Privacy Policy
Last updated: 5 September 2026
This Privacy Policy describes how SOLO Software Private Limited ("SOLO", "we", "us", or "our") collects, uses, discloses, and protects your personal data in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore.
1. Data Controller
The data controller responsible for your personal data is:
SOLO Software Private Limited UEN: 202607912K Data Protection Officer: privacy@solo.sg
2. Personal Data We Collect
We collect the following categories of personal data:
(a) Account Information: Email address and authentication tokens for magic link and OTP login. SOLO does not use password-based authentication.
(b) Identity Verification Data (via Singpass MyInfo): Full name, NRIC number (we store only a keyed one-way hash of it, computed using HMAC-SHA256 with a secret key held outside the database, and a masked display version showing only the last 4 characters. The keyed hash cannot be reversed to recover your NRIC. The full NRIC is not retained after initial processing), date of birth, nationality, residential status, and registered address. This data is retrieved with your explicit authorisation via the Singpass MyInfo API solely for identity verification and reasonable ownership cross-referencing as disclosed to you at the point of retrieval. This data is not used for any secondary purpose, profiling, or marketing. This restriction is a requirement of our Singpass API Services Agreement with Government Technology Agency.
(c) Property Information:
For HDB listings: address, block, street, flat type, floor range, floor area, lease commencement date, photographs of the property, asking price, property description, and co-owner information including names and email addresses.
For condo, landed, and commercial listings: project or development name, address, unit type, floor level, floor area, tenure, asking price, photographs of the property, property description, and co-owner information where applicable.
For rental listings: all of the above for the relevant property type, plus monthly rent, deposit terms, availability date, minimum tenancy period, furnishing details, room or whole-unit configuration, and any tenant preferences the landlord or agent chooses to publish.
For agent listings: agent CEA registration number, estate agent firm name, CEA licence card image, owner consent records, and all property information listed above for the relevant property type.
(d) Communication Data: Messages exchanged between users through the Platform's communication features, viewing booking details, co-owner consent records and responses.
(e) Technical Data: IP address, browser type and version, device information, operating system, access timestamps, pages visited, and referral URLs.
(f) WhatsApp Contact Information: Mobile phone number, provided voluntarily for WhatsApp notifications. We use Twilio's WhatsApp Business API to send transactional notifications. Your phone number is shared with Twilio solely for this purpose and is governed by Twilio's data processing terms.
(g) Transaction Data: Transaction milestone records including milestone status, completion timestamps, deadline dates, and responsible party assignments; activity logs recording milestone completions and system events; nudge records (manual reminders sent between transaction parties); automated reminder records; and transaction health indicators.
(h) Behavioural and Preference Data: Listing view history, search activity, time spent on listing pages, saved listings, and automatically computed preference profiles including preferred property types, locations, floor levels, and price ranges. These profiles are computed automatically in the background based on your activity on the Platform. They are used solely within the Platform to improve listing relevance and are not used for automated decision-making with legal or similarly significant effects, and are not shared with third parties.
(i) Analytics Data: When you consent to optional analytics cookies, we use PostHog to collect anonymised usage data including pages visited, features used, button clicks, session duration, and general interaction patterns. We implement reasonable technical measures designed to prevent personally identifiable information from being transmitted to PostHog. You can opt out at any time through the cookie preferences banner.
(j) CEA Agent Data: For CEA-licensed agents, we additionally collect CEA registration number, estate agent firm name, and licence card images for verification purposes. CEA registration information is verified against publicly available data from the Council for Estate Agencies at the time of onboarding.
(k) Agent-Added Third Party Contact Data: CEA-licensed agents may input contact details of their buyer and seller clients including name, phone number, and email address for the sole purpose of sending automated transaction milestone reminders. These individuals have not directly registered on SOLO. This data is used only for sending the specific reminders configured by the agent and is retained only for the duration of the active transaction plus 12 months.
(l) Security Event Logs: SOLO records security-related events including authentication attempts, verification activities, and access anomalies in a security event log. This log may contain user identifiers and is retained for fraud prevention and platform security purposes for a period of 24 months.
(m) SOLO Jumpstart Data: Where a CEA-licensed agent enables SOLO Jumpstart, we record the opt-in and any later opt-out with the date, time, device user agent, and the exact wording agreed to. To prepare draft listings inside that agent's own account we use information the agent supplies to us and factual property information that is publicly available, such as address, block and street, project name, tenure, floor area, and government transaction data. Jumpstart drafts are private to the agent, are not published by SOLO, and each draft records that it was started by SOLO and by which administrator.
(m1) SOLO Jumpstart Direct: Where a CEA-licensed agent replies yes to our WhatsApp invitation, we record that consent with the date, time, the exact button wording, and the phone number that replied. We then create a temporary profile for that agent using only information from the CEA public register, being the registered name, agency, licence number and registration number, together with the phone number we contacted. We prepare a listing on the agent's behalf and send it to the agent through a private link. Nothing is published until the agent approves it on that screen, and the approval is stored with its date, time and exact wording. An agent who replies no thanks is recorded as declined and receives no further Jumpstart Direct messages. To withdraw and have the temporary profile and any prepared listing deleted, reply to our WhatsApp message or write to us at the contact address below.
(n) Agent Outreach Data: For CEA-licensed agents and prospective agents, we record outreach and messaging activity including WhatsApp campaign sends, delivery and read status returned by our messaging provider, replies, and whether marketing consent has been given or withdrawn. Marketing messages are sent only with consent, and consent can be withdrawn at any time.
(o) Public Agent Profile Data: For onboarded agents, name or display name, profile photo, CEA registration number, estate agent firm, published professional details, and live listings are shown in SOLO's public agent directory. This information is visible to visitors who are not signed in and may be indexed by search engines. Agent mobile numbers and email addresses are not published publicly.
3. How We Collect Personal Data
(a) Directly from you: When you register an account, create a listing, upload photographs, book a viewing, or communicate with other users through the Platform.
(b) From Singpass MyInfo: When you authorise the retrieval of your personal data via the Singpass MyInfo API for identity verification. This retrieval occurs only with your explicit consent at the point of verification. Data retrieved from MyInfo is used only for the purposes disclosed to you at the time of retrieval and is not used for any secondary purpose.
(c) From publicly available sources: HDB resale transaction data from data.gov.sg, URA private property transaction data from ura.gov.sg, property coordinates from OneMap operated by the Singapore Land Authority, and CEA agent registration data from the CEA public register at cea.gov.sg. We also use factual, publicly available property information when preparing SOLO Jumpstart drafts for agents who have enabled that feature. We do not copy listing descriptions, photographs, or other creative content from third-party property portals.
(d) Automatically: Through essential cookies, server logs, and automated background processes including buyer preference computation when you access and use the Platform.
(e) From CEA-licensed agents: Agents may provide contact details of their buyer and seller clients as described in Section 2(k) above.
4. Purposes for Collecting and Using Personal Data
We use your personal data for the following purposes:
(a) Account management: To create, maintain, authenticate, and secure your account.
(b) Identity verification: To verify your identity via Singpass and confirm that sellers are genuine property owners, and that CEA-licensed agents hold valid registrations at the time of onboarding. NRIC numbers are stored only as a keyed one-way hash (HMAC-SHA256 with a secret key held outside the database) together with a masked display version. The full NRIC is not stored in plaintext after processing.
(c) Property listing services: To display your property listing to potential buyers, generate AI-assisted property descriptions and photo analyses using the property data you provide, facilitate viewing bookings, process co-owner consent, and verify CEA agent credentials for agent listings.
(d) Communication and transaction support: To enable scheduling between buyers and sellers or their agents, send transactional notifications via email and WhatsApp about listing status, viewing bookings, co-owner consent requests, and important platform updates. To send automated deadline reminders prior to and following milestone due dates during active transactions. To facilitate manual reminder notifications sent by one transaction party to the other, subject to a 12-hour cooldown period per milestone.
(e) Platform operation and improvement: To monitor platform performance, detect and prevent fraud, ensure compliance with our Terms of Service, troubleshoot technical issues, and improve the user experience.
(f) Legal compliance: To comply with applicable laws, regulations, and lawful requests from government authorities, including the PDPA, Estate Agents Act 2010, CEA regulations, and any applicable anti-money laundering regulations.
(g) Transaction milestone tracking: To generate, track, and display transaction milestones, estimated deadlines, and completion status for active property transactions. To provide general informational materials at each milestone stage. To enable administrators to review transaction progress and, where necessary, override milestone statuses for platform integrity review, abuse investigation, or error correction purposes, with all such actions recorded in an auditable log. Transaction data is visible only to authorised participants within the same transaction workflow.
(h) Analytics and product improvement: Where you have consented to analytics cookies, to track anonymised usage patterns, understand feature adoption, identify usability issues, and improve the Platform experience.
(i) Buyer preference profiling: To automatically compute buyer preference profiles based on your browsing and search behaviour for the purpose of improving listing relevance within the Platform. This computation occurs automatically in the background. These profiles are not used for automated decision-making with legal or similarly significant effects and are not shared with third parties.
(j) EIP compliance monitoring: To monitor Ethnic Integration Policy quota status for active listings and notify sellers, agents, and administrators of changes in eligibility status as required for platform compliance.
(k) Security event logging: To record authentication and verification events for fraud prevention, platform security, and abuse investigation purposes.
(l) Transaction reminder delivery for agent clients: To send automated transaction milestone reminders to buyer and seller clients whose contact details have been provided by their appointed CEA-licensed agent, solely for the purpose of those specific reminders.
(m) SOLO Jumpstart: To prepare private draft listings inside the account of a CEA-licensed agent who has enabled Jumpstart, and to keep a record of that agent's opt-in and opt-out choices.
(n) Agent outreach and marketing: To contact CEA-licensed agents and prospective agents about SOLO where they have given marketing consent, and to record delivery status and consent withdrawals.
5. Legal Basis for Processing
Under the PDPA, we process your personal data on the following bases:
(a) Consent: You provide consent when you register for an account, authorise Singpass MyInfo retrieval, opt in to WhatsApp notifications, and create a property listing. For third parties whose contact details are provided by agents, the consent basis is the agent's representation that consent has been obtained from their client.
(b) Contractual necessity: Processing necessary for the performance of our Terms of Service.
(c) Legitimate interests: Processing necessary for our legitimate interests in operating, securing, and improving the Platform, provided these interests are not overridden by your data protection rights. This includes security event logging, fraud prevention, and buyer preference profiling.
(d) Legal obligation: Processing required to comply with applicable Singapore laws.
6. Disclosure of Personal Data
We may disclose your personal data to:
(a) Other Platform users: Your listing information (property details, photographs, first name or display name, verification status) is visible to other users of the Platform. For agent listings, the agent's name, CEA registration number, and agency name are also visible. We do not disclose your NRIC, whether full or masked, to any other user. The Option to Purchase walkthrough available on the Platform is an educational guide only. Anything you type into it stays in your browser, is not saved by us, and is not sent to the other party. Your full NRIC, email address, phone number, and home address are NOT disclosed to other users. Transaction milestone progress and activity history are visible only to authorised participants within the same transaction workflow.
(b) Co-owners: If you list a jointly-owned property, we share listing details and your name with identified co-owners for the purpose of obtaining their consent.
(c) Service providers: We use the following third-party service providers who process data on our behalf under appropriate contractual safeguards:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database hosting, authentication, security logging | Account data, listing data, security events | Singapore region |
| Twilio | WhatsApp notifications | Phone number, message content | United States (with contractual safeguards) |
| Google Gemini API | AI-generated descriptions, photo analysis, chat suggestions, market insights, location summaries | Property address, features, and listing photos. No personal identity data. | Global |
| Singpass / MyInfo | Identity verification | As authorised by user, operated by Government of Singapore | Singapore |
| PostHog | Product analytics | Anonymised usage patterns; technical measures applied to minimise PII | EU / United States |
| Resend | Transactional email delivery | Email address, email content | United States (with contractual safeguards) |
| Meta Pixel (Meta Platforms, Inc.) | Conversion tracking and analytics for agent signup | Anonymised page-view and event data; no personal identity data is deliberately transmitted | United States |
| Google Ads (Google LLC) | Advertising conversion tracking for completed agent registrations | Anonymised conversion event data; no personal identity data is deliberately transmitted | United States |
(d) Government authorities: When required by law, court order, regulatory direction, or government regulation, including the Council for Estate Agencies and the Personal Data Protection Commission.
We do NOT:
- Sell, rent, or trade your personal data to third parties for marketing purposes
- Share your data with renovation companies, banks, insurance providers, or property agents for marketing purposes
- Use your personal data for targeted advertising
- Share your data with any party not listed above without your consent
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion plus 30 days for processing, except where longer retention is required for legal, fraud prevention, audit, or regulatory purposes |
| NRIC keyed hash | Duration of active listing, deleted on account deletion |
| Full NRIC | Not retained, deleted immediately after the keyed hash is computed at point of verification |
| Listing data (active) | Until sold, expired, or deleted by seller |
| Listing data (archived/sold) | 12 months after removal, then deleted |
| Communication/booking records | 12 months after associated listing is removed |
| Technical/server logs | 90 days |
| WhatsApp phone number | Until user opts out or deletes account |
| Transaction milestone and activity data | Duration of active transaction plus 24 months after transaction completion or cancellation |
| Nudge and reminder records | Duration of active transaction plus 12 months |
| Buyer behavioural/preference data | Until account deletion or 12 months of inactivity |
| CEA licence card images | Duration of agent registration on Platform plus 12 months |
| Security event logs | 24 months |
| Agent-added third party contact data | Duration of active transaction plus 12 months |
| Singpass MyInfo retrieved data | Not retained beyond initial processing |
Upon account deletion, all personal data is deleted within 30 days, except where longer retention is required for legal, fraud prevention, audit, or regulatory purposes, and except for transaction records which other authorised transaction participants may have a legitimate interest in retaining for the duration specified above.
8. Data Security
We implement the following technical and organisational measures to protect your personal data:
(a) Encryption in transit using TLS 1.2 and above for all data transmitted between your device and our servers.
(b) Encryption at rest for sensitive data fields. NRIC numbers are stored only as a keyed one-way hash (HMAC-SHA256 with a secret key held outside the database), so the hash cannot be reversed or matched by anyone who does not hold the key. Authentication tokens are securely managed by Supabase Auth.
(c) Row-Level Security (RLS) policies on our database to ensure users can only access data they are authorised to view.
(d) Regular security reviews of our codebase, edge functions, and infrastructure.
(e) Access controls limiting employee access to personal data to those with a legitimate operational need.
(f) Co-owner consent tokens are hashed (SHA-256) and time-limited (7-day expiry) to prevent unauthorised access.
Despite these measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data but are committed to promptly notifying affected users in the event of a data breach as required by the PDPA.
10. Your Rights Under the PDPA
Under the PDPA, you have the right to:
(a) Access: Request access to the personal data we hold about you.
(b) Correction: Request correction of inaccurate or incomplete personal data.
(c) Withdrawal of consent: Withdraw your consent for us to collect, use, or disclose your personal data, subject to legal and contractual restrictions. Note: Withdrawal of consent may affect your ability to use the Platform.
(d) Data portability: Request a copy of your personal data in a commonly used, machine-readable format where technically feasible.
(e) Deletion: Request deletion of your personal data, subject to legal retention obligations.
For third parties whose contact details have been entered by a CEA-licensed agent, you may also contact us to access, correct, or remove your data, or to stop receiving reminder communications.
To exercise any of these rights, contact our Data Protection Officer at privacy@solo.sg. We will respond within 30 days as required by the PDPA.
11. International Data Transfers
Your personal data is primarily stored in Singapore via Supabase's Singapore region. Some data may be processed by service providers in other jurisdictions. Where data is transferred outside Singapore, we ensure adequate data protection through contractual safeguards consistent with the PDPA's transfer limitation obligation (Section 26).
12. Children's Data
The Platform is not intended for use by persons under 21 years of age, consistent with the minimum age for HDB flat ownership in Singapore. We do not knowingly collect personal data from persons under 21. If we become aware that we have collected data from a person under 21, we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or through the Platform.
14. Contact
Data Protection Officer Email: privacy@solo.sg UEN: 202607912K