Privacy Policy

Nucleus by Handshake

Last updated on 7 May 2026.

This Privacy Policy (“Policy”) describes how Handshake Technologies Pte. Ltd. (Singapore UEN No. 202424769C) (“Handshake”, “we”, “our”, or “us”) collects, uses, discloses, and protects personal data in connection with the Nucleus platform (“Nucleus” or the “Platform”), our website at https://nucleus.handshake.finance, and any other related services (collectively, the “Services”).

This Policy is designed to comply with the Singapore Personal Data Protection Act 2012 (the “PDPA”). It forms part of, and should be read together with, our Terms of Service and any Data Processing Addendum we may enter into with you.

Nucleus is a quote-to-cash and accounts receivable automation platform used by service businesses to issue invoices, schedule reminders, collect payments, and reconcile receivables. In the course of providing the Services, Handshake processes personal data of three distinct categories of individuals, and our role under the PDPA differs for each. This Policy is structured around those three categories.

Handshake may from time to time update this Policy to reflect changes in our practices or applicable law. Updates will be posted at https://nucleus.handshake.finance with the revised “Last updated” date above. Material changes will be notified through the Platform or by email. Continued use of the Services after an update constitutes acceptance of the revised Policy.

1. Definitions

“Individual” means a natural person, whether living or deceased, and “Individuals” shall be construed accordingly.

“Personal Data” means data that is capable of identifying an Individual, whether on its own or in conjunction with other data accessible to Handshake.

“Merchant” means a business that has registered for an account on Nucleus, together with its authorised users.

“Merchant Client” means an individual or business to whom a Merchant issues an invoice or sends a communication through Nucleus.

“Personnel” means any Individual engaged under a contract of service with Handshake, permanent or temporary employees as well as trainees and interns engaged by Handshake from time to time.

“Sensitive Personal Data” includes data relating to race or ethnic origin, political opinions, religion or similar, trade union membership, physical or mental health, sexual life, or criminal record. We do not seek Sensitive Personal Data, and Nucleus is not designed for the processing of Sensitive Personal Data.

2. Our Role for Each Category of Individual

Under the PDPA, the rights of the Individual and the corresponding obligations of an organisation depend on whether the organisation is acting on its own account or processing data on behalf of another organisation. The following table sets out our role in respect of each category of Individual whose Personal Data is processed by Nucleus.

A. Merchants and their authorised users

When you register for a Nucleus account or are added as an authorised user of a Merchant’s account, Handshake collects and processes your Personal Data on its own account. We are the controller of your Personal Data and our use of it is governed by Sections 3 to 9 of this Policy.

B. Merchant Clients

When a Merchant uploads, enters, or otherwise provides Personal Data of a Merchant Client into Nucleus — for example, a client’s name, email address, telephone number, billing address, or invoice history — the Merchant is the data controller of that Personal Data and Handshake processes it on the Merchant’s behalf as a data intermediary in accordance with the PDPA. The Merchant is responsible for ensuring it has a lawful basis under the PDPA to provide that Personal Data to Handshake and to instruct Handshake to use it (including, where applicable, to send reminders and other communications to the Merchant Client).

If you are a Merchant Client and have questions about how your Personal Data is being processed, please contact the Merchant who issued an invoice or sent you a communication. We will refer such enquiries to the Merchant. Handshake processes Merchant Client Personal Data only as instructed by the Merchant and as set out in Section 10 of this Policy.

C. Website visitors

When you visit our public website at https://nucleus.handshake.finance without registering for an account, we are the controller of any Personal Data we collect about you (such as your IP address and information collected via cookies). Section 11 of this Policy describes that processing.

3. Personal Data of Merchants We Collect

We collect the following categories of Personal Data from Merchants and their authorised users:

• identification and contact data: name, business email, telephone number, business address, role, and authorised-signatory details;
• account and login data: username, password (in hashed form), authentication tokens, and login history;
• verification data: information required to satisfy know-your-business and anti-money-laundering checks, including company registration details, beneficial-ownership information, and identification documents of authorised representatives;
• financial and settlement data: bank account details for settlement, billing addresses, payment-method information (handled by our payment service providers), and tax information;
• usage data: invoices issued, payment records, reminder activity, integration usage, and other data generated through your use of the Platform;
• communications: support requests, correspondence with our team, and feedback you provide;
• device and network data: IP address, browser type, operating system, device identifiers, and other technical data automatically collected when you use the Platform.

4. How We Collect Merchant Personal Data

We collect Personal Data described in Section 3 in the following ways:

• directly from you when you register for an account, complete verification, configure your account, issue invoices, or otherwise use the Platform;
• from your interactions with our Personnel via email, telephone, video call, support channels, or in person;
• from our identity verification, fraud, sanctions screening, and credit-reference providers, where applicable;
• from our payment service providers and banking partners, in connection with settlement and reconciliation;
• from third-party services you choose to integrate with Nucleus (for example, accounting software);
• automatically through cookies and similar technologies when you use the Platform; and
• from publicly available sources (such as company registers and professional networks) for verification, due diligence, and business-development purposes.

5. Purposes for Which We Use Merchant Personal Data

We use Merchant Personal Data for the following purposes:

A. Providing and operating the Services

• creating and administering your account, authenticating users, and providing access to features;
• verifying your identity and the standing of your business, including for anti-money-laundering, counter-terrorism-financing, and sanctions screening purposes;
• processing invoices, reminders, and payments, and reconciling settlements;
• integrating with third-party services you have authorised;
• providing customer support and responding to your queries;
• communicating service announcements, security notices, and changes to terms or this Policy.

B. Billing and account management

• charging subscription fees, transaction fees, and other amounts due, and recovering amounts in respect of chargebacks, reversals, or refunds;
• issuing receipts, statements, and tax documentation.

C. Security, fraud prevention, and compliance

• detecting, preventing, and investigating fraud, abuse, security incidents, and breaches of our terms;
• complying with applicable laws, regulations, lawful orders, and the requirements of payment service providers, banks, regulators, and courts.

D. Improving the Services

• analysing usage patterns to improve the Platform’s performance, reliability, and features;
• developing new features and services, including through the use of anonymised or aggregated data that does not identify you or your Merchant Clients.

E. Marketing

• sending you information about new features, product updates, and offers from Handshake, where you have not opted out;
• measuring the effectiveness of our marketing and improving the relevance of communications you receive.

You may opt out of marketing communications at any time using the unsubscribe link in any marketing email or by contacting our Data Protection Officer. Service-related communications (for example, security notices and billing notifications) will continue to be sent regardless of your marketing preferences.

6. Disclosure of Merchant Personal Data

We may disclose Merchant Personal Data to the following categories of recipient:

• payment service providers, banks, and card schemes that process payments collected through the Platform;
• identity verification, anti-money-laundering, sanctions, and fraud-prevention service providers;
• cloud hosting, data storage, and infrastructure providers that operate the systems on which Nucleus runs;
• communications providers used to deliver email, SMS, and messaging-app notifications;
• analytics, monitoring, and security service providers;
• professional advisors, including auditors, accountants, and lawyers;
• regulators, government agencies, courts, and law enforcement, where disclosure is required or permitted by law;
• any actual or proposed acquirer, successor, or assignee of Handshake or its business, in connection with a merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality protections;
• other parties with your consent or at your direction.

We do not sell Merchant Personal Data to third parties.

7. Retention

We retain Merchant Personal Data for as long as your account is active and for such further period as is necessary to:

• comply with our legal, accounting, tax, anti-money-laundering, and regulatory obligations;
• resolve disputes, enforce our agreements, and defend legal claims;
• protect the security and integrity of the Services.

Where we no longer have a lawful basis to retain Personal Data, we will delete or anonymise it. Anonymised data, which does not identify any Individual, may be retained and used for analytics, benchmarking, and product improvement without further restriction under this Policy.

8. Security

Handshake makes reasonable physical, technical, and organisational security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, or disposal of Personal Data in our possession. These include access controls, encryption in transit and at rest where appropriate, logging and monitoring, vendor due diligence, and Personnel training.

No system can be completely secure, and we cannot guarantee the absolute security of any Personal Data. You are responsible for keeping your account credentials confidential and for notifying us promptly of any suspected unauthorised access. In the event of a data breach affecting your Personal Data that is likely to result in significant harm, we will notify you and the Personal Data Protection Commission in accordance with the PDPA.

9. Cross-Border Transfers

The Services are provided from Singapore. From time to time, Personal Data may be transferred to, stored in, or accessed from countries outside Singapore, for example where our cloud-hosting, communications, or other service providers operate facilities in other jurisdictions. Where we transfer Personal Data outside Singapore, we will take reasonable steps to ensure that the recipient is bound by legally enforceable obligations to protect the Personal Data to a standard comparable to that required under the PDPA.

10. Merchant Client Personal Data

When a Merchant uses Nucleus, the Merchant uploads, enters, or otherwise causes the Platform to receive Personal Data about its Merchant Clients, such as names, email addresses, telephone numbers, billing addresses, invoice details, and payment histories.

Handshake processes Merchant Client Personal Data on behalf of the Merchant and only for the following purposes:

• issuing invoices and hosting payment pages on the Merchant’s behalf;
• sending automated reminders and related communications to Merchant Clients on the Merchant’s instruction, by email, SMS, or messaging applications;
• processing payments through our payment service providers and reconciling them against invoices;
• providing the Merchant with reporting on its accounts receivable, payment behaviour, and related metrics;
• detecting and preventing fraud and abuse on the Platform; and
• complying with applicable law and the lawful instructions of the Merchant.

Handshake does not use Merchant Client Personal Data for our own marketing, and does not sell Merchant Client Personal Data. We may use anonymised, aggregated, or de-identified data derived from Merchant Client activity (which does not identify any Individual) to operate, secure, and improve the Services.

If you are a Merchant Client and have questions about how a Merchant is using your Personal Data, you should contact the Merchant directly. If you wish to make a complaint or contact Handshake, you may write to us at contact@handshake.finance and we will refer your enquiry to the relevant Merchant.

11. Website Visitors and Cookies

Our website at https://nucleus.handshake.finance uses cookies and similar technologies to operate the site, remember your preferences, analyse traffic, and improve performance. The categories of cookies we use are:

• strictly necessary cookies that are essential for the website to function;
• preference cookies that remember your settings;
• analytics cookies that help us understand how the website is used; and
• marketing cookies that help us measure the effectiveness of our advertising, where applicable.

You may control cookies through your browser settings. Disabling cookies may affect the functionality of the website. We collect IP address, browser type, device information, referring URL, and pages visited from website visitors, and use that data to operate the website, analyse traffic, and detect abuse.

12. Your Rights and How to Exercise Them

Subject to the PDPA, you have the right to:

• request access to your Personal Data held by Handshake;
• request information about the ways in which your Personal Data has been or may have been used or disclosed by Handshake in the year preceding the request;
• request the correction of inaccurate or incomplete Personal Data;
• withdraw consent to our collection, use, or disclosure of your Personal Data, subject to legal or contractual restrictions and reasonable notice; and
• make a complaint to us or to the Personal Data Protection Commission of Singapore.

To exercise any of these rights, please contact our Data Protection Officer at contact@handshake.finance. We will respond to your request within the timeframes required by the PDPA. We may need to verify your identity before processing your request, and we may charge a reasonable fee for handling access or disclosure-history requests as permitted by the PDPA.

Withdrawing consent or requesting deletion of certain Personal Data may affect our ability to provide the Services to you. Some Personal Data may also need to be retained where retention is required to satisfy legal, accounting, regulatory, or anti-money-laundering obligations.

13. Third-Party Links and Services

Nucleus integrates with, or links to, third-party services such as accounting software, payment service providers, and messaging providers. Your use of those services is governed by their own privacy policies. Handshake is not responsible for the privacy practices of third-party services and recommends you review their policies before sharing Personal Data with them.

14. Children

The Services are intended for use by businesses and their authorised representatives. We do not knowingly collect Personal Data from anyone under the age of 18. If you believe a child has provided us with Personal Data, please contact our Data Protection Officer and we will take steps to delete it.

15. Contacting Us

If you have any questions, comments, or complaints about this Policy or our processing of your Personal Data, please contact our Data Protection Officer at contact@handshake.finance.

Handshake Technologies Pte. Ltd. (UEN 202424769C), Singapore.

16. Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of Singapore without regard to its conflict-of-laws principles. Any dispute arising out of or in connection with this Policy, including any question regarding its existence, validity, or termination, shall be referred to and finally resolved by the courts of Singapore.