Privacy Policy

1. Who we are and what this covers

Plinth is operated by AUDEOBASE PTE. LTD. (UEN 202645192R), a company registered in Singapore (“we”, “us”). This policy covers the property agents who use Plinth, the clients and visitors who use an agent’s brief, tour or website, and visitors to this site.

Our Data Protection Officer can be reached at [email protected].

2. Agents and their clients

For an agent’s own account, we decide how the data is used and we are responsible for it.

When an agent adds details about clients, or receives bookings and questions through their website, the agent decides what is collected and why. For that data we act on the agent’s behalf, as a data intermediary under the PDPA, and use it only to provide Plinth to that agent and to keep the service secure. If your details reached Plinth through an agent, you can contact that agent or us; we will work with the agent on your request.

3. What we collect from agents

• Account: name, email address, phone, agency, CEA registration number and agency licence number, your plan and trial dates. If you sign in with Google, we receive your Google account ID, verified email address and name. If you use a password, we store only a scrambled (hashed) form of it.
• Free-trial record: when an account is made or a trial starts, we record a keyed one-way hash of its email address, of its Google account ID and of the trial card's fingerprint from Stripe (not the card number), with the date, so each person and each card gets one free trial. We keep these after the account is closed; we do not keep the address or ID itself.
• Your work: listings and their details, photographs, clips, panoramas and 3D tours, videos, room redesigns, client briefs, your website’s content and settings, and messages you draft.
• Clients: what you choose to enter, such as a name or alias, areas and homes of interest, notes and tags. Client phone numbers are encrypted before we store them. For affordability figures in a brief, you may enter details such as income, age, residency and the number of properties owned.
• Recorded conversations: see section 5.
• Technical: your browser and device type for each signed-in session, and usage counts we need to apply your plan’s allowances.

4. What we collect from clients and visitors

• Viewing bookings on an agent’s website: your name, email address or mobile number, the home and time you choose, and any note you add. We send a confirmation to the email address you give, with a private link to view, change or cancel the booking.
• Questions asked through an agent’s website: your question and the conversation with the website’s assistant, and the name and contact details you choose to leave, so the agent can reply.
• Client briefs: when an agent sends a tracked brief, we record when it is opened, which sections are read, time spent, scrolling and return visits, any questions you send, and your browser type and the page that linked to it. The brief shows a notice before any of this is recorded. To recognise a returning device we keep a scrambled device code, not your name; your phone number, if the agent added it, is kept only in scrambled form.
• 3D tours: rooms visited, time spent and narration listened to, without your name or IP address.

Activity gives the agent context for a conversation. It does not reveal what you intend, and it is not used for anything else.

5. Recorded conversations

An agent can record a conversation, for example a meeting with a client, to get a transcript, notes and follow-up tasks. Before each recording, the agent must confirm that everyone being recorded has agreed to recording and transcription. We keep that confirmation with the recording.

Audio and transcripts are encrypted where we store them, with a key held only by Plinth. This is not end-to-end encryption: our servers decrypt a recording to process it, and send it to Google’s Gemini service for transcription and notes when the agent asks for that.

The original audio is kept until the agent deletes the conversation. Approving a transcript or notes does not delete the audio. If you were recorded and want a recording deleted, ask the agent or write to us.

6. How we use personal data

• to run the features you use, including the AI features you start;
• to show an agent the bookings, questions and reading activity that belong to their work;
• to send service emails: welcome and trial reminders to agents, and booking confirmations to visitors;
• to apply plan allowances, prevent abuse, keep accounts secure and fix faults;
• to meet legal obligations and respond to lawful requests.

We do not sell personal data, and we do not use it for advertising. If we want to use personal data for a new purpose, we will tell you first and ask for consent where the law requires it.

7. AI processing

AI features run only when you start them: video narration and scripts, news summaries, room redesigns, and recorded-conversation transcripts and notes. For each request we send the provider only what that task needs. We use Google’s Gemini service, and Anthropic’s Claude service for news summaries.

AI output can be wrong. Agents are responsible for checking it before they use it or share it.

8. Service providers and where data is kept

We use these providers to run Plinth. Each processes personal data only on our instructions.

• Supabase: our database, in Singapore.
• Render: our servers, in Singapore.
• Cloudflare: network security and delivery, and R2 storage for photos, videos and panoramas, in the Asia-Pacific region.
• Resend: sending email, in the United States.
• Google: Google sign-in, Gemini AI processing, and the fonts used in the app.
• Anthropic: AI news summaries.
• Public data services (OneMap, URA, HDB and other data.gov.sg sources, LTA, MAS): they receive property addresses or locations to look up public facts, not people’s details. Maps on agents’ websites load from OneMap.
• Stripe: card payments are handled by Stripe. We will not see or store your full card number.

Some providers process data outside Singapore. Where that happens we take steps, such as contractual commitments, so that the data keeps a standard of protection comparable to the PDPA. We may also disclose personal data where the law requires or permits it.

9. Cookies and browser storage

This site uses no cookies. The Plinth app sets two cookies, both strictly necessary: a sign-in cookie that keeps you signed in for up to 14 days, and a short-lived cookie that protects Google sign-in for 10 minutes. The app also keeps your display theme in your browser, and a brief keeps a random device code there so repeat visits are counted once.

We use no analytics, advertising or tracking cookies.

10. Emails, messages and calls

The emails we send are service messages about your account or booking. We do not send marketing emails today. If we do in future, we will send them only with your consent, identify ourselves and include a working unsubscribe link, as the Spam Control Act 2007 requires. We do not make marketing calls or send marketing texts.

Messages an agent sends from Plinth go out from the agent’s own phone or email. The agent is responsible for following the PDPA’s Do Not Call rules and the Spam Control Act when doing so.

11. How long we keep data

• Brief and deck reading activity and visit records: 365 days, then deleted automatically.
• Expired brief links: deleted 365 days after they expire. Room redesign images: 365 days.
• Signed-in sessions: deleted when they expire.
• Recorded conversations: the original audio, transcript and notes are kept until the agent deletes the conversation.
• An agent’s account, listings, media, clients, bookings and questions: kept while the account is open, so the agent’s work stays in place, and deleted when the agent deletes them or closes the account.

When we no longer need personal data for the purpose it was collected for, or for a legal or business reason, we delete it or make it anonymous. Deleted data can stay in encrypted backups for up to 7 days before they are overwritten.

12. Keeping data safe

We use encrypted connections, store passwords and sign-in tokens only in scrambled form, encrypt client phone numbers and recorded conversations where we store them, limit repeated attempts, and keep each agent’s data separate from every other agent’s. No system is perfectly secure, so keep your sign-in safe and tell us if you notice anything wrong.

If a data breach is likely to cause significant harm or affects many people, we will notify the Personal Data Protection Commission (PDPC) within three calendar days of assessing it, and tell the people affected where the law requires.

13. Your choices and requests

You can ask us for a copy of your personal data and how it has been used or disclosed in the past year, ask us to correct it, ask us to delete it, or withdraw your consent. Write to [email protected]. We may need to confirm who you are first. We aim to reply within 30 days and will tell you if we need longer.

Withdrawing consent can mean a feature that needs the data stops working; we will explain what changes. A request cannot expose another person’s data. If your data reached us through an agent, we may involve that agent.

If you are not satisfied with our answer, you can contact the PDPC. Your rights under the PDPA ↗

14. Changes to this policy

Plinth is under active development, and this policy will change as it does. We will post every change here with a new effective date, and tell agents by email or in the app before a change that matters applies.

Questions or concerns: [email protected].