Privacy Notice

Last updated: 8 October 2026.

This notice describes how Panthera International Asia Capital Pte. Ltd. ("Panthera", "we", "us") collects and processes personal data through the Panthera Insight mobile app. It is written to satisfy Singapore's Personal Data Protection Act 2012 (as amended in 2020) ("PDPA"), the UK General Data Protection Regulation and the Data Protection Act 2018 ("UK GDPR"), Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), Quebec's Act respecting the protection of personal information in the private sector ("Quebec Law 25") and, where applicable, Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").

1. Who we are

Panthera International Asia Capital Pte. Ltd. is the data controller for personal data processed via the Panthera Insight mobile app. We are licensed and regulated by the Monetary Authority of Singapore (MAS) under Capital Markets Services Licence CMS101735.

2. Data Protection Officer

Our Data Protection Officer ("DPO") can be reached at it@pantherafo.com. You may contact the DPO with any question about this notice, to exercise the rights described in section 7, or to report a suspected privacy incident.

3. What we collect

• Account email address — used to issue one-time sign-in codes and to identify your account.
• Authentication session token — held in your device's secure storage so you can stay signed in; it is used to keep you authenticated and is not readable by us.
• Disclaimer acceptance records — a record that you accepted the Disclaimer & Acknowledgement, and the version accepted, kept to evidence your acknowledgement.
• Client identifier and role — the client / profile you are linked to and your access role, used to show you the correct reports.
• Reporting data — portfolio reports prepared for you by Panthera (positions, valuations and historical performance), displayed to you on a read-only basis. This data is generated by Panthera, not by you.
• Downloaded report PDFs — when you download a report it is saved on your device only; we do not receive a copy.
• One-time-code (OTP) rate-limit records — short-lived bookkeeping that limits how often sign-in codes can be requested, used to protect your account.
• Account-deletion audit log — a record that a deletion took place, kept to evidence the request.
• Crash diagnostics — crash and error reports, automatically scrubbed of email addresses, tokens, identifiers and IP address before they leave the device. Used to maintain reliability only — not for analytics.

We do not collect advertising identifiers, location data, contacts, photos, microphone or camera data. We do not use third-party advertising or analytics SDKs. The app does not track you across third-party apps or websites, so it does not respond to browser "Do Not Track" signals.

4. Why we process it

• To authenticate you and deliver your portfolio reports (performance of contract).
• To investigate crashes and improve reliability (legitimate interest in maintaining a working app).
• To comply with our obligations under applicable financial services and data protection law (legal obligation).

5. Who else processes it

We use a small number of sub-processors. Each is bound by a Data Processing Agreement.

• Supabase — hosting, database, authentication and encrypted file storage. Data is hosted in the United Kingdom (AWS eu-west-2, London). Supabase's own infrastructure subprocessors — AWS, Google, Fly.io and Cloudflare, operating in the UK, EU and US — are governed by Supabase's Data Processing Agreement and published subprocessor list. The Privacy Notice will be updated if the region changes.
• Sentry — crash and error monitoring and diagnostics only (not analytics). Hosted in the EU (Frankfurt, Germany). Sentry is configured to collect no personal data: user identity and IP address are scrubbed on-device before any event leaves your phone.
• Apple, Google — app distribution. Apple and Google do not receive your reporting data; they only receive what they need to deliver app updates and process App Store / Play Store interactions you initiate yourself.

6. International transfers

Personal data may be processed in Singapore, the United Kingdom, the EU/EEA, the United States and other locations where our service providers or their subprocessors operate, subject to contractual and technical safeguards.

Where data leaves Singapore, the United Kingdom or the EEA, we rely on the data-transfer provisions in our sub-processor agreements (the PDPA Transfer Limitation Obligation, and UK / EU Standard Contractual Clauses where applicable).

7. Your rights

You may at any time:

• Ask what personal data we hold about you;
• Ask us to correct inaccurate data;
• Ask us to delete your account and associated data (see Delete your account for the in-app and web paths);
• Withdraw your consent to optional processing;
• Lodge a complaint with your local supervisory authority — the Personal Data Protection Commission of Singapore (PDPC) in Singapore, the Information Commissioner's Office (ICO) in the United Kingdom, the Office of the Privacy Commissioner of Canada (OPC), for Quebec residents, the Commission d'accès à l'information (CAI) or, in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD).

Requests should be sent to the DPO mailbox above. We aim to respond within 30 days; complex requests may take up to a further 60 days, in which case we will tell you.

8. Retention

• Reporting data is retained for one month by default and is erased at the next monthly update. If more than one email address is linked to the profile, it is retained as-is. Reporting data is not deleted when you delete your account (see Delete your account).
• Disclaimer acceptance records and the account-deletion audit log are retained for five years.
• The OTP rate-limit record is deleted immediately on successful account deletion.
• Crash / error logs (Sentry) are retained for up to one year, with user identity scrubbed.
• Your account email and profile are retained for the life of the client relationship and are removed when you delete your account, subject to the reporting-data exception above.

Certain records are retained to meet the record-keeping requirements applicable to a MAS-licensed entity, as reflected above. Sub-processor backups (for example database point-in-time recovery) may retain copies for a limited period before they are overwritten on the sub-processor's normal schedule.

9. Children

The app is provided to identified adult clients of Panthera. It is not directed at children and we do not knowingly collect personal data from anyone under 18.

10. Notice for residents of Canada

For residents of Canada this notice is written to satisfy the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and, for Quebec residents, the Act respecting the protection of personal information in the private sector ("Quebec Law 25"). The rights described in section 7 apply to Canadian residents in addition to any rights granted by federal or provincial law.

Privacy officer. The PIPEDA-required individual accountable for our personal information practices is the same Data Protection Officer named in section 2 of this notice (it@pantherafo.com). The same address serves as the contact for Quebec Law 25 access, correction, de-indexation and portability requests.

Cross-border transfers. Personal information processed through the Panthera Insight app is hosted by Supabase (London, United Kingdom — eu-west-2; the regional choice is documented in section 5) and Sentry (EU region). Quebec Law 25 requires explicit notice that data may be processed outside of Canada — this paragraph constitutes that notice.

Automated decision-making. The app does not make decisions about you by purely automated means. Reports are prepared by Panthera staff; the app only displays them.

Breach reporting. Where a privacy breach creates a real risk of significant harm we report to the Office of the Privacy Commissioner of Canada ("OPC") under PIPEDA and, for Quebec residents, to the Commission d'accès à l'information ("CAI") within 72 hours under Quebec Law 25. Affected individuals are notified at the same time.

Sale of personal information. We do not sell personal information and we do not share it for behavioural advertising. We do not use third-party advertising or analytics SDKs.

11. Changes to this notice

If we materially change how we process personal data, we will update the date at the top of this page and, where appropriate, notify you in-app. Continued use of the app after a change indicates acceptance of the updated notice.