Privacy Policy

Draft — not legal advice. This is placeholder text pending review by a qualified lawyer before it governs real customer data. Do not treat it as final or PDPA-compliant as written.

This policy describes how Aware Sustainability collects, uses, and protects personal data, in line with Singapore's Personal Data Protection Act (PDPA). It applies to visitors, account holders, and people whose data is entered into the Service by an account holder (e.g. teammates, or WhatsApp users linked to a company account).

1. What we collect

Account data: name, email address, hashed password (or Google account identifier if you sign in with Google).
Company profile data: company name, UEN, address, industry, size, and similar business details you provide during onboarding.
Emissions and activity data you or your team enter, and documents/photos you upload as supporting evidence (utility bills, receipts, etc.).
Materiality survey responses from stakeholders you invite, submitted via a tokenized link.
Contact form submissions (name, company, email, phone, message).
Basic technical data (IP address, browser) collected automatically for security and debugging.

2. Why we collect it

To provide the Service you sign up for: calculating emissions, running your materiality assessment, drafting your sustainability report, and (once available) handling billing and WhatsApp-based data intake. We don't sell personal data.

3. Who we share it with

We use the following processors to run the Service:

Anthropic — AI processing (bill/document extraction, materiality and report drafting assistance).
Resend — transactional email (invites, verification links).
Google — optional sign-in via Google OAuth.
Render — application hosting and database.
Stripe (once billing is live) — payment processing; we do not store your card details ourselves.
Meta (once WhatsApp intake is live) — message delivery via the WhatsApp Business Cloud API.

Some of these processors are based outside Singapore, meaning personal data may be transferred overseas. (Placeholder — the specific PDPA overseas-transfer safeguards need legal review.)

4. How long we keep it

We retain account and emissions data for as long as your account is active, plus a reasonable period after closure for legal/accounting purposes. (Placeholder — exact retention periods to be finalized.)

5. Your rights

Under the PDPA, you can ask to access or correct the personal data we hold about you, and withdraw consent for us to use it (which may limit what parts of the Service you can use). Contact us at [privacy contact email — TBD] to make a request.

6. Security

Passwords are hashed, not stored in plain text. Access to company data is scoped so only members of that company can see it. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.