Privacy policy

Capstone AI Lab is operated by Capstone Consulting and Training, a sole proprietorship registered in Singapore ("we", "us"). This policy explains what personal data we collect when you use capstoneailab.com, why we collect it, and your rights under Singapore's Personal Data Protection Act 2012 (PDPA). We collect only what we need to run the Lab.

What we collect

• Waitlist: your email address, the edition you're interested in, the page you signed up from, and the time you signed up.
• Membership: your email address, the plan you bought, whether it is a founding plan, the amount paid, and the Stripe customer, subscription and checkout reference numbers.
• Members area: sign-in records (a one-time sign-in link and a session cookie) and your progress, such as the tools you mark as finished and the XP you earn.
• Emails you send us: whatever you choose to include.

We do not receive or store your card details. Payments are handled entirely by Stripe.

Why we use it

• To give you first access and send the free AI Prompt Pack you asked for.
• To deliver your membership: sign you in, release new tools, and email you about your account.
• To process refunds, handle support requests and keep the records the law requires.
• To understand, in aggregate, how the site is used so we can improve it.

By joining the waitlist or buying a plan, you consent to these uses. We will email you about AI Lab launches and new tools, and every email has a way to opt out. We never sell your personal data.

Who processes it for us

• Cloudflare hosts the website and our database, and provides cookieless, aggregate web analytics.
• Stripe processes payments. For purchases, Stripe acts as the merchant of record and handles sales tax or VAT. Stripe's own privacy policy applies to the payment details you give it.
• Resend delivers our emails.
• Enoch, our AI mentor at enoch.capstoneailab.com, is a separate service with its own sign-up and notice. What you type into Enoch is processed by an AI model to generate replies.

These providers may process data outside Singapore. Where they do, we rely on their contractual commitments to protect it to a standard comparable to the PDPA.

Cookies

The public site sets no advertising or tracking cookies. The members area uses one strictly necessary session cookie to keep you signed in.

How long we keep it

• Waitlist emails: until you unsubscribe or ask us to delete them, or 24 months without engagement, whichever comes first.
• Membership and payment records: for as long as you are a member, then for 5 years, as Singapore requires for business and tax records.
• Sign-in links expire after 15 minutes. Session records are deleted when they expire.

Your rights

You can ask to access or correct your personal data, or withdraw your consent, by emailing our Data Protection Officer at [email protected]. We will reply within 30 days. If you withdraw consent, we may no longer be able to provide the membership.

Security and breaches

Data is encrypted in transit, access is limited to what each system needs, and secrets are never kept in our code. If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the PDPA requires.

Age

AI Lab: Adults is for people aged 18 and over. We do not knowingly collect data from children.

Changes

We will post any changes on this page and update the date at the top. If a change is significant, we will also email members.