Privacy Policy

Straits Intelligence Pte. Ltd. (operating as Propkaki; "we", "us", or "our") is committed to protecting the personal data of all individuals who interact with our platform. This Privacy Policy explains how we collect, use, disclose, and protect personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA").

This Policy applies to two categories of individuals:

• RES Users — CEA-registered Real Estate Salespersons who register for and use the Propkaki platform; and
• Property Enquirers — members of the public who submit enquiries through public listing pages hosted at propkaki.sg (/l/[listing-slug]).

By using our Services or submitting an enquiry through a listing page, you consent to the collection, use, and disclosure of your personal data as described in this Policy.

Straits Intelligence Pte. Ltd.
1 Coleman Street, The Adelphi, #B1-35, Singapore 179803
UEN: 202615220E
Data Protection Officer: dpo@propkaki.sg

We have appointed a Data Protection Officer ("DPO") as required under the PDPA. All data protection queries, access requests, correction requests, and withdrawal of consent notices should be directed to the DPO at the email address above.

When you register for and use the platform, we collect:

• Registration data: Full name, Singapore WhatsApp number, CEA registration number, estate agent licence number (CEA registry), and agency name.
• Account data: Password (stored as a bcrypt hash — never in plaintext), subscription tier, billing history, and account status.
• Listing data: Property details, photographs, descriptions, and other content you submit for publication on listing pages.
• CRM data: Lead records, pipeline stages, AI draft history, notes, and activity logs associated with your listings and leads.
• Usage data: IP address, browser type, device type, pages accessed, timestamps, and error logs — collected automatically for security monitoring and service improvement.
• Payment data: Payment is processed by Stripe, Inc. We receive only a tokenised reference and last four digits of your payment method. Full card or bank account details are never stored by us.

When you submit an enquiry through a public listing page, we collect the following on behalf of the listing agent:

• Full name;
• WhatsApp number;
• Email address (optional);
• Budget range (optional);
• Enquiry message;
• PDPA consent confirmation and the exact consent wording shown to you at submission;
• Submission timestamp and IP address.

This data is collected solely for the purpose of facilitating contact between you and the listing agent regarding the specific property you enquired about.

For RES Users, we use your personal data to:

• Verify your CEA registration status at sign-up and on a daily basis;
• Create and manage your account and subscription;
• Deliver one-time passwords (OTPs) via WhatsApp for authentication;
• Process subscription payments through Stripe;
• Provide AI-assisted features (see Section 7 on cross-border transfers);
• Send account-related notifications via WhatsApp, including CEA expiry warnings and billing notifications;
• Detect and prevent fraud, abuse, and security incidents;
• Comply with applicable Singapore laws and regulatory obligations.

For Property Enquirers, we use your personal data to:

• Deliver your enquiry to the relevant RES agent;
• Maintain a record of the enquiry within the agent's CRM for the purpose of follow-up;
• Comply with PDPA record-keeping requirements for consent.

We will not use your personal data for any purpose other than those described in this Policy without first obtaining your consent, except where otherwise permitted by law.

We do not sell your personal data. We may disclose your personal data to:

• Stripe, Inc. — for payment processing. Your payment data is subject to Stripe's Privacy Policy.
• Google LLC — for AI content generation via Google Gemini (our primary AI provider). Your inputs (including listing details and lead context) may be processed by Google's systems. See Section 7 for cross-border transfer details.
• Anthropic PBC — for AI content generation via Claude, which is an optional secondary AI provider that may not be active at all times. Data is only transmitted to Anthropic if the platform is configured to use Claude. See Section 7.
• Meta Platforms, Inc. (WhatsApp) — for delivery of OTP authentication messages to your WhatsApp number.
• Council for Estate Agencies (CEA) and data.gov.sg — we query the official CEA public registry (via data.gov.sg) to verify and monitor RES registration status. No personal data is transmitted to these authorities; we only receive data from them.
• Regulatory authorities and law enforcement — where required by Singapore law or a valid court order.
• Successors in interest — in the event of a merger, acquisition, or sale of all or substantially all of our assets, provided that the acquiring entity is bound by equivalent data protection obligations.

Our AI features transmit input data (which may include property details, lead information, and agent context) to AI service providers whose servers are located outside Singapore:

• Google Gemini (primary AI provider) — processed on Google infrastructure (primarily United States). This transfer occurs whenever AI drafting features are used.
• Anthropic Claude (optional secondary AI provider) — processed on Anthropic infrastructure (United States). This transfer only occurs if the platform is configured to use Claude as an AI provider, which may not be active at all times.

By using the AI drafting and content generation features, you consent to this cross-border transfer of data. We take all steps reasonably necessary to ensure that transferred data is handled securely and in accordance with the PDPA, including relying on each provider's data processing agreements and their compliance with international data protection standards (such as GDPR and SOC 2 Type II).

If you do not wish your data to be processed outside Singapore, you should refrain from using AI-powered features. Core CRM and listing features do not involve cross-border AI processing.

By registering for an account, you consent to receive WhatsApp messages from us on your registered Singapore WhatsApp number for the following purposes:

• One-time passwords (OTPs) for account authentication;
• CEA registration expiry warnings (30, 14, and 7 days before expiry);
• Account status notifications (including suspension notices);
• Billing notifications (subscription renewal, payment failure).

These communications are necessary for the operation of your account and cannot be individually opted out of without closing your account. Authentication OTPs are non-optional as they are the sole means of account verification.

By expressly consenting to receive WhatsApp communications from us at sign-up, you consent to receive such messages even if your number is registered on Singapore's Do Not Call (DNC) Registry. This consent covers only the categories of messages described in Section 8 above.

Property Enquirers who submit an enquiry through a listing page consent to being contacted by the listing agent via WhatsApp regarding their enquiry. This consent is specific to the enquiry and does not constitute general marketing consent.

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by applicable law:

• RES User account data: Retained for the duration of your account and for a period of [7 years — to be confirmed with legal counsel] thereafter, in compliance with Singapore's record-keeping requirements under the Income Tax Act and PDPA.
• Property Enquirer data (leads): Retained in the CRM until the RES deletes the lead record, or for a maximum of [24 months — to be confirmed] of inactivity, after which it will be automatically archived or purged.
• Billing records: Retained for 7 years from the date of the transaction in accordance with Singapore's Accounting and Corporate Regulatory Authority (ACRA) requirements.
• Audit and security logs: Retained for [12 months — to be confirmed].

When data is no longer required, it is securely deleted or anonymised.

We implement commercially reasonable physical, administrative, and technical safeguards to protect your personal data, including:

• HTTPS encryption for all data in transit;
• Passwords stored as bcrypt hashes (never in plaintext);
• JWT-based authentication with short-lived access tokens;
• Access to personal data restricted to authorised personnel only;
• Regular security reviews and monitoring.

Notwithstanding the above, no method of electronic storage or internet transmission is 100% secure. We cannot guarantee absolute security of your data.

In the event of a data breach that is notifiable under the PDPA, we will notify the Personal Data Protection Commission (PDPC) and affected individuals within the timeframes prescribed by law.

Under the PDPA, you have the right to:

• Access — request confirmation of whether we hold your personal data and obtain a copy of such data;
• Correction — request correction of any inaccurate or incomplete personal data we hold about you;
• Withdrawal of consent — withdraw your consent to the collection, use, or disclosure of your personal data at any time, subject to legal and contractual restrictions. Withdrawal of consent may result in us being unable to continue providing the Services to you;
• Data portability — where applicable under the PDPA, request transmission of your personal data to another organisation.

To exercise any of these rights, please contact our DPO at dpo@propkaki.sg. We will respond to all requests within 30 days. Complex requests may require up to 60 days, in which case we will notify you of the extended timeline.

We may charge a reasonable fee for access requests that are manifestly unfounded or excessive, as permitted by the PDPA. We will notify you of any applicable fee before processing your request.

We use essential cookies to maintain your authenticated session. We do not currently use third-party advertising or analytics cookies on the core application.

Public listing pages (/l/[slug]) do not use advertising cookies. View counts for listings are tracked server-side without cookies.

The Services are not directed to individuals under the age of 21. We do not knowingly collect personal data from anyone under 21. If you believe we have inadvertently collected data from a minor, please contact our DPO immediately.

We may update this Privacy Policy from time to time to reflect changes in our data practices, the Services, or applicable law. We will notify you of material changes via WhatsApp message to your registered number or by posting a prominent notice within the application.

Your continued use of the Services after the effective date of an updated Policy constitutes your acceptance of the changes.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection Officer:

Data Protection Officer
Straits Intelligence Pte. Ltd.
1 Coleman Street, The Adelphi, #B1-35, Singapore 179803
Email: dpo@propkaki.sg

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.