Legal
Privacy policy
Version 2026-09-01. Written to Singapore's Personal Data Protection Act 2012 and the Do Not Call provisions.
1. Who we are
SingaPR operates singapr.sg from Singapore. Our Data Protection Officer can be reached at privacy@singapr.sg. We are independent of ICA, MOM and the Singapore Government.
2. What we collect
- Assessment answers — pass type, time in Singapore, employment, income band, education, family ties, application history and similar. You can work through the questions without giving any details; your answers stay in your browser until you submit the result form.
- Contact details — name, mobile number and e-mail, which are required to produce and send your personalised result, plus WhatsApp number, preferred language, an English or romanised form of your name where your name is written in another script, what you want help with and how urgently.
- Technical data — a hashed IP address and browser type for security and abuse prevention, first-party attribution cookies (campaign source, click identifiers from advertising platforms, and landing page), an experiment-variant cookie, the language you used the site in, and anonymous product-usage events (no personal data).
We do not collect NRIC/FIN numbers, passport numbers, exact salaries or documents.
3. Purposes
Purpose 1: producing and sending your assessment
We use your answers, name, mobile number and e-mail to produce your personalised result, send you a copy and contact you about it. A notice saying so sits directly above the submit button; submitting the form is how you consent to this purpose.
Purpose 2: connecting you with a suitable immigration consultancy
Referring people to immigration consultancies is how SingaPR is funded, and it is part of what you are asking for when you request an assessment and tell us what you want help with. When you submit the form, we disclose your name, mobile number and e-mail to one suitable Singapore immigration consultancy so that it can contact you about professional assistance with what you asked about — by phone call, text message (including SMS and WhatsApp) and e-mail. The notice beside the submit button says so and links here.
We record the exact wording you were shown, in the language you saw it, its version, the version of this policy, the time, the page and the fact that you submitted. You can tell us to stop at any time using the withdrawal form, and we will stop disclosing your details and ask any consultancy already sent your enquiry to stop contacting you.
If you submitted before September 2026, you were instead offered an optional tick-box for this. If you did not tick it, that decision stands permanently: we do not re-interpret it, and your details are not passed to any consultancy.
Purpose 3: SingaPR updates and offers
Our own updates are separate and entirely optional. We send them only if you tick a box offering them, which is not part of the assessment form, and every message includes a way to stop. Declining them changes nothing about your assessment or the consultancy referral.
Security, duplicate detection and translation
We use hashed identifiers to detect repeated or conflicting submissions and to protect the service from abuse. Records are flagged for human review, never merged automatically. Where you write free text in a language other than English, we keep exactly what you wrote and may prepare an English working translation alongside it for the consultancy; your original is never altered or replaced, and your name is never transliterated for you.
4. Who receives your data
- A participating consultancy — only under Purpose 2, and only the one identified to you. Each consultancy signs a data-sharing agreement requiring PDPA and Do Not Call compliance, no onward sale, and prompt cessation on withdrawal.
- Service providers that host our systems (data storage, e-mail delivery, analytics, bot protection) acting on our instructions.
- Advertising platforms receive only an anonymous conversion signal tied to the click identifier they issued, and only where advertising measurement is switched on; they never receive your name, e-mail or number from us unless you have separately consented to that.
- Authorities where required by law.
Every disclosure to a consultancy is logged with the date, recipient and fields shared, and you can ask us for that record.
5. Withdrawing consent
You can withdraw consultancy sharing, marketing, or both, at any time and separately, using the withdraw consent form, by replying STOP to any SMS or WhatsApp message, by using the unsubscribe link in any e-mail, or by e-mailing the DPO at privacy@singapr.sg. We act within 10 business days for use and disclosure, and within 21 days for telemarketing, and we instruct any consultancy we shared your data with to stop contacting you; that consultancy may keep records needed to close your enquiry or comply with the law. Withdrawing either consent does not affect your assessment result, which you keep.
6. Access and correction
You may ask what personal data we hold about you, how it has been used and to whom it was disclosed in the past year, and ask us to correct it. Write to the DPO; we respond within 30 days.
7. Retention
| Data | Default retention | Why |
|---|---|---|
| Assessment answers abandoned before the result form | Deleted or anonymised after 6 months of inactivity | Never sent to us; no continuing purpose |
| Contact details and profile, not shared with a consultancy | Deleted after 6 months unless you ask us to keep them | No continuing purpose |
| Lead record shared with a consultancy | Identifying data kept 12 months after the last partner update, then anonymised | Disputes, your right to know who received your data, partner accounting |
| Consent and withdrawal ledger | Kept while any reliance continues plus 6 years; withdrawals kept indefinitely as a hashed suppression key | Legal evidence of consent and of your opt-out |
| Export and disclosure logs | 3 years | Access requests, breach enumeration, audits |
| Analytics | Aggregated or anonymised within 13 months | Purpose met |
8. Cookies and analytics
spr_ft,spr_lt— first- and last-touch attribution (campaign, landing page, advertising click identifiers), 90 and 30 days.spr_exp— which version of a page you saw during a design experiment, 1 year.spr_cid— a random identifier used to detect duplicate submissions, 1 year.spr_locale— the language you chose, 1 year.spr_tc— whether you accepted or declined advertising cookies, where an advertising pixel is in use, 6 months.spr_admin— staff sign-in only.- Google Analytics 4 and Vercel Analytics, if enabled, receive page and event data without names or contact details. Advertising pixels, if enabled, load only after you accept them.
9. Security
Data is encrypted in transit, stored with access controls, and lead exports are restricted to authorised staff, logged, and delivered through expiring links. IP addresses are stored only as salted hashes. Forms may be protected by a bot-detection service that checks the request, not your identity.
10. Data breaches
If a breach is likely to cause significant harm or affects 500 or more people, we will notify the PDPC within 3 calendar days of assessing it as notifiable and notify affected individuals as required.
11. Transfers
Our hosting providers may process data outside Singapore. We require contractual protections comparable to the PDPA for any such transfer.
12. Children
The tools are intended for adults and for parents acting for children under 21. We do not knowingly collect contact details from anyone under 18.
13. Changes
The version date above changes when this policy changes. Material changes are announced on the site.
14. Contact
Data Protection Officer: privacy@singapr.sg. You may also complain to the Personal Data Protection Commission.