← Back to Spend Gateway

Privacy Policy

Last updated: 14 October 2026

1. Who we are

ActOnce Spend Gateway ("we", "us", "Spend Gateway") is operated by ActOnce, a sole-trader business registered in Singapore. You can reach us at privacy@actonceapi.com.

2. What data we collect

To run Spend Gateway we collect:

  • Account data. Workspace name, billing email, creator email, and any contact details you give us on signup.
  • API credentials. API keys are generated for you; we store their hash, prefix, and revocation status. We never store the raw key in plaintext after first display.
  • Spend decision data. Agent IDs, amounts, currencies, merchants, descriptions, decisions (APPROVED / REJECTED / REQUIRES_APPROVAL), policy matches, and approval metadata that your local gateway forwards to our cloud sync.
  • Billing data. Stripe customer and subscription IDs, plan tier, billing status, and payment history. Card details are handled entirely by Stripe — we never see or store them.
  • Operational data. IP addresses (used for rate limiting and abuse prevention), request timestamps, and aggregate usage counters.
  • Email delivery data. Recipient email address, delivery status, and bounce / complaint events from our transactional email provider (Resend).

3. Why we use it

We use this data to:

  • Operate, secure, and improve the Spend Gateway service.
  • Enforce plan limits (per-plan usage caps, per-workspace rate limits).
  • Process payments and prevent fraud via Stripe.
  • Send transactional emails (signup confirmation, webhook alerts, usage alerts on Business plans).
  • Respond to legal requests and enforce our Terms.

We do not sell your data. We do not use your spend decision data to train AI models.

4. Third-party processors

We share the minimum data needed with these processors:

  • Stripe Payments Europe Ltd. — billing. Stripe Privacy Policy.
  • Resend, Inc. — transactional email delivery. Resend Privacy Policy.
  • Supabase / Riverbank Labs Pte. Ltd. — hosted Postgres database (Singapore region).
  • Railway Corporation — application hosting.
  • Cloudflare, Inc. — DNS and edge.

Each processor handles data under its own privacy terms and our data-processing agreements.

5. Retention

  • Spend decision records: kept while your account is active and for 12 months after the last activity on the workspace, then anonymised for aggregate analytics.
  • Billing records: kept for 7 years to comply with tax and accounting rules in Singapore.
  • API keys: kept until you revoke them, plus a 30-day grace window to allow for grace-period access.
  • Operational logs: 90 days rolling.

6. Your rights

You can at any time:

  • Access the personal data we hold about your workspace.
  • Correct inaccurate data.
  • Delete your workspace and associated data (subject to retention obligations above).
  • Export your spend decision history in CSV / JSON.
  • Revoke any API key from the dashboard.

Email privacy@actonceapi.com and we'll action it within 30 days. Singapore PDPA gives you additional rights; EU/UK GDPR gives you the right to complain to a supervisory authority.

7. International transfers

Data is stored in the ap-southeast-1 (Singapore) region. Some processors (Stripe, Resend, Cloudflare, Railway) may process data in the US, EU, or other regions under their standard contractual safeguards.

8. Security

We protect data with TLS in transit, encryption at rest at our database provider, scoped API keys with SHA-256 hashing, per-workspace rate limits, and principle-of-least-privilege access for staff. No system is 100% secure; if you find a vulnerability, please email security@actonceapi.com — we run a responsible-disclosure programme.

9. Cookies & analytics

We do not use third-party tracking cookies on spend.actonceapi.com. The marketing site uses no analytics. The Spend Gateway API and dashboard are cookie-free for end users.

10. Children's data

Spend Gateway is a B2B product. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We will post material changes on this page with an updated "Last updated" date and, for significant changes, email you at your billing address at least 14 days before they take effect.

12. Contact

Questions, complaints, or data requests: privacy@actonceapi.com. We aim to respond within 5 business days.