Privacy Policy

Contents

Part A — All Users: covers everyone who visits DoubleHuat, including the free 4D/TOTO research tools and general property information.
Part B — CEA Agents: additional terms that apply to registered agents using DoubleHuat Pro (Client Notebook, CMA reports, calculators, branding).

A1. Who We Are

DoubleHuat is operated by Kri8tion Technology, a business registered in Singapore. Our registered business address is available upon request via support@doublehuat.com.

A2. Personal Data We Collect

For general users, we collect only the data needed to run the service:

1. Registration data: name, email address, and password (stored as a one-way cryptographic hash, never in plain text);
2. Usage data: 4D or TOTO numbers you save to your tracker, and general session activity such as pages visited;
3. Technical data: IP address, browser type, and device type — used for security, analytics, and abuse prevention.

We do not collect payment information from general users. The public DoubleHuat site is free.

A3. How We Use Your Data

We use your data to:

1. Provide the service (login, saved trackers, personalised research);
2. Send account-related emails such as verification codes and password resets;
3. Detect and prevent fraud, abuse, and technical problems;
4. Comply with legal obligations under Singapore law.

We do not use your data for direct marketing without your consent. We do not sell your personal data.

A4. Cookies and Advertising

We use session cookies to keep you logged in. On the free public site we may display advertisements through Google AdSense and similar ad networks, which may set their own cookies to show relevant ads based on your browsing activity. You can opt out of personalised advertising at google.com/settings/ads. We do not control the cookies placed by advertising partners. The paid DoubleHuat Pro platform for CEA agents does not display third-party advertisements.

A5. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We disclose data only:

1. To service providers acting on our behalf (see subprocessors listed at A6 below);
2. To advertising partners in the form of anonymised, aggregated data only;
3. Where required by Singapore law, a court order, or a valid regulatory request.

A6. Subprocessors and Data Sources

We use the following categories of third-party services to run the platform:

1. Hosting — DigitalOcean (server infrastructure);
2. Email delivery — Resend (for verification codes, password resets, and transactional emails);
3. Payment processing — Stripe (for CEA agent subscription payments, including card and PayNow via Stripe). Stripe processes your payment data on our behalf under its own terms and privacy policy;
4. Public data sources — HDB, URA, LTA, data.gov.sg, IRAS, Singapore Pools (lottery historical results), and OneMap for property, transaction, transport, and location data. These are read-only public sources; no personal data is sent to them;
5. Advertising (free site only) — Google AdSense and similar ad networks.

This list may change. We will update this policy when we add or remove significant subprocessors.

A7. Data Location and International Transfers

Our primary servers are located in Singapore. Some subprocessors (such as email delivery and advertising networks) may process data outside Singapore. When personal data is transferred outside Singapore, we take reasonable steps to ensure the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA.

A8. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal data within a reasonable period, except where we are required to retain it for legal, accounting, or fraud-prevention purposes. Access logs and technical data may be retained for up to 12 months for security and diagnostic purposes.

A9. Data Security

We implement reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. These include encrypted transport (HTTPS), one-way password hashing, session security, rate limiting, and regular backups. However, no internet service can guarantee absolute security. You are responsible for keeping your account password confidential.

A10. Your PDPA Rights

Under the PDPA, you have the right to:

1. Request access to your personal data we hold;
2. Request correction of inaccurate data;
3. Withdraw consent for the collection, use, or disclosure of your personal data (subject to legal or contractual obligations);
4. Request deletion of your account.

To exercise any of these rights, contact support@doublehuat.com. We aim to respond within 10 business days. We may need to verify your identity before actioning a request.

A11. Age Restriction

The Service is intended for users aged 18 or older. If we become aware that a registered user is under 18, we will delete the account and associated data.

B1. Agent Data We Collect

In addition to Part A, when you register as an Agent we collect:

1. Your CEA registration number and agency affiliation;
2. Your mobile number and (optionally) WhatsApp link for client-facing branded materials;
3. Your profile photo and agency logo (if you choose to upload them);
4. Your acceptance of the DoubleHuat Agent Subscription Agreement, recorded with a timestamp and agreement version;
5. Sign-in records — the date and time of each sign-in, the IP address used, and a one-way fingerprint of your browser or device.

We keep sign-in records for up to 180 days and use them only to secure your account and to detect the sharing of login credentials prohibited under clause 6 of the Agent Subscription Agreement. We store a one-way fingerprint of your browser or device, not the underlying browser or device details themselves. These records are deleted automatically once the retention period has passed.

B2. Your Client Data — We Are a Data Intermediary

When you enter information about your prospects and clients into the Client Notebook, save calculations to a client, or attach valuations to a client:

1. You are the data controller (the "organisation" under the PDPA) for that client data. You are responsible for obtaining any necessary consents from your clients before entering their personal data into our platform, and for informing them of the purposes of collection and use;
2. Kri8tion is a data intermediary. We host and process that client data on your behalf and in accordance with your instructions, solely to provide the Service. We do not use your client data for our own purposes, do not disclose it to any third party except our subprocessors listed at A6, and do not use it for advertising, analytics, or profiling;
3. We will respond to your clients' PDPA requests (access, correction, withdrawal of consent) through you, since you are the data controller. We will provide reasonable technical assistance;
4. If you terminate your account or your subscription lapses, we will retain your client data for a reasonable period before deletion, in case you need to export it. Before termination, you may request an export of your Client Notebook via support@doublehuat.com.

B3. Payment Records

When you subscribe to a paid plan, we collect and retain:

1. Your plan type, subscription start and end dates, and the amount paid;
2. The payment reference issued by our payment processor to identify your transaction;
3. Any notes or supporting messages you send us regarding your subscription.

Payments for DoubleHuat Pro are processed by Stripe, our third-party payment processor, which supports card payments and PayNow. Your card or bank details are entered directly with Stripe and are handled under Stripe's own terms and privacy policy. We do not store your full card number, CVC, or bank account credentials on our own systems; we retain only the transaction metadata described above (plan, dates, amount, and Stripe's payment reference). Because Stripe operates internationally, some payment data may be processed outside Singapore, subject to the safeguards described in A7.

We retain payment and transaction records for as long as required by Singapore law — currently up to 7 years — for accounting, tax, and audit purposes (including under the Income Tax Act 1947 and the Goods and Services Tax Act). This retention period applies even after you delete your account, and such records are kept solely for legal compliance.

B4. CEA and Regulatory Data Requests

If the Council for Estate Agencies (CEA), the Personal Data Protection Commission (PDPC), the Inland Revenue Authority of Singapore (IRAS), or another Singapore regulator makes a lawful request for data relating to you or your client records, we will respond in accordance with our legal obligations. Where legally permitted, we will notify you of the request.

B5. Communications From Us

As an Agent subscriber, you will receive transactional communications from us regarding your account, subscription, and material changes to the Service. You may also receive occasional service updates and feature announcements. You may opt out of non-essential communications at any time by contacting support@doublehuat.com. We do not send unsolicited direct marketing to your clients.

G1. Data Protection Officer

Our designated Data Protection Officer (DPO) can be contacted at support@doublehuat.com. All PDPA-related queries and requests should be addressed there.

G2. Changes to This Policy

We may update this Privacy Policy from time to time. Where a change is material — such as introducing a new category of data collection, a new subprocessor, or a change in how data is used — we will notify affected users by email, or by prominent notice within the Service, at least 30 days before the change takes effect. Continued use of the Service after the change takes effect constitutes acceptance of the updated policy.

G3. Contact

For any question about this Privacy Policy or your personal data, contact support@doublehuat.com. We respond within 5 business days. If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.