隐私政策
本政策说明 PropertyWealth（sg-property.ai，以下称「本服务」）收集哪些个人数据、如何使用、保留多久，以及你可以行使哪些权利。本政策依据新加坡《个人数据保护法》（Personal Data Protection Act 2012, PDPA）制定。
1. 我们收集哪些数据
取决于你以哪种方式使用本服务。
1.1 未登录访客（网页）
- 对话内容 —— 你向 AI 助手输入的问题及助手的回复。
- 浏览器随机标识 —— 一串由你的浏览器本地生成的随机编号，仅用于在你刷新页面后接续同一段对话。它不包含任何身份信息，也不与你的真实身份关联。
IP 地址 —— 我们会记录发起对话时的 IP 地址与其所属国家/地区，仅用于两件事：识别同一位访客的多次来访（清除浏览器数据、使用无痕模式或更换浏览器都会产生新的随机标识，IP 让我们知道这些其实是同一个人），以及发现与阻止滥用。IP 与对话一同保存，90 天后随对话一起自动删除。我们不记录浏览器 User-Agent。
1.2 注册用户（网页）
- 电子邮箱 —— 作为账号名。
- 密码 —— 仅以加盐哈希形式存储，我们无法还原你的原始密码。
- 对话历史 —— 与账号关联，便于你随时回看。
1.3 WhatsApp 用户
如果你主动通过 WhatsApp 向我们发送消息，我们会收到：
- 你的 WhatsApp 号码 —— 由 WhatsApp 提供，我们用它把答案回复给你本人。
- 你发送的消息内容及我们的回复 —— 用于理解你的问题并在同一段对话中保持上下文。
我们不会主动向未联系过我们的号码发送消息，也不会把你的号码用于与你所提问题无关的用途。这些对话会作为往来记录长期保留（见第 3 节），你可随时要求删除。
1.4 主动留下的联系方式
如果你在对话中主动填写留资表单，我们会收到你填写的手机号，以及你选填的称呼、方便联系的时间和备注，并附带该次咨询的背景摘要（例如「Stirling Residences 2 房，考虑出售」）。
这些信息仅用于就本次咨询与你联系，不会用于其他营销、不会出售、也不会提供给第三方。你可以随时来信要求删除，我们会连同该条记录一并移除。不填写表单不影响你使用本服务的任何功能。
1.5 付费会员
付款由 Stripe 处理。我们不接触、不存储你的银行卡号或任何支付凭证。我们仅保存 Stripe 返回的客户编号、订阅状态与当期结束日期，用于判断你的会员权益是否有效。
2. 我们如何使用这些数据
- 理解并回答你提出的房产问题；
- 在同一段对话中保持上下文，避免你重复描述；
- 为注册用户保存并展示历史对话；
- 判断会员权益、处理订阅；
- 以汇总统计方式了解服务的使用情况（例如每日提问总数），用于改进产品；
- 发现并阻止滥用行为（例如自动化脚本、恶意刷量）。
我们不会出售你的个人数据，也不会将其用于我们服务之外的定向广告。
3. 数据存放在哪里、保留多久
我们的服务器与数据库位于新加坡。保留期限如下：
| 数据类型 | 保留期限 |
|---|---|
| 未登录访客的对话 | 自最后活动起 90 天，之后自动删除 |
| WhatsApp 对话 | 长期保留，作为客户往来记录；你可随时要求删除 |
| 你主动留下的联系方式 | 保留至跟进结束或你要求删除 |
| 注册用户的账号与对话 | 保留至你删除账号或提出删除请求 |
| 订阅与付款状态 | 依会计与税务要求保留，通常为 5 年 |
4. 我们与谁共享数据
我们仅在为你提供服务所必需的范围内，与以下类别的服务商共享必要数据；他们均受合同约束，只能按我们的指示处理数据：
| 服务商类别 | 共享内容 | 目的 |
|---|---|---|
| 第三方 AI 模型服务商 | 你的问题文本及必要的对话上下文 | 生成回答 |
| Meta Platforms（WhatsApp） | 你的 WhatsApp 号码与消息内容 | 在 WhatsApp 上收发消息 |
| Stripe | 你的邮箱与订阅信息 | 处理订阅付款 |
| 匿名的广告转化事件 | 衡量广告效果 | |
| 网络与基础设施服务商 | 技术性请求数据 | 保障网站可用与安全 |
除上述情形外，我们仅在法律要求或保护本服务及用户安全所必需时披露数据。
5. Cookie 与本地存储
- 必要的本地存储 —— 保存你的登录令牌、界面语言偏好与访客标识。没有这些，登录与语言切换无法工作。
- 广告衡量 —— 我们使用 Google Ads 代码衡量广告转化。你可以通过浏览器设置或 Google 广告设置限制此类跟踪。
6. 你的权利
依据 PDPA，你可以随时：
- 查阅我们持有的关于你的个人数据；
- 更正不准确的数据；
- 要求删除你的对话记录或整个账号；
- 撤回同意（撤回后我们将无法继续提供需要该数据的功能）。
发送邮件至 [email protected] 即可提出请求。为保护你的数据，我们可能需要先验证你的身份。我们通常在 30 天内答复。
7. 安全措施
- 全站强制 HTTPS 加密传输；
- 密码仅以加盐哈希存储；
- 数据库不对公网开放，仅内部服务可访问；
- 每日自动备份，并定期演练恢复。
没有任何系统能保证绝对安全，但我们会持续采取合理的技术与管理措施保护你的数据。
8. 儿童
本服务面向成年人。我们不会有意收集 13 岁以下儿童的个人数据。若你认为我们无意中收集了此类数据，请联系我们删除。
9. 服务性质的重要说明
10. 政策变更
本政策如有修改，我们会更新本页顶部的「最后更新」日期。涉及重大变更时，我们会在服务内显著提示。
11. 联系我们
隐私相关的任何问题或请求，请联系：[email protected]
Privacy Policy
This policy explains what personal data PropertyWealth (sg-property.ai, the "Service") collects, how we use it, how long we keep it, and your rights. It is written in line with Singapore's Personal Data Protection Act 2012 (PDPA).
1. What we collect
Visitors who are not signed in (web): the questions you type and the assistant's replies, plus a random identifier generated locally by your browser so a conversation survives a page refresh. We also record the IP address the conversation came from and the country it maps to, used only to recognise repeat visits by the same person (clearing browser data, using private mode or switching browsers all create a new random identifier) and to detect and prevent abuse. The IP is stored with the conversation and deleted automatically after 90 days along with it. We do not log User-Agent strings.
Registered users (web): your email address (used as the account name), your password stored only as a salted hash, and your conversation history.
WhatsApp users: if you choose to message us on WhatsApp, we receive your WhatsApp number and the content of your messages. We use them only to answer your question and keep context within that conversation. We do not message numbers that have not contacted us first. These conversations are kept as a record of our correspondence with you, so that we can pick up where we left off if you contact us again; you may ask us to delete them — including your number — at any time.
Contact details you choose to give us: if you voluntarily fill in the contact form in the chat, we receive your phone number, plus any name, preferred contact time and notes you choose to add, together with a short summary of what you were asking about. We use these only to get back to you about that enquiry — not for other marketing, never sold, never passed to third parties. You may ask us to delete them at any time. Declining the form does not restrict any feature of the Service.
Paying members: payments are handled by Stripe. We never see or store your card details. We keep only the Stripe customer reference, subscription status and current period end.
2. How we use it
To answer your property questions, keep context within a conversation, show registered users their history, determine membership entitlements, understand usage in aggregate, and prevent abuse. We do not sell your personal data and do not use it for targeted advertising outside our own service.
3. Where it is stored and for how long
Our servers and database are located in Singapore.
| Data | Retention |
|---|---|
| Conversations of visitors who are not signed in | 90 days after last activity, then deleted automatically |
| WhatsApp conversations | Retained as a record of our correspondence with you; you may ask us to delete them at any time |
| Contact details you volunteered | Until the follow-up is complete or you ask us to delete them |
| Registered accounts and their history | Until you delete the account or ask us to delete it |
| Subscription and payment records | As required by accounting and tax rules, typically 5 years |
4. Who we share it with
Only as needed to provide the Service, and only with providers bound to process data on our instructions: third-party AI model providers (your question text and necessary context, to generate an answer), Meta Platforms / WhatsApp (your number and messages, to send and receive on WhatsApp), Stripe (email and subscription details, to process payment), Google (anonymous ad-conversion events, to measure advertising), and network/infrastructure providers. Otherwise we disclose data only where required by law or necessary to protect the Service and its users.
5. Cookies and local storage
We use local storage for your login token, language preference and visitor identifier — these are necessary for sign-in and language switching to work. We also use Google Ads tags to measure ad conversions; you can limit this through your browser settings or Google Ads Settings.
6. Your rights
Under the PDPA you may request access to, correction of, or deletion of your personal data, and you may withdraw consent at any time. Email [email protected]. We may need to verify your identity first, and we normally respond within 30 days.
7. Security
HTTPS is enforced site-wide, passwords are stored only as salted hashes, the database is not exposed to the public internet, and backups run daily with periodic restore drills. No system can be guaranteed absolutely secure, but we take reasonable technical and organisational measures to protect your data.
8. Children
The Service is intended for adults. We do not knowingly collect personal data from children under 13. If you believe we have, please contact us and we will delete it.
9. Important note on the nature of the Service
10. Changes
If we change this policy we will update the "last updated" date above, and we will notify you prominently within the Service for material changes.