Privacy Policy

This policy explains how LeafTracker Pte. Ltd. (“LeafTracker”, “we”, “us”) collects, uses, discloses and protects personal data when you use leaftracker.app, the LeafTracker platform and the messages we send about them (together, the “Service”). We are a Singapore company and we follow the Personal Data Protection Act 2012 (PDPA). Read this together with our Disclaimer.

1. Who this covers

Anyone who interacts with LeafTracker: people with an account, people invited into a project by a customer, visitors to the website, people who ask for a demo or join a waitlist, and people who write to us.

For account, billing, website and support data, LeafTracker decides why and how the data is used. For the documents and details a customer puts into its own project workspace (“Project Data”), the customer decides, and LeafTracker handles that data on the customer's instructions as a data intermediary under the PDPA. A request about Project Data may need to go to the customer that owns the project.

2. What we collect

• Account details: name, email address, organisation, role and country, a system-generated user ID and whether your email is verified. Passwords are stored only as a hash and cannot be read by us.
• Project details: project name, location, building type, certification target, project stage, assignments, due dates, comments, review history and who is on the project.
• Uploaded evidence: documents, drawings, specifications, photographs, certificates, test results and correspondence you upload as evidence, and links you save to documents kept elsewhere. These can incidentally contain personal data.
• Billing details: plan, subscription status, invoices, billing contact and transaction identifiers. Card details go straight to our payment processor and are never stored by LeafTracker.
• Technical data: IP address, browser and device type, operating system, timestamps, pages and features used, error logs and cookie identifiers.
• Messages: support requests, demo requests, feedback and your marketing preferences.
• Waitlist sign-ups: the name and email address you give us to be told when a tracker opens, when you signed up, and a hashed form of your IP address so we can spot automated sign-ups.

We do not ask for NRIC or passport numbers, home addresses, dates of birth, health data or other sensitive personal data. Please do not upload such data unless it is strictly necessary and lawful.

3. How we collect it

Directly from you; from a customer or project administrator who creates or invites your account; automatically from your browser and device; and from the service providers that run our authentication, hosting, billing and email.

4. What we use it for

• to create and run accounts, organisations, workspaces and project permissions;
• to provide the trackers, evidence management, collaboration, reporting, export and support;
• to sign you in, prevent misuse, investigate incidents and protect the Service and its users;
• to process subscriptions, payments and invoices;
• to send operational notices, product changes, security messages and the support you asked for;
• to tell you, once, when a tracker you joined the waitlist for opens;
• to understand performance and usage, fix problems and improve the product;
• to comply with the law, enforce our agreements and respond to lawful requests;
• to send marketing where you have agreed to it, always with an unsubscribe link; and
• to produce aggregated statistics that do not identify any person or customer.

We will not use Project Data to train generative AI models unless the customer, and where required the people concerned, expressly opt in. If we add features that send your data to an AI service, this policy will say so first.

5. Consent and withdrawing it

Where consent is needed we tell you the purpose at or before collection. Giving us personal data for a stated purpose is consent to use it for that purpose. You can withdraw it at any time (see Your rights below). Withdrawal does not undo what was already lawfully done, and it may mean some features no longer work for you; we will tell you if so.

6. Who we share it with

Only as needed to run the Service:

• the customer that owns a project, its administrators and the people it has given access to;
• the providers that run the Service under contract: our database, sign-in and file-storage provider, our hosting provider, our payment processor, the bot-protection service on the sign-in and sign-up pages, and our email delivery provider. Maps inside the Service draw their tiles from third-party map servers, which see your IP address when they load;
• professional advisers, auditors and insurers, under confidentiality;
• authorities, regulators and courts where the law requires or allows it; and
• a successor if LeafTracker is sold, merged or reorganised, with the same protections.

We do not sell personal data, and we do not hand customer contact lists to anyone for their own marketing.

7. Cookies and local storage

We use the cookies needed to sign you in and keep your session, and your browser's local storage to keep tracker progress between visits. The bot-protection service on the sign-in and sign-up pages sets its own cookies to tell people from bots. We run no advertising or analytics cookies, so there is no cookie banner. If that changes, we will ask before setting any non-essential cookie.

8. Where the data goes

Our providers process data in Singapore, the wider Asia-Pacific region and the United States. When personal data leaves Singapore we make sure it gets protection comparable to the PDPA, through contract terms with each provider and checks on how they handle data.

9. Security

Everything travels over HTTPS. Sign-in uses hashed passwords; you only ever see your own projects; uploaded documents are served through short-lived signed links; the site sends strict security headers; and the sign-in and sign-up forms are protected against bots. We add multi-factor sign-in, audit logs and other controls as the Service grows. No system is completely secure: keep your password to yourself and tell us if you think an account has been compromised.

10. How long we keep it

We keep personal data while your account is active and for as long as we need it to provide the Service, meet legal and contractual obligations and keep security records. When an account or subscription ends, project data stays exportable for 30 days, is then deleted or anonymised from our production systems within 90 days, and leaves encrypted backups as they rotate within 180 days. Billing and legal records are kept for the period the law requires, up to 7 years.

11. Your rights

Under the PDPA you can ask what personal data we hold about you and how it has been used or disclosed in the past year, ask us to correct it, withdraw consent, or ask us to delete your account and its data sooner than the periods above. Any of these requests goes to the contact below. We may check your identity first, and we answer within 30 days. Where a request concerns Project Data we may pass it to the customer that owns the project and help them respond. Profile details can also be changed inside the Service.

12. Marketing

Marketing is optional and separate from accepting these terms. Every marketing email carries an unsubscribe link. We will still send the messages needed to run your account, a transaction, a security incident or a legal notice. Any telephone marketing follows the Do Not Call rules of the PDPA.

13. Data breaches

If a breach must be reported under the PDPA we will notify the Personal Data Protection Commission and the people affected within the time the law sets. Where the breach touches Project Data we handle for a customer, we will tell that customer without undue delay and help them respond.

14. Children

The Service is for professional use and is not aimed at children. Anyone under 18 should not open an account alone. If we learn that a child's data was collected without proper authorisation we will delete or restrict it.

15. Other sites and BCA resources

The Service links to official BCA pages and other third-party sites, whose privacy practices are their own. A link to BCA, or a descriptive reference to Green Mark, does not mean BCA endorses LeafTracker or that LeafTracker controls data you submit through official BCA channels.

16. Changes to this policy

We update this policy when the Service, our providers or the law change. The effective date at the top moves when we do, and we give reasonable notice of material changes. Where the law requires it we will ask for fresh consent before using data already collected for a new purpose.