This policy explains how ecoSPIRITS Pte. Ltd. (“ecoSPIRITS”, “we”, “us”) collects, uses, shares and protects personal data when you use:

• our website, ecospirits.global;
• CircularONE, our platform for tracking ecoTOTEs and other ecoSPIRITS hardware, on the web (circularone.ai) and in the CircularONE mobile app;
• other apps and features we make available to selected users, including beta versions.

Together these are the “Services”.

ecoSPIRITS is responsible for the personal data described here. Our details are at the end of this policy.

Who uses CircularONE

CircularONE is a business platform. Your account is set up by an organisation that works with ecoSPIRITS, such as a licensed operator, a brand, a bottler or a venue, and you use CircularONE on that organisation’s behalf. The Services are not intended for anyone under 18.

What we collect

When you visit our website

• Information about your device and your visit: browser, IP address, approximate location worked out from the IP address, the page you came from and the pages you view. We collect this through cookies and Google Analytics (see “Cookies and analytics”).
• Anything you send us through a form on the website, such as your name, email address, company and the details of your enquiry.

When you use CircularONE

• Account details: your name, username, email address, phone number, profile photo if you add one, the organisation you belong to, your role and the sites you are assigned to. Your password is stored only in a form that cannot be read back.
• Records of what you do: the scans and reports you file, such as registering, sending, receiving, filling, emptying, grouping or transferring ecoTOTEs and other hardware, and pairing devices. Each record shows who filed it and when. It also includes any notes, photos or documents you attach. Do not attach personal data about other people.
• Account activity: when you sign in, and changes made to your account, including changes made by an ecoSPIRITS administrator on your organisation’s behalf.
• Support requests: messages you send through “Contact Us”, together with the app version and device details needed to help you.
• Technical data: IP address, device and app information, server logs, and error and crash reports.
• Hardware data: our hardware, such as SmartPour dispensers, sends usage data like dispense volumes and connection status. This is linked to the site where the hardware is used, not to you personally.

Location

• Location when you scan. When you submit a scan in CircularONE on a phone or tablet and have allowed location access, we record your device’s location at that moment. We do not record it at any other time. Other organisations that can see that scan can also see its location, along with what the entry shows about who filed it (see “Who can see it”). You can turn off location access in your device or browser settings at any time, and scanning works the same without it. This applies only once we have enabled the feature.
• Pairing hardware. On some phones the CircularONE app needs location permission to search for nearby hardware over Bluetooth. The app uses it only for that search and does not record your location.

How we use it

We use personal data to:

• set up and run your account and let you sign in;
• record where ecoTOTEs and other hardware are and what has been done with them, for your organisation and for the other organisations that handle the same hardware;
• check that a scan matches the site it was filed against;
• send you the emails the Services depend on, such as account activation, password resets, and fault and product notices;
• answer your support requests;
• keep the Services secure, investigate misuse and fix errors;
• understand how the Services are used, so we can improve them;
• meet our legal obligations.

We do not send marketing emails, and we do not sell personal data.

We may share statistics about how the Services are used, for example with prospective partners. These statistics do not identify you.

Who can see it

• Your organisation can see your account details and the records you file.
• The brand that owns an ecoTOTE or other hardware can see everything done with it while it owns it, including scans by the licensed operator, the bottler and the venues that handle it. If ownership passes to another brand, the previous owner keeps seeing what happened while it owned the hardware, and the new owner sees only what happens after the transfer.
• Other organisations that handle the hardware, such as a licensed operator, a bottler or a venue, see the entries they filed and the entries filed at their own sites, including earlier visits of the hardware to those sites.
• What an entry shows. Where you can see an entry filed by another organisation, it usually shows that organisation’s name and logo. Some entries, such as fills and registrations, can show the username and profile photo of the person who filed it. Email addresses are not shown to other organisations.
• Scan locations can be seen by anyone who can see the entry they belong to.
• ecoSPIRITS staff who need it to run and support the Services.
• Service providers who process data for us, under contract and only on our instructions:
  • Microsoft Azure, which hosts CircularONE in Switzerland;
  • Mailgun, which sends our emails from the European Union;
  • Tuya, which connects our hardware to CircularONE;
  • Google (Google Analytics, Firebase and Crashlytics), for usage analytics and crash reports;
  • Sentry, for error reports;
  • Atlassian (Jira), where support requests are tracked.
• Others where the law requires it, or to protect our rights, our users or the public.
• A buyer or successor, if our business is sold or merged, under the same protections.

International transfers

ecoSPIRITS is based in Singapore, CircularONE is hosted in Switzerland, and some of our service providers process data in the European Union, the United States and elsewhere. When personal data leaves your country, we take steps to make sure it is protected to the standard required by the law that applies to it.

How long we keep it

We may keep data longer where the law requires it or to resolve a dispute.

Cookies and analytics

Cookies are small files a website stores in your browser.

• CircularONE uses cookies to keep you signed in. Without them you cannot use the web app.
• Our website uses Google Analytics cookies to count visits and see how pages are used. You can choose which cookies to allow through the privacy preferences on the website, and change your choice at any time.
• CircularONE web and mobile use Google Analytics (through Firebase) to see how the apps are used. In the mobile app this is linked to your CircularONE user ID.

Google processes analytics data under its own privacy policy: https://policies.google.com/privacy. You can delete or block cookies in your browser settings, but parts of the Services may then stop working.

Security

We protect personal data with technical and organisational measures, including encrypted connections, access limited to people who need it, and hosting in secure data centres. No system is completely secure, and we cannot guarantee that data will never be lost or misused.

Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct it;
• ask us to delete it;
• withdraw your consent where we rely on it, for example by turning off location access;
• object to or restrict how we use it;
• receive it in a format you can pass to someone else.

To use any of these rights, email [email protected]. We may need to confirm your identity first. If your account was set up by your organisation, deleting your personal data may mean you can no longer use CircularONE. Records you filed stay in the history without your name or photo.

If you are not satisfied with our answer, you can complain to your data protection authority: in Singapore, the Personal Data Protection Commission (https://www.pdpc.gov.sg); in the European Union, the authority in your country (https://edpb.europa.eu/about-edpb/about-edpb/members_en).

Changes to this policy

We may update this policy from time to time and will post the new version on this page. You are asked to accept the current version when you sign in to CircularONE, and continuing to use the Services means you accept it.

Contact us

ecoSPIRITS Pte. Ltd.
Company registration number 202011031M
202A South Bridge Road, Singapore 058751

Data Protection Officer: [email protected]
Requests about your personal data: [email protected]

This policy was last updated on 23 October 2026 and is version 2.0.