Privacy Notice

1. Organisation responsible

Pippin Puffin Pte Ltd is responsible for this website and for determining the purposes and means of any future personal-data processing by tribefii Audience Operations, subject to applicable law and provider requirements.

Privacy and Data Protection Officer contact: privacy@pippinpuffin.com.

2. Current website and application state

This website is informational. It has no form, newsletter, account login, subscriber capture, or application runtime. Pippin Puffin sets no first-party analytics, advertising, tracking, or marketing cookies on this initial site.

The hosting and network providers may process ordinary technical request data—such as request time, requested path, network address, user agent, response status, and security events—to deliver the site, maintain reliability, prevent abuse, and investigate security incidents.

tribefii Audience Operations is under development. No LinkedIn account is connected through the application, no live automated publication capability is active, and no LinkedIn Member Data is currently collected through it.

This notice will be reviewed and updated before any materially different data flow is activated.

3. Conditional future application data

Only after separate provider approval, legal and privacy review, security readiness, and deliberate activation, the application may process:

• the authorised account's provider identity and basic profile binding;
• OAuth scope, issue, expiry, revocation, and reauthorisation metadata;
• secret references, while raw tokens remain in an approved secret store;
• exact human-approved content revisions;
• intended publication time and exact account binding;
• provider request and receipt identifiers;
• public post URLs and operational status;
• permitted aggregate post and profile analytics; and
• consent, disconnect, deletion, and audit events.

This is a description of planned conditional processing, not a statement that collection is currently occurring.

4. Limited purposes

Any approved future processing will be limited to:

• authenticating and binding the exact authorised account;
• executing only human-approved operations permitted by the provider;
• preventing duplicate or unauthorised execution;
• showing operational status and permitted analytics to the authorised user;
• maintaining security, auditability, and legal compliance;
• handling access, correction, withdrawal, disconnect, and deletion; and
• troubleshooting and protecting the service.

5. Prohibited uses

Pippin Puffin will not use the proposed integration for the sale of personal data, advertising, prospecting, unrelated enrichment, or hidden transfer into another programme or project. It will not use scraping, browser automation, autonomous authorship approval, or automated relational replies.

The proposed integration will not collect a LinkedIn member's email unless a later, separately disclosed and authorised capability specifically requires it.

6. Service providers and overseas processing

Approved hosting, database, security, email, and secret-custody providers may process limited data on Pippin Puffin's behalf under contractual, access-control, confidentiality, and security requirements. Processing may occur outside Singapore where comparable protection and appropriate safeguards are provided.

LinkedIn is a separate provider with its own terms, privacy policies, security practices, retention rules, and rights processes. Provider-side data may remain subject to those policies even after disconnection from a Pippin Puffin service.

7. Retention, disconnect, and deletion

If the application is approved and activated, tokens will be retained only while the connection remains active or as required for security and legal obligations. Publication and audit evidence will be retained according to a documented schedule. Data no longer required will be deleted or irreversibly de-identified.

Disconnecting will stop further collection through the connection and initiate the applicable token and local-data handling process. It cannot by itself delete provider-side data governed by the provider's policies.

8. Intended security controls

Before any application processing is activated, intended controls include encryption in transit and at rest, least privilege, secret-vault custody, access control, audit logging, incident response, and fail-closed external execution. These are readiness requirements and not claims that a production service is currently deployed.

9. Access, correction, withdrawal, and deletion

You may ask about personal data associated with you, request access or correction, withdraw consent where applicable, request disconnection or deletion, or raise a privacy concern by emailing privacy@pippinpuffin.com. We may need to verify your identity and authority before acting on a request.

10. Notice updates

We will revise this notice before activating materially different processing and will publish the effective date of any updated notice. Material application changes remain subject to separate provider, privacy, security, and owner approval.