• responding to messages you send through the reach form;
• maintaining security, diagnosing abuse, and enforcing rate limits on form submissions;
• complying with applicable law, regulatory guidance, or lawful requests;
• improving site reliability when you have consented to optional analytics cookies;
• keeping records of correspondence where needed to follow up on reader replies or corrections.

I do not sell personal data. I do not use contact details for unsolicited marketing lists. I do not disclose personal data to advertisers. Disclosure is limited to service providers necessary to operate the site (hosting, email delivery) and circumstances required by law.

5. Legal bases and consent

Under the PDPA, I rely on consent for processing reach-form submissions. The consent checkbox on the form is not pre-selected; you must actively confirm before sending. You may withdraw consent by emailing [email protected], though withdrawal may limit my ability to respond to your enquiry if contact details are removed.

For server security logs and essential site operation, I may process data on bases recognised under the PDPA, including legal obligation and legitimate interests in protecting the site from abuse, provided such interests are not overridden by your rights.

6. Retention

Reach-form messages retained in my mailbox are kept only as long as needed to respond and for a reasonable archival period thereafter, typically not exceeding twenty-four months unless a longer period is required for dispute resolution. Server logs retained by the hosting provider follow the provider's schedule, often thirty to ninety days. Cookie preferences stored locally expire after six months unless you clear browser storage sooner.

7. Transfer outside Singapore

Hosting and email routing may involve servers located outside Singapore. Where personal data is transferred overseas, I take reasonable steps to ensure recipients provide a standard of protection comparable to the PDPA, including contractual safeguards where appropriate. Google Maps content is served by Google and may involve international processing governed by Google's terms.

8. Security

I implement reasonable administrative and technical measures appropriate to a small static site: HTTPS where supported by the host, honeypot and rate limiting on the contact form, minimal data collection, and access controls on mailboxes. No method of transmission over the Internet is completely secure; I cannot guarantee absolute security but I review practices periodically.

9. Your rights under the PDPA

Subject to exceptions in the PDPA, you may request access to personal data about you that is in my possession or control, request correction of inaccurate data, and withdraw consent to processing where consent is the basis. You may also inquire about how your data has been used or disclosed within the preceding year.

To exercise these rights, contact [email protected] with sufficient detail for me to identify your request and verify identity where reasonable. I will respond within thirty days or inform you if an extension is required under the PDPA.

10. Accuracy

Please provide accurate contact information when messaging me. If your details change, include updated information in a new message so records can be corrected.

11. Children

TaleWave is written for a general adult audience. I do not knowingly collect personal data from children under thirteen without appropriate parental consent. If you believe a child submitted data through the reach form, contact me and I will delete it promptly.

12. Third-party embeds and links

Each page includes a Google Maps iframe showing Woodlands, Singapore. Loading the map may allow Google to collect device and usage data according to Google's privacy policy. External links in essays or footers lead to third-party sites not controlled by me. Review their notices before submitting data.

13. Data breach notification

If I become aware of a notifiable data breach affecting personal data in my possession, I will assess the breach under PDPA requirements and, where notification is required, notify the PDPC and affected individuals without undue delay.

14. Do Not Call Registry

TaleWave does not operate telemarketing. If you provide a telephone number in a message, I will use it only to respond to that message, not for unsolicited calls or messages regulated under the Do Not Call Provisions unless you give clear consent for broader contact.

15. Updates to this notice

I may update this Privacy Notice to reflect changes in practice, hosting, or legal requirements. The "Last updated" date at the top will change accordingly. Material changes will be described on this page. Continued use of the site after updates constitutes acknowledgement of the revised notice where permitted by law.

16. Contact and complaints

Questions or requests relating to personal data should be sent to [email protected] or by post to Blk 558 Woodlands Drive 16, #04-11, Singapore 730558. If you remain unsatisfied after contacting me, you may lodge a complaint with the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.

This notice is provided in English (Singapore). In case of inconsistency between translations, the English version prevails unless otherwise required by law.

17. Automated decision-making and profiling

TaleWave does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals. The reach form is reviewed manually. Rate limiting on send.php uses IP-based counters solely to prevent abuse and does not create user profiles for marketing. Optional analytics, if enabled in future, would be configured to avoid individual profiling beyond aggregated visit statistics.

18. Marketing and newsletters

TaleWave does not operate a mailing list, newsletter, or promotional SMS service. Email addresses submitted through the reach form are used only to respond to your message unless you explicitly request ongoing correspondence and confirm consent in writing. I will not add you to any third-party marketing platform.

19. Processors and service providers

Personal data may be processed by infrastructure providers that host static files, route email, or provide TLS certificates. These providers act on my instructions only to deliver the site and are selected with reasonable care. I do not permit processors to use reach-form data for their own marketing. A list of categories includes: web hosting, email transport, and domain registration services.

20. Access requests — what to include

To help me respond efficiently to PDPA access or correction requests, include: your full name, the email address used in correspondence (if any), a description of the data you seek or believe is inaccurate, and proof of identity where reasonable (for example, sending from the same email previously used). I may request additional verification if the request involves sensitive context. There is no fee for reasonable access requests unless permitted under the PDPA for manifestly unfounded or excessive requests.

21. Relationship to cookie preferences

Cookie choices are stored locally in your browser and are not linked to reach-form identity unless you separately contact me. Details appear in the Cookie Policy, including the Google Maps disclosure relevant to every content page.

22. Glossary

"Personal data" means data about an individual who can be identified from that data or from that data and other information to which I have or are likely to have access, as defined in the PDPA. "Processing" includes collection, use, disclosure, and storage. "Consent" must be voluntarily provided, informed, and specific to the purpose stated on the reach form.