Privacy Policy

1. Introduction

Homejourney Pte. Ltd. (UEN: 202406236N) ("Homejourney", "we", "us", or "our") is committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore.

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our websites (homejourney.sg), mobile applications (Homejourney, Hello, Prepare, Studio, Agent, Business, Landlord), and related services (collectively, the "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Services.

2. Data Protection Officer

We have appointed a Data Protection Officer ("DPO") to oversee our compliance with the PDPA. If you have any questions about this policy or our data protection practices, please contact:

Data Protection Officer Homejourney Pte. Ltd. Email: dpo@homejourney.sg Phone: +65 8851 6851

We will respond to all legitimate requests within 30 business days.

3. Personal Data We Collect

We collect personal data that you voluntarily provide and data generated through your use of our Services:

• Account information: name, email address, phone number, profile photo
• Identity verification: CEA registration number (for agents), NRIC/FIN (only when required for loan applications via Singpass MyInfo, with your explicit consent)
• Property preferences: search history, saved properties, budget, preferred locations
• Financial information: income range, CPF balances (only via Singpass MyInfo with consent, never stored permanently)
• Transaction data: booking history, payment records (card details are handled by Stripe and never touch our servers)
• Communications: messages sent through our platform, support tickets, feedback
• Device and usage data: IP address, device type, operating system, browser type, app version, usage patterns, crash reports
• Location data: approximate location (city-level) for property search relevance, only with your permission

4. Purposes of Collection

We collect and use your personal data for the following purposes:

• Providing our Services: property search, agent matching, home services marketplace, financial tools, eSIM purchases, exam preparation
• Account management: creating and managing your account, verifying your identity
• Communications: sending you service-related notifications, responding to enquiries, and (with consent) marketing communications
• Personalisation: tailoring property recommendations, search results, and content to your preferences
• Analytics and improvement: understanding how our Services are used, identifying issues, and improving the user experience
• Legal compliance: fulfilling regulatory obligations, responding to legal requests, preventing fraud and abuse
• Payment processing: facilitating transactions through our third-party payment processor (Stripe)
• Safety and security: detecting and preventing fraud, abuse, and security threats

5. Consent

We obtain your consent before collecting, using, or disclosing your personal data, except where permitted under the PDPA (e.g., for legitimate business purposes, legal obligations, or vital interests).

You may withdraw consent at any time by contacting our DPO at dpo@homejourney.sg. Please note that withdrawing consent for certain data processing may affect our ability to provide some Services to you.

For marketing communications, you can opt out at any time using the unsubscribe link in our emails or by updating your preferences in your account settings.

6. Disclosure to Third Parties

We do not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary:

• Service providers: Supabase (database hosting, Singapore region), Vercel (web hosting), Stripe (payment processing), PostHog (privacy-focused analytics), Sentry (error monitoring), Airalo (eSIM fulfilment)
• Property agents: when you initiate contact with an agent through our platform, we share your contact details with that agent
• Business partners: service providers in our home services marketplace, only when you book a service
• Legal authorities: when required by law, regulation, or legal process, or to protect the rights, property, or safety of Homejourney, our users, or the public
• Corporate transactions: in connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Active account data: retained while your account is open and for 30 days after account deletion
• Transaction records: retained for 7 years as required by Singapore tax and accounting regulations
• Communications: retained for 2 years for service improvement and dispute resolution
• Analytics data: anonymised and aggregated data may be retained indefinitely for product improvement
• Legal hold data: retained as long as required by applicable legal proceedings

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• TLS 1.3 encryption for all data in transit (256-bit)
• AES-256 encryption for all data at rest
• Row-level security (RLS) policies ensuring users can only access their own data
• Regular security audits and vulnerability assessments
• Strict access controls with principle of least privilege
• Automated threat detection and rate limiting
• Incident response plan with 3-day breach notification commitment per PDPA requirements
• Primary data storage in Singapore (ap-southeast-1 region)

9. Your Rights Under PDPA

Under the PDPA, you have the following rights:

• Access: request a copy of your personal data that we hold
• Correction: request correction of inaccurate or incomplete personal data
• Withdrawal of consent: withdraw consent for any specific purpose of data processing
• Data portability: request a copy of your data in a commonly used machine-readable format
• Complaint: lodge a complaint with the Personal Data Protection Commission (PDPC) if you believe we have mishandled your data

10. Cookies & Analytics

We use cookies and similar technologies for essential functionality and analytics:

• Essential cookies: session management, authentication, security (cannot be disabled)
• Analytics: PostHog (privacy-focused, self-hosted option, respects Do Not Track)
• Performance monitoring: Vercel Analytics (anonymised web vitals)
• Error tracking: Sentry (captures technical errors, not personal browsing data)

11. Children

Our Services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly.

12. International Transfers

Your personal data is primarily stored in Singapore. Some of our service providers may process data in other jurisdictions (e.g., Vercel edge network, Stripe payment processing). In such cases, we ensure that adequate data protection measures are in place, including contractual obligations that provide a level of protection comparable to the PDPA.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting a notice on our website or sending you a notification. The "Last updated" date at the top of this page indicates when this policy was last revised.

Your continued use of our Services after any changes constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Homejourney Pte. Ltd. Data Protection Officer Email: dpo@homejourney.sg Phone: +65 8851 6851 Website: homejourney.sg

You may also file a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg if you believe your personal data has been mishandled.