PropertyVault
Private Wealth

Privacy Policy

Last updated: 18 July 2026

1. Introduction & Data Controller

This Privacy Policy describes how Veridico Pte Ltd (UEN: 202505745R; registered address: 21 Tan Quee Lan Street, #02-04 Heritage Place, Singapore 188108) collects, uses, discloses, transfers, and protects your personal data. PropertyVault is the product brand operated by Veridico Pte Ltd (“PropertyVault”, “we”, “us”).

This Policy is issued in compliance with the Personal Data Protection Act 2012 (PDPA) of Singapore and covers all personal data processed through the PropertyVault web application and its associated APIs.

2. Data Protection Officer

We have appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with the PDPA. You may contact the DPO on any data-protection matter, including access, correction, and withdrawal-of-consent requests, at privacy@propvault.biz. We aim to acknowledge requests within 3 business days and to substantively respond within 30 days, notifying you if more time is required.

3. Scope & Consent

This Policy applies to all users of the PropertyVault service. By creating an account and accepting this Policy at sign-up, you consent to the collection, use, disclosure, and overseas transfer of your personal data as described herein, including the AI-assisted document processing and cross-border processing described in Sections 6 and 9. We record the date and time at which you accept this Policy. You may withdraw consent at any time by contacting our DPO, though doing so may prevent us from continuing to provide the service.

4. What Personal Data We Collect

We collect the following categories of personal data:

  • Account data: email address, full name, optional company name, account type (Owner or Manager), and your password — stored only as a salted hash, never in plain text. We record the timestamp at which you accepted these terms and this Policy.
  • Sign-in data: if you choose to sign in with Google, we receive your Google account email and basic profile information (name) to create and authenticate your account. We do not receive your Google password.
  • Billing data: if you subscribe to a paid plan, our payment processor (Stripe) collects and holds your payment-card and billing details. We never receive or store full card numbers. We store only a customer/subscription reference, your plan, billing interval, and subscription status.
  • Property & portfolio data: addresses, ownership names and shares, valuations, mortgage, tax and cashflow figures, and related financial information. These records may directly or indirectly identify you.
  • Document & photo data: files and records you add relating to tenancy agreements, loan letters, insurance policies, tax bills, invoices, title documents, and property photos. These may contain third-party personal data such as tenant, agent, or counterparty names, contact details, and (where present in your documents) identification numbers.
  • Client data (Manager accounts): if you use a Manager account, the details of the clients on whose behalf you manage properties, and the properties attributed to them.
  • Usage & audit data: server-side logs (request timestamps, IP addresses, error traces), device/browser information for active-session management, and an in-app audit log of changes to your records. These are used only for operating, securing, and debugging the service — not for product analytics or advertising.

5. Purposes of Collection and Use

We collect and use your personal data for the following purposes:

  • To deliver the PropertyVault property-management service to you;
  • To generate lease-expiry, loan- and rate-lock-maturity, insurance- and document-expiry, maintenance, and tax-deadline alerts;
  • To compute portfolio cashflow, valuation, and financial summaries;
  • To provide AI-assisted extraction of data from documents you choose to upload (see Section 6);
  • To process subscription payments and manage your plan;
  • To send transactional email such as email verification, password resets, and alerts;
  • For security monitoring, fraud prevention, and abuse prevention.

These purposes are notified to you at the point of collection in compliance with the PDPA Notification and Consent obligations. Where we rely on an exception to consent (such as the Legitimate Interests or Business Improvement exceptions), we do so only within the limits the PDPA permits.

6. AI-Assisted Document Processing

PropertyVault offers an optional feature that uses a third-party artificial-intelligence model to read documents you upload and extract structured data (for example, lease dates, rent amounts, loan terms, or valuations) so you do not have to enter them by hand.

  • It runs only on documents you choose to submit to the feature. If you do not use it, your documents are not sent to any AI service.
  • The document contents are sent, over an encrypted connection, to our AI processing provider (Anthropic’s Claude models, accessed via Amazon Web Services Bedrock) solely to perform the extraction and return the result to you.
  • Your data is not used to train any AI model. The provider processes the content transiently to produce the extraction and does not retain it for its own purposes.
  • AI output can be inaccurate. The feature is an assistant, not a substitute for your review. You are shown the extracted data to confirm or edit before it is saved to your records, and you remain responsible for the accuracy of what you save.
  • This processing may occur outside Singapore (see Section 9).

7. National Identification Numbers (NRIC / FIN)

PropertyVault does not requireyou to provide, and does not use, any NRIC, FIN, or other national identification number to create, verify, or authenticate your account. We ask that you avoid uploading documents containing full identification numbers where they are not necessary for your own records. Consistent with the PDPC’s Advisory Guidelines on NRIC numbers, we do not use identification numbers as a login credential or account identifier, and we apply data-minimisation and access controls to any such data present in documents you upload. If you would like an identification number redacted from a stored document, contact our DPO.

8. Third Parties We Share Data With

We disclose personal data only to the following service providers, acting as our data intermediaries, and only for the purposes stated. We do not sell personal data, share it with advertisers, or disclose it to data brokers, and PropertyVault carries no third-party analytics or advertising trackers.

  • Amazon Web Services (AWS) — cloud hosting, compute, database, file storage, and transactional email (Amazon SES). Your database records and uploaded files are hosted in the AWS Singapore region (ap-southeast-1).
  • Anthropic, via AWS Bedrock — the AI model provider that performs the optional document-extraction feature described in Section 6, on documents you submit to it.
  • Stripe — payment processing for paid subscriptions. Stripe collects your payment details directly and processes them as an independent controller under its own privacy policy.
  • Google — Google Sign-In (if you use it to authenticate) and, where enabled, Google Maps Platform to look up and geocode a property address you enter.

Each of these providers is engaged under a data-processing agreement that requires it to protect personal data to a standard comparable to the PDPA.

9. International Data Transfers

Your database records, uploaded documents, and photos are stored in the AWS Singapore region (ap-southeast-1). However, some processing necessarily involves transferring personal data outside Singapore:

  • AI document extraction(Section 6) is performed by Anthropic’s models via AWS Bedrock and may be processed in AWS regions outside Singapore;
  • Subscription billing is processed by Stripe, which operates from the United States;
  • Google Sign-In and address geocoding are processed by Google, which operates globally.

Where we transfer personal data outside Singapore, we do so in compliance with the PDPA Transfer Limitation Obligation. We rely on data-processing agreements with each provider that bind the recipient to legally enforceable obligations to protect the transferred data to a standard comparable to the PDPA. By accepting this Policy you also consent to these transfers. On request to our DPO we can provide a reasonable summary of the safeguards applied.

10. Workspaces & Shared Access

If you invite other people into your workspace, or accept an invitation into another user’s workspace, the members of that workspace may view and (depending on their role) edit the property, document, and financial data within it. If you use a Manager account, you are responsible for the personal data of the clients and properties you add. You must ensure you are authorised to process that data and to grant access to any workspace members you invite. See also the corresponding provisions of our Terms of Service.

11. Data Retention

  • Active accounts: personal data is retained for as long as your account remains active.
  • Deleted accounts: upon a verified account-deletion request, all account data — properties, documents, photos, expenses, tenancies, loans, valuations, transactions, and alerts — is permanently deleted, and your login is removed.
  • Operational backups: database backups are retained on a rolling basis in the Singapore region. Deleted user data ages out of backups within 30 days of the hard-delete completing.
  • AI extraction: document contents sent for AI extraction are processed transiently and are not retained by the AI provider for its own purposes.

12. Your Rights Under the PDPA

As a data subject under the PDPA, you have the following rights:

  • Right of Access: request a copy of the personal data we hold about you. In-app: your records are visible at /dashboard and /properties.
  • Right of Correction: correct inaccurate personal data. In-app: use the Edit Property, Edit Loan, Edit Tenancy, and Edit Valuation forms directly.
  • Right to Withdraw Consent and Right to Erasure (Account Deletion): withdraw consent or request deletion of your account and all associated data by contacting our DPO.

To exercise any right not available through the in-app interface, contact our Data Protection Officer at privacy@propvault.biz.

13. Security Measures

PropertyVault implements the following technical and organisational measures to protect your personal data:

  • TLS 1.2+ encryption for all data in transit;
  • Encryption at rest for the database and stored files;
  • Application-level access controls that scope every record to its owner or authorised workspace, and a private object store served only through authenticated proxies;
  • Passwords stored only as salted hashes; optional two-factor authentication;
  • Email-verification and password-reset links stored only as one-way hashes, never as raw tokens;
  • Revocable active-session management and an in-app audit log;
  • Principle of least privilege for infrastructure and administrative access.

14. Data Breach Notification

In the event of a data breach that is likely to result in significant harm to affected individuals, or that is of significant scale, we will notify the Personal Data Protection Commission (PDPC) as soon as practicable and in any case within 3 calendar days of assessing the breach to be notifiable, and we will notify affected individuals where the PDPA requires, in accordance with the PDPA’s Data Breach Notification Obligation.

15. Children

PropertyVault is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us at privacy@propvault.biz and we will delete it promptly.

16. Changes to This Policy

Material changes to this Policy (changes that affect how we collect, use, transfer, or share your personal data) will be notified to you by email to your registered address at least 14 days before they take effect. Non-material changes (corrections, clarifications, formatting) will update the “Last updated” date silently. Your continued use of PropertyVault after a material change takes effect constitutes acceptance of the revised Policy.

17. Contact Us

Data protection enquiries: privacy@propvault.biz

General enquiries: hello@propvault.biz

Postal address: Veridico Pte Ltd, 21 Tan Quee Lan Street, #02-04 Heritage Place, Singapore 188108