Privacy Policy

From Residents: full name, email, phone (WhatsApp/WeChat), nationality, gender, university, course of study, Student Pass details, and accommodation preferences. From Hosts: business name, contact details, and property details. Automatically collected: anonymised usage analytics via PostHog, error data via Sentry (no PII), and standard server logs.

We collect this data to match Residents with accommodation listings, process enquiries, send confirmation emails, notify Residents of relevant new listings, arrange ancillary services, and comply with Singapore law.

We rely on consent (obtained at enquiry submission or account creation), contractual necessity (to deliver our service), and legal obligation (compliance with Singapore law).

We do not sell your personal data. We share data only with the Host you enquire about (name and contact details only), service providers necessary to operate the platform (Supabase, Vercel, Resend, PostHog, and Sentry — each bound by data processing agreements), and authorities where required by law.

Your data is stored in Singapore (AWS ap-southeast-1 via Supabase). Sensitive fields are encrypted at rest via Supabase Vault, and all transmissions are encrypted using TLS. Access is restricted by role-based controls with a persistent audit trail.

Residents with no completed service: data retained for 2 years from your deletion request, then permanently deleted. Residents with completed service history: 7 years from your last service. Host data: retained for the duration of the listing relationship and as required by law.

Under the PDPA you may request access to your data, correction of inaccurate data, withdrawal of consent, data portability, and account deletion. Contact dpo@welcomestay.com.sg — we respond within 30 calendar days. Some data may be retained until the applicable legal retention period elapses.

We use PostHog for anonymised usage analytics. PostHog may set cookies; we do not use cookies for advertising or cross-site tracking. You can control cookies via your browser settings.

Your data is primarily stored in Singapore. Some service providers may process data in other jurisdictions; we ensure adequate safeguards are in place in accordance with the PDPA.

We may update this policy from time to time. Where changes are material, we will notify you by email or prominent notice on the platform.