PropSeek Privacy Policy
| Item | Value |
|---|---|
| Version | v1.0 |
| Effective date | 2026-10-13 |
1. Scope and operator
1.1 This Privacy Policy explains how the PropSeek mobile application (the "App") and the website https://propseek.homes (the "Website") collect, use, disclose, retain and delete your personal data.
1.2 The operator is Redland Pte. Ltd. (UEN 202304648K, "we" or "us").
1.3 This Policy is made under Singapore's Personal Data Protection Act 2012 (PDPA).
1.4 PropSeek is an advertising platform for rental listings. We are not a property agency, we do not hold rent or deposits, and we do not take part in negotiation or deals between you and a lister (see the Platform Identity Statement).
1.5 This Policy does not apply to websites or services run independently by third parties.
2. Personal data we collect
2.1 Data you provide
| Category | Examples | Purpose | If not provided |
|---|---|---|---|
| Account | Nickname, sign-in email, sign-in method (one of Apple, Google, WhatsApp, email) | Create and manage your account | You cannot register |
| Mobile number | Number in international format | Bound by a WhatsApp verification code; one number can be bound to one account only | You cannot enter the App |
| Agent profile | Name, CEA registration number, agency, photo, bio, service areas, languages | Checking against the public CEA register; showing the required particulars on listings; profile page | You cannot list as an agent |
| Owner verification documents (if owner listing is opened) | Images of identity document or pass, selfie, ownership or letting eligibility documents | Owner document review | You cannot list as an owner |
| Listing content | Address, unit type, rent, available-from date, occupancy and viewing arrangement, description, photos, videos | Publishing and displaying listings | You cannot publish |
| Contact and messages | Records of contacting listers; chat messages if in-app chat is opened; viewing times if viewing booking is opened | Contact services and anti-scam | You cannot make contact |
| Reports, appeals and support | Report content, evidence, appeal reasons, ticket content | Trust and safety, customer support | Optional |
2.2 Data collected automatically
- Technical data needed to run the service: installation identifier (
install_id), push token, App version, request time, error logs. - Device information and product analytics events: collected only after you consent to "Product analytics", see Section 3.
- Location: only if you allow foreground location, used for "Nearby" and centring the map. We do not read your location in the background.
2.3 Data from public sources
- Public CEA register (name, registration number, agency, registration validity and similar): used to check agent identity and show the required particulars on listings. Treated as business contact information.
- Public CEA transaction records: used for statistics on agent profile pages.
- Public market data such as HDB resale and rental and URA transactions and rental contracts: used for market reference. It does not identify individuals.
2.4 We do not collect full NRIC, FIN or passport numbers in day-to-day operation. Identity document images collected for owner verification are deleted 90 days after the review decision; only the verification result is kept.
3. Device information and product analytics
3.1 Product analytics uses only our own event endpoint /v1/events. We do not use Firebase Analytics or any advertising attribution SDK.
3.2 We do not:
- collect IDFA (iOS advertising identifier) or AAID (Android advertising identifier); the Android build blocks the advertising ID permission;
- use device fingerprinting;
- track you across apps or companies;
- show an ATT (App Tracking Transparency) prompt, because we do not track.
3.3 Device information fields (collected only when "Product analytics" consent is on): interface language, system language, region and time zone, country (from device settings and the country code supplied by the network edge; the server does not store your IP address), device model, OS version, App version, screen size, network type, install source and campaign parameters.
3.4 Withdrawal: You may withdraw "Product analytics" consent at any time in the App's Privacy Centre. Reporting stops immediately, and device information in events already received is cleared within about one hour. install_id and the push token are kept because the service needs them to run.
3.5 Uses: product improvement, user mix statistics, compatibility and crash investigation. Not used for ad targeting.
4. Consent management
4.1 On first launch we explain each category, ask for consent, and record the version and time.
| Category | Default | Covers | Can be turned off |
|---|---|---|---|
| Essential | On | Account, security, anti-scam, service notices, mobile number binding | No; the service cannot be provided without it |
| Product analytics | Asked on first launch | Our own /v1/events and device information (Section 3) |
Yes, at any time |
| Marketing | Unticked | Marketing emails and push notifications | Yes, at any time |
4.2 Channels: Verification codes and transactional messages are sent by WhatsApp (channel provided by Twilio) and by email. We do not send SMS.
4.3 Marketing is sent only by App push and email. Marketing emails carry the <ADV> label and an unsubscribe link. If we ever send marketing messages on WhatsApp, we will first ask for your separate, opt-in consent.
4.4 Consent for cookies and similar technologies on the Website is covered in the Cookie Notice.
5. How we use personal data
- To provide platform features: search, map, listing, verification, contacting listers, renewal and expiry reminders;
- To check agents' CEA registration and show the required particulars on listings automatically;
- Content moderation and anti-scam: after a listing is submitted, automated review (including a cloud large language model) decides whether it goes live; approved listings go live at once and staff then spot-check a share of them;
- Customer support, reports, appeals and PDPA requests;
- Service notices: verification codes, review results, expiry reminders, security notices;
- Product analytics within the scope of your consent;
- Meeting legal obligations and responding to lawful requests from authorities.
We do not sell your personal data.
6. Service providers and data flows
6.1 The following providers process data only on our instructions.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Amazon Web Services | Servers, database, key management, email sending (Amazon SES) | Platform data; email addresses and email content | Singapore (ap-southeast-1) |
| Cloudflare | Website hosting, network protection, object storage, video, bot check (Turnstile), web analytics | Request data, images and videos, web analytics with consent | Global edge network; storage location to be verified |
| Twilio (upstream: Meta WhatsApp) | WhatsApp verification codes and transactional messages | Mobile number, message content, delivery status | United States and its global infrastructure |
| Google sign-in; maps (App map and Website map); Firebase push channel | Account identifier and email; map requests; push token | United States and its global infrastructure | |
| Apple | Sign in with Apple; iOS push | Account identifier and email; push token | United States and its global infrastructure |
| Expo | Push relay | Push token and notification content | United States |
| Sentry | Error and crash monitoring | Error logs, device model and App version | Region to be verified |
| Anthropic | Cloud large language model API: content moderation, document pre-screening, description drafts | Only the text and image parts needed for that task | United States |
| Crisp | Website live chat (loaded only after you consent to "Support" cookies) | Chat content, browser information | European Union (to be verified) |
| OneMap (Singapore Land Authority) | Postal code to address lookup | Postal code and address | Singapore |
6.2 Data minimisation for model calls: we send only what is needed for that review or draft, never the whole account profile. Output is used only as a review label or as a draft for you to confirm; a draft is published only after you confirm it.
6.3 Public data: public datasets from data.gov.sg, URA, CEA and others are mirrored in our own database and attributed as set out in Section 7 of the Platform Identity Statement.
7. Cross-border transfers
7.1 The platform database and business data are stored in Singapore (AWS ap-southeast-1).
7.2 Providers in Section 6 located outside Singapore (the Cloudflare edge network, Twilio and Meta, Google, Apple, Expo, Anthropic, Crisp, and Sentry whose region is to be confirmed) process part of your data overseas. Under section 26 of the PDPA, we require these recipients, through contract terms and their published data protection commitments, to give protection comparable to the PDPA.
8. Retention
8.1 The retention periods below match the current system.
| Data | Retention |
|---|---|
| Owner verification originals (ID, selfie, ownership document images) | Deleted 90 days after the review decision; only the result is kept |
| Chat messages (if in-app chat is opened) | 12 months after the last activity in the conversation; reported conversations, and all conversations involving a reported user, until 12 months after the case is closed |
| Contact records | 24 months from the most recent contact |
| Raw analytics events | 13 months |
| Device records | 13 months after last activity |
| Search logs | 90 days, without user identifier |
| Inbound WhatsApp messages | 90 days |
| Verification code records | 30 days |
| Sign-in sessions | 30 days after expiry |
| Listing videos | 90 days after the listing ends |
| Source text pasted to create a listing draft | 24 hours |
| Data export files | 7 days after creation |
| Consent records | 3 years after account deletion (kept de-identified, to show what consent was given) |
| PDPA request log | 3 years after closure |
| Admin audit logs | Append-only and not deleted, for security and compliance tracing |
| Raw layer of public data mirror | Latest 12 batches |
8.2 Where the law, or an ongoing dispute, litigation or regulatory investigation, requires longer retention, we keep the data as needed and delete it afterwards.
9. Security
9.1 Data in transit is encrypted with TLS. The database and object storage are encrypted at rest. Keys are held in a cloud key management service.
9.2 Admin staff must use two-factor authentication. High-risk and irreversible operations require re-verification within 5 minutes and a second confirmation, and are all written to the audit log.
9.3 No system is perfectly secure. Data breaches are handled as set out in Section 12.
10. Account deletion
10.1 Where: in the App under "Me > Settings > Delete account"; on the web at https://propseek.homes/account-deletion (confirmed by verification code; if you cannot receive a code you may submit a request for manual verification).
10.2 Cooling-off period: after you confirm, a 7-day cooling-off period starts. During it your account is disabled and hidden, and you may cancel at any time. Deletion runs when the period ends.
10.3 What is deleted: personal profile fields such as nickname, contact details and photo are cleared and the account record is anonymised; all sign-in tokens and push tokens are revoked; device information is cleared.
10.4 What happens automatically: live listings are taken down and their "one unit, one code" claim is released; if viewing booking is opened, future bookings are cancelled and the other party is notified; if in-app chat is opened, your messages show as "Deleted user" and their content is deleted on the schedule in Section 8.
10.5 Exceptions: consent records and the PDPA request log are kept as set out in Section 8. To stop banned accounts from deleting and re-registering, the ban list keeps only irreversible hashes of identifiers such as mobile numbers. Admin audit logs are not deleted. Data the law requires us to keep is kept as required.
10.6 If you used Sign in with Apple, you can also stop PropSeek using your Apple ID in your Apple ID settings.
11. Your rights under the PDPA
11.1 How to exercise them: the App's Privacy Centre, or email the DPO (Section 16).
| Right | What it means | Timing |
|---|---|---|
| Access | Ask what personal data we hold about you and how it was used or disclosed in the past year | Reply within 30 days; if we cannot, we tell you in writing when we will |
| Correction | Correct inaccurate or incomplete data | Reply within 30 days; if we cannot, we tell you in writing when we will |
| Withdraw consent | Withdraw consent such as product analytics or marketing | Marketing and product analytics take effect in the App at once; others within a reasonable period (usually 10 business days) |
| Export | Download a copy of your data | Within 30 days, target 72 hours; once every 7 days; downloaded in the App, file kept 7 days |
| Delete account | Delete the whole account | See Section 10 |
| Complain | Complain about how we handle your data | We reply as soon as we can; you may also complain to the Personal Data Protection Commission (PDPC) |
11.2 Access, correction and export are free of charge.
11.3 Once you withdraw consent we stop the related processing, but this does not affect processing carried out before. Withdrawing "Essential" consent means you can no longer use your account.
12. Data breaches
12.1 When we find a suspected data breach, we assess reasonably and promptly whether it must be notified.
12.2 If it must be notified (likely to cause significant harm, or affecting 500 or more people), we notify the Personal Data Protection Commission (PDPC) within 3 calendar days after the assessment. If it is likely to cause you significant harm, we also notify you and tell you what you can do to protect yourself.
12.3 See the DPO and Data Breach Notification Terms for details.
13. Cookies and similar technologies
13.1 Cookies and similar technologies on the Website are described in the Cookie Notice. The App does not use cookies.
14. Minors
14.1 The platform does not offer registration to people under 18 years of age. If we learn we have collected such data by mistake, we will delete it promptly.
15. Changes to this Policy
15.1 We may update this Policy. Material changes will be announced prominently in the App and on the Website, and notified separately where needed.
16. Contact us and the DPO
16.1 Data Protection Officer (DPO): contact by title, "Data Protection Officer", at email dpo@propseek.homes.
16.2 Support: support@propseek.homes; Website /support.
16.3 This Policy is published in Chinese and English. If they differ, the English version prevails.