SG Residence

Privacy policy

Last updated 13 October 2026

Draft for legal review. Highlighted items need filling in, and the whole policy should be checked by a Singapore lawyer before launch.

This policy explains how [Company legal name] (UEN [UEN]), trading as SG Residence ("we", "us"), collects, uses, discloses and protects personal data under Singapore's Personal Data Protection Act 2012 (PDPA).

Who this policy covers

  • Agents: property salespersons who sign up to use SG Residence.
  • Agents' clients: people who message an agent's WhatsApp number while the agent uses SG Residence.
  • Visitors to sgresidence.com.

For agents' clients, the agent (and their agency) decides why and how the client's data is used. We process that data on the agent's behalf to provide the service, as a data intermediary under the PDPA. Questions about a specific agent's use of your data should go to that agent first; we will help them respond.

What we collect

From agents

  • From Google sign-in: your name, email address and profile photo.
  • Details you give us: CEA registration number, agency name, mobile number, working hours, assistant settings, FAQs and listings you add.
  • From Google Calendar, with your permission: busy and free times, and the viewing events we create for you.
  • From WhatsApp (Meta), with your permission: your WhatsApp Business account and phone number identifiers, and the messages sent and received on that number while the service is connected.
  • Usage information such as log-ins and settings changes, to run and secure the service.

From agents' clients

  • Your WhatsApp name and number, and the messages, voice notes and files you send to the agent's number.
  • What you tell the assistant about your property needs, for example area, budget, timeline and flat type.
  • Viewing appointments you book.

The assistant does not ask for NRIC numbers. It may ask about ethnicity only where relevant to HDB's Ethnic Integration Policy for a specific flat, and explains why when it does.

How we use it

  • To reply to enquiries on the agent's behalf, qualify leads and book viewings.
  • To send agents lead summaries, viewing requests and reminders, and to send clients viewing confirmations and reminders.
  • To verify that agents are registered with the Council for Estate Agencies (CEA).
  • To operate, secure, support and improve the service.
  • To meet legal obligations.

We do not sell personal data, and we do not use agents' clients' data to market to them.

Data from Google

SG Residence's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google Calendar access only to read your free and busy times and to create, update or remove viewing events that you or your assistant arranged. We do not read your email. We do not use Google user data to train AI models, and we do not transfer it to others except as needed to provide this feature, for security, or to comply with law.

AI processing

Messages are processed by an AI model to draft replies, transcribe voice notes and summarise leads. We use [AI provider name(s)] for this, under terms that do not allow them to use the data to train their models. Every AI-written message is labelled as the agent's assistant.

Who we share it with

  • Service providers who host or run parts of the service for us: [hosting provider] (servers in Singapore), Meta (WhatsApp Business Platform), Google (sign-in and Calendar), [AI provider(s)].
  • The agent a client is talking to, who sees the conversation and lead summary.
  • Authorities, where required by law.

Where it's stored

Our servers and database are in Singapore. Some service providers (such as Meta, Google and AI providers) may process data outside Singapore. Where that happens, we take steps so the data receives protection comparable to the PDPA.

How long we keep it

  • Conversations and lead details: for as long as the agent's account is active, and up to [12] months after, unless the agent deletes them earlier.
  • Agent accounts: until you close your account, then up to [30] days for recovery, unless law requires longer.
  • Security and audit logs: up to [12] months.

Your choices

  • Ask for access to, or correction of, your personal data.
  • Withdraw consent. Agents can disconnect Google or WhatsApp at any time in settings, or through their Google account and Meta Business Suite.
  • Clients can ask the agent, or us, to delete their conversation.

We reply to requests within 30 days.

Security

Connection tokens are stored encrypted, data is sent over encrypted connections, and access to personal data is limited to staff who need it. If a data breach is likely to cause significant harm, we will notify the PDPC and affected people as the PDPA requires.

Contact

Data Protection Officer: [name], privacy@sgresidence.com, [registered address].