Possible Privacy Policy

Last updated: 1 November 2026

This policy explains how BRAIN TRUST PRIVATE LIMITED, a Singapore company (UEN 202416698H) ("we", "us"), collects, uses and discloses personal data through possible.sh and our paid teardown reports (the "Service"). We're responsible for that data under Singapore's Personal Data Protection Act 2012 (PDPA) and, where they apply, the EU and UK GDPR.

What we collect

  • Order details, such as your email address and name, and the brief you give us: a competitor link, a description of your product, and your question.
  • Payment information. Our payment provider collects your payment details at checkout under its own privacy policy. We receive details such as your name, email, billing country and payment status, but not your full card number.
  • Waitlist email. If you join a waitlist, your email address and which page you joined from.
  • Communications, such as messages you send us.
  • Technical information that our hosting provider processes to deliver and secure the site, such as IP address and browser type.

Our page-visit counts are anonymous daily totals by page, referring site and campaign tag. They don't use cookies and don't identify you.

Reports about competitors. To write a report, we research public sources about the business you name. Those sources may mention people, such as founders or staff, by name. We use only what's publicly available, and only to write the report.

How we use it

We use personal data to:

  • research, write and email your report, and handle refunds;
  • process payments and keep billing records;
  • email you about the agent you joined a waitlist for, which you can stop at any time;
  • reply to you;
  • protect the Service and prevent fraud and abuse;
  • improve the Service;
  • comply with the law and enforce our terms.

Legal bases (EU and UK). We rely on: performance of our contract with you; our legitimate interests in running, securing and improving the Service; your consent, where we ask for it; and compliance with legal obligations.

We don't sell your personal data.

Who we share it with

  • Service providers that help us run the Service: payment processing, hosting and content delivery, database, email delivery, and AI model providers that help research and write reports. They may use the data only to provide their services to us.
  • Authorities and others, where the law requires it, or where we believe it's needed to protect the rights, property or safety of Possible, our users or others.
  • A buyer or successor, if we sell or transfer all or part of our business.

We may share aggregated or de-identified information that doesn't identify you.

International transfers

We're based in Singapore, and our service providers may process data in other countries. Where we transfer personal data out of Singapore, we take steps to ensure it receives protection comparable to the PDPA. For data from the EU or UK, we use a lawful transfer mechanism, such as standard contractual clauses.

How long we keep it

We keep personal data for as long as we need it for the purposes above, including to deliver your report, handle refunds, resolve disputes and meet legal, tax and accounting requirements. After that, we delete or anonymise it within a reasonable time. Copies may remain for a limited period in backups.

Security

We use reasonable security arrangements to protect personal data. No method of transmission or storage is completely secure, and we can't guarantee the security of your data.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent. To make a request, email hello@possible.sh. We may need to verify your identity, and we'll respond within the time the law requires. Some data may be exempt, for example where we must keep it by law.

You can also complain to Singapore's Personal Data Protection Commission or your local data protection authority.

Children

The Service isn't for anyone under 18, and we don't knowingly collect their personal data. If you believe we have, contact us and we'll delete it.

Changes

We may update this policy from time to time. We'll post the new version here and update the date above. Where the law requires, we'll tell you about material changes in another way too.

Contact

Questions and requests: hello@possible.sh. You can contact our Data Protection Officer at the same address.

Adapted from the Basecamp open-source policies / CC BY 4.0