FREEHOLT

Privacy Policy

Last updated 7 November 2026

Who this is for: Everyone whose personal data we hold: account holders, the household members and beneficiaries they name, people who paid rent into an account holder's bank account, people an account holder's spending was paid to, and visitors to the site.

This policy explains how [Freeholt Pte. Ltd.], trading as Freeholt ("we", "us"), collects and uses personal data. It is written to satisfy the Singapore Personal Data Protection Act 2012 (PDPA), the EU and UK General Data Protection Regulation (GDPR), the Australian Privacy Act 1988 and its Australian Privacy Principles (APPs), and to be honest to everyone else.

The short version: you enter financial figures so that a calculator can project them; we store those figures so that you can come back to them; we never sell them, never run advertising or third-party analytics, and you can export or delete everything yourself from inside the app.

For individual users we are the controller (in PDPA terms, the organisation) of your data. Where a business customer such as a financial adviser enters information about its own clients, that customer is the controller and we process the data on its instructions under our Data Processing Agreement.

1. What we collect

We collect only what the Service needs to do what you ask of it. The table lists each category, where it comes from, and what it is for.

Category	What it includes	Source	Why
Account	Email address, the display name you type at sign-up, a password (stored only as a hash by our authentication provider), the time you signed up and last signed in, the plan terms version your account was created under, and the plan your account is on, including any access an administrator gives or limits on it (which features, until when, and a short internal note of why; the note never contains your figures).	You; our administrators	To create and secure your account, to contact you about it, and to give you the access your plan includes.
Household and financial inputs	Properties you own and properties you are considering buying (including address, purchase and sale details, price, value, rent, costs, whether you would buy each one as a citizen, permanent resident or foreign buyer in its country - worked out from the citizenship and residence you record, which also decide the purchase taxes shown and, where the household holds more than one citizenship, the purchase cost and any permit or ownership limit under each one - and, for a property you archive, the day, your reason and its figures that day), loans and offsets, cash and investment balances and the institution or platform they are with, securities and transactions, pension or retirement accounts and contributions, income, expenses, savings, goals, scenarios, assumptions, and the year of birth, planned retirement age and (optionally) name of you and a partner.	You, or a file you import	To compute the projections, comparisons and reports you ask for. This is the substance of the Service.
Tax and residency	Countries of tax residence and the periods they apply to, any special tax regime for new residents you choose for one of those periods, citizenships and whether a person holds a US green card (lawful permanent residence), main residence and occupancy details, the country the household is based in, whether you and a partner file one joint US federal tax return (your US filing status) and, if you file separate returns, whether you lived apart all year, for Israel how many apartments you own there, whether you plan to sell one within the replacement window and whether you can get a foreign tax authority's certificate of owning no home abroad, and tax losses carried forward and other deductions you enter.	You	To select the tax rules, currencies and country data the calculations use.
Pasted listings and emails	Text of a property listing or an agent's email that you paste to fill in a property's figures. It is read in your browser by fixed rules; it is never sent to us or to anyone else, and never stored. Only the figures you confirm are kept, as part of the property.	You	To save you typing a property's figures.
Market evidence	Sale and listing figures for other properties that you type in to compare with the properties on your shortlist: the street or suburb, the month, the price, bedrooms, type and size, and a short note of where you saw them. These are a property's public figures; we ask you not to enter anyone's name or contact details.	You	To show where a shortlist property's asking price sits among nearby sales.
Imported statements and documents	Statements and other documents you choose to import on the Documents page. The document is read on your own device, in your browser, by fixed rules; it is not uploaded to us or stored. We keep only what you confirm: the figures, and a history of each import (which values it changed, and what they were before and after, so that it can be undone exactly). An account number is never stored: it is sent to us once and turned in memory into a one-way keyed hash, which may be kept on the account you choose so that a later statement from it is matched for you. The same hash is also written into that import's history, so that the import can be undone exactly. Undoing the import puts back what the account held before, unless it has changed since, but the history keeps its record of the hash, also after the account's hash is replaced or the account is deleted, until your Freeholt account is deleted. You only ever see the last four digits of an account number. A one-way keyed fingerprint of each imported document is kept so that the same document is not imported twice. When you import a bank statement or export, the description of each payment into the account is sent to us once, turned in memory into a one-way keyed hash, and is never stored or logged; the description is usually the name of whoever paid (for example a tenant or a managing agent), and the hash lets a payer seen before be matched to the same property. When you record a payment as rent received for a property, we keep its date, amount and currency and the property you chose, with a one-way keyed fingerprint of the payment so that the same payment is not counted twice, and it counts towards that property's rent for the month. We also keep the payer's hash with that property, so that rent from the same payer on a later statement is matched to it. You can see how many payers are remembered for each property, including a property you have sold or deleted, and forget them, on the Documents page. A recorded payment is kept until you undo its import, or until you restore a backup, which replaces your properties, or until your Freeholt account is deleted. A remembered payer is kept until you forget it, or until you restore a backup, which replaces your properties, or until your Freeholt account is deleted; undoing the import that remembered it puts back what was remembered before, unless it has changed since. As with an account number, the import's history keeps its record of a payer's hash, also after the payer is forgotten, until your Freeholt account is deleted. The description of each payment OUT of the account is also sent to us once, to be turned in memory into a one-way keyed hash of the shop or payee (kept apart from payers' hashes); it is never stored or logged. When you file a payment out as spending, we keep its date, amount (a refund as a negative amount) and currency, the category and sub-category you chose and whether you marked it as a one-off, with a one-way keyed fingerprint of the payment and the shop's hash, so that the same payment is not counted twice. For each imported statement we also keep how many payments out you left unfiled and their total in each currency, never which payments they were, their dates or their shops, so that the Money page can show how much of a statement is not filed. We also keep the shop's hash with the category you chose, so that a later payment to the same shop is filed the same way, and you can forget every remembered shop on the Documents page. We never keep a shop's name: it stays in your browser's storage on the device that imported the statement. For a payment filed under Health, or Gifts and giving, we keep only that category, never a sub-category. On the Money page you can split a payment between categories, by typing the amounts or by reading a receipt: a receipt is read on your own device, in your browser, and is not uploaded to us or stored, and nothing printed on it (not its items) is sent to us; we keep only the amount for each category you confirm, with the payment, until you remove the split, undo the payment's import, or your Freeholt account is deleted. A shop's estimated split is worked out from your split payments each time you open the page and is not stored; we keep only whether you turned it off. A spending payment, and a statement's count of unfiled payments, is kept until you undo its import, or until your Freeholt account is deleted; a remembered shop until you forget it, or until your Freeholt account is deleted; undoing the import that remembered it puts back what was remembered before, unless it has changed since. A property workbook you import on the Properties page is different: it is sent to us, read in memory and not stored, and only the properties you choose to add are saved. Any future option to keep a copy of a document would be offered only with your separate, explicit consent.	You, or a file you import	To let you update balances and other figures from a document without typing them, to show where a figure came from, to undo an import, and to match a later statement's rent to the same property.
Change history	A record of every change to a value you have saved (a property's value, a loan's rate or balance, rent, costs and the like): the value before and after, the date it applies from, when the change was made, and how it was made (typed, imported or calculated). It is kept so an earlier figure is never lost when you correct or update it. Corrections you save on the History page are also kept as one record per save, with each figure before and after, so that the save can be undone; they are deleted with your account.	You, and the Service when you save	To show you how a figure has changed, and to keep earlier values when you correct or update one.
Payments	Our payment processor's identifiers for your customer record and subscription, the subscription status, and the plan you bought. We never receive or store your card number.	You, via the payment processor	To know which plan you are on and to reconcile billing.
Support and assistant	Questions you send to the in-app assistant, the answers, whether an answer was refused, and the model used. Support emails you send us.	You	To answer you and to review and improve the quality of answers.
Legacy Access (if you turn it on)	The name, email address and (optionally) relationship of up to five beneficiaries; a hash of a pass phrase you set; your dormancy settings; a log of check-in emails, responses and releases including the IP address and browser of the device that acted; and, once triggered, a read-only summary of your figures held for the beneficiaries.	You (about your beneficiaries); the device that opens a link	To operate the feature you configured and to prove afterwards what was sent to whom and when.
Saved answers	Answers from the AI Analyst that you choose to save as a report: the question, the sentences and the figures of its calculations as they were on the day, frozen (not the written reply, which stays in the conversation), and which calculations produced them with what they were given, so that you can run the same calculations again later on your plan as it is then. The calculations are not part of a shared link.	You	To keep an answer you want to read again, print or share.
Sharing	Snapshots of a plan's outcome, or of a saved answer, that you choose to share by link (for example with your accountant), with a title, until they expire or you revoke them.	You	To show a plan outcome or a saved answer to someone you send the link to.
Usage and technical	Per-day counters of which features an account used (no values), the outcome of each digest and reminder email we sent you, and an audit record of sensitive actions on your account (what changed, never the amounts). On our public pages, where you have no account, we keep per-day counts of how often a page element was used and which country was chosen, with no identifier, no cookie and no record of who you are: a count rises by one and nothing about you is stored. Your IP address is read to rate limit those requests and is never written down. Our hosting and email providers keep standard server and delivery logs that include IP addresses, browser type and request times for a short period.	Your use of the Service, and visits to our public pages	To enforce plan limits, understand which parts of the site people use, keep the Service secure, investigate problems, and meet our legal obligations.
Cookies	A session cookie from our authentication provider; a cookie that remembers whether you are viewing the sample portfolio; short-lived cookies that carry a choice you made on our public pages into the app, whether you then sign up, confirm your email, sign in or are already signed in (the story on the landing page, a property you typed into a public calculator, or the free trial you asked for), each deleted once it has been used or after 30 minutes; and, for a beneficiary opening a Legacy Access vault, a session cookie for that vault. All are necessary for the Service to work. The app also keeps some of your choices in your browser's own storage on your device: for example a panel you opened, a view or chart setting you picked, a draft you have not saved yet, how far you got in a guided tour, a spreadsheet's column layout on the Documents page, or the names of the shops you filed spending from (which we never receive; a shop's name is forgotten once you file it under Health or Gifts and giving, and every name is forgotten when you sign out or delete your account). Like the cookies, it is used only to keep the app the way you left it, never to track you or for advertising, and you can clear it in your browser.	Your browser	To keep you signed in and remember a choice you made on the site.

We do not collect government identity numbers, bank login credentials, full card numbers, precise geolocation, biometric data, or any special category of personal data (health, ethnicity, religion, politics, sexual orientation, criminal history), and we ask you not to enter them. When you file spending under Health, or Gifts and giving, we keep only that broad category, never the shop or a sub-category such as a pharmacy or a charity, so that a spending record does not reveal one. Citizenship, tax residency and US filing status are collected because tax rules depend on them, and citizenship also because the rules on who may buy property in some countries do; they are not used for any other purpose.

We do not use advertising pixels, third-party analytics scripts, session recording, fingerprinting, or any script that follows you to other sites.

2. Why we use it, and the legal basis

Purpose	Legal basis (GDPR / UK GDPR)	PDPA / APP note
Providing the Service you signed up for: storing your inputs, running calculations, showing reports, exports, backups, billing.	Performance of a contract (Art. 6(1)(b)).	Deemed consent by contractual necessity; APP 6 primary purpose.
Securing the Service: authentication, rate limits, audit records, fraud and abuse prevention, backups.	Legitimate interests (Art. 6(1)(f)) in a secure, reliable service; legal obligation where security law requires it.	Legitimate interests exception; APP 11.
Service emails: sign-up confirmation, password reset, billing receipts and renewal reminders, a reminder before a trial or access we gave you ends, notice before a change to an email you receive, security notices, changes to these terms.	Contract; legal obligation.	Deemed consent; not marketing.
Monthly digest email of your own figures.	Consent (Art. 6(1)(a)): it is off until you turn it on in Settings and every email has an unsubscribe link.	Express consent; you may withdraw it at any time.
Reminder emails before a loan's fixed rate or interest-only period ends.	Consent (Art. 6(1)(a)): it is off until you turn it on, and every email has an unsubscribe link.	Express consent; you may withdraw it at any time.
Legacy Access, including emailing the beneficiaries you named.	Consent for you (the feature records the time you consented); legitimate interests in respect of beneficiaries, who are told who named them and why.	Express consent; beneficiaries receive notification at first contact.
Matching rent from a bank statement to a property (Documents): the keyed one-way hash of the description of a payment into your account, kept with the property you chose.	Contract for you; legitimate interests (Art. 6(1)(f)) in respect of the people who paid that rent, who are not party to our contract with you. Only the hash is kept, never their name; it is used for nothing but matching their later payments to the same property, and you can forget it at any time. We hold nothing that would let us contact them, so they are not told individually (Art. 14(5)(b)); this policy is public, and a payer may exercise their rights by emailing us.	Legitimate interests exception; APP 3.6, collected from you as a keyed hash only.
Filing your spending from a bank statement by category (Documents, Money): the payments out you confirm, how you split a payment between categories, and the keyed one-way hash of each shop's description, kept with the category you chose.	Contract for you; legitimate interests (Art. 6(1)(f)) in respect of any person a payment was made to (a shop is usually a business, but a payee can be a person), who is not party to our contract with you. Only the hash is kept, never their name; it is used for nothing but filing later payments to them under the same category, and you can forget it at any time. We hold nothing that would let us contact them, so they are not told individually (Art. 14(5)(b)); this policy is public, and a payee may exercise their rights by emailing us.	Legitimate interests exception; APP 3.6, collected from you as a keyed hash only.
Assistant and narration features.	Consent, by choosing to use the feature; legitimate interests in reviewing stored conversations for quality.	Deemed consent by use of the feature you invoked.
Address matches when you type a property's address, unless you pick City only for it (section 3).	Performance of a contract (Art. 6(1)(b)): matching the address you type is part of the property form you are filling in; legitimate interests (Art. 6(1)(f)) in a correct address with less typing. City only sends nothing, and you can pick it for any property at any time.	Legitimate interests exception; APP 6 primary purpose.
Aggregated, anonymised statistics (section 5).	Legitimate interests in understanding and improving the Service and in producing statistics that identify no one. Anonymising is the last processing of your personal data for this purpose.	Anonymised data is not personal data under the PDPA; the process of anonymising it is covered by the business-improvement exception.
Complying with law: tax and accounting records of payments, responding to lawful requests, keeping a record of erasure requests.	Legal obligation (Art. 6(1)(c)); legitimate interests in establishing or defending legal claims.	Required by law exception.

We do not make decisions about you by automated means that have legal or similarly significant effects. The Service computes and ranks figures for you to consider; it does not decide anything about you.

3. The assistant, narration and address features

These optional features send data to Anthropic, PBC (United States) to use a Claude model over its commercial API. The provider does not use data sent through that API to train its models.

Narration ("Explain my position") sends a small structured summary of your own figures: the month, home currency, number of properties, portfolio totals, and the alerts the Service has computed. It sends no name, email, address, account identifier or free text. The reply is shown to you and is not stored.
The assistant ("Ask Freeholt") sends the recent turns of your conversation and a fixed description of how the Service works. It does not send your portfolio. Each question and answer is stored in your account, with the model name, and can be read by an administrator to check answer quality. Deleting your account deletes them.
The AI Analyst, where switched on for your account, answers only after you accept its own terms (the AI Analyst Terms, shown before first use, in the question box too). Until then nothing is asked or sent.
When you tell the AI Analyst a figure has changed, it prepares a card and keeps it with the figures it would replace; nothing changes until you press Apply, and the card is what lets you undo the change. Anything deleted through the AI Analyst is held in an archive you can restore from. Cards and the archive are removed after 30 days of Undo, no later than 37 days after they were made.
On its own page, in the panel you can open on any page and in the question box on Portfolio Outlook, History and Outlook, the AI Analyst holds one conversation about your own plan. To answer, it sends your question, the parts of your plan the answer needs (including your own names for your properties and their figures), the facts it remembers for you, the recent conversation and, in the panel and the question box, the name of the page you asked from (such as “Outlook”; never what is on your screen). With every question those parts include who your plan is for: the names, ages, citizenships, retirement ages and pension access ages you entered for the people in it, your tax residency periods with their dates, and how each property is held and in what shares. If a what-if is open (Portfolio Outlook and Outlook share one) they also include what the what-if changes, with any property or purchase it names, and Portfolio Outlook's net worth and goal year with and without it. When an answer needs them they also include each person's year of birth, income (with its label and where it is earned), pension funds (provider, type, country and balance), contributions, State Pension age and amount, and whether they hold a US green card, any region or special tax regime on a residency period, each owner's share of a tax figure by name, the holdings you track under Investments (each one's name, symbol, units, last price, value, cost, dividends and any franked share you entered), your ISA and US account contributions (with any beneficiary you named), and for Israel how many apartments you own. It sends no files, identity, bank or card numbers: a citizenship is the country only. Your conversations and remembered facts are stored in your account until you delete them in Settings, My data, or delete your account.

If the deployment has no model key configured, these features say so and send nothing.

Address matches. Unless you pick City only for a property, the address you type is sent from our servers to Google's Places service, with the property's country and a random session code, to find matching addresses. We keep the address you confirm and Google's identifier for it, used to open the place in Google Maps when you ask. We do not keep Google's map coordinates. Choose City only and nothing is sent. This starts on 29 October 2026.

Google Maps links. Showing the "Google Maps ↗" link on a property sends Google nothing, and no Google script runs on our pages. Following it takes you to Google's own site, which then receives the address (or, without one, the property's name, city and country), Google's identifier for the place when we keep one, and your IP address, under Google's own privacy policy.

4. Who we share it with

We share personal data only with the service providers below, each under a contract that limits them to processing it for us, and otherwise only where the law requires or you ask us to. We do not sell personal data and we do not share it with advertisers, data brokers, lenders, agents or advisers.

Provider	Role	Data	Location
Supabase, Inc.	Database, authentication and storage of everything in your account. Its built-in mailer sends the account emails: sign-up confirmation, password reset, sign-in link and email-change confirmation.	All categories in section 1 except payment card data and the delivery logs of the emails Resend sends. For the account emails, the message and its delivery log.	Seoul, South Korea (AWS ap-northeast-2); Supabase's US-based control plane.
Vercel, Inc.	Hosting, application servers, scheduled jobs, edge network.	Everything that passes through the application in transit; server logs with IP address and request metadata.	Application functions in Seoul, South Korea (AWS ap-northeast-2); edge network worldwide; US company.
Stripe, Inc.	Payment processing, subscription billing, receipts.	Email address, payment method and billing details you give Stripe, subscription records.	United States, with regional entities.
Resend, Inc.	Sending the Service's own email: the welcome email, the monthly digest, rate-change reminders, trial-ending and renewal reminders, notice before a change to an email you receive, and Legacy Access check-ins and notices.	Recipient email address, subject, message content, delivery events.	United States.
Anthropic, PBC	Language model for the optional assistant, narration and AI Analyst features (section 3).	The structured summary, conversation or AI Analyst conversation described in section 3.	United States.
Google LLC	Address matches when you type a property's address, unless City only is picked (section 3).	The address text you type, the property's country and a random session code, sent from our servers - Google does not receive your IP address, browser details, name or email.	United States.
Have I Been Pwned (Troy Hunt)	Checking at sign-up whether a chosen password appears in known breaches.	The first five characters of a hash of the password; never the password, never your email.	Global CDN.
Public statistical and market data sources (central banks, statistics agencies, exchanges, index providers).	Exchange rates, market prices, property and yield benchmarks.	None. These are fetched by our servers with no user data attached.	Various.

We may also disclose personal data where required by law, court order or a regulator with jurisdiction over us; to protect the rights, safety or property of any person; to a successor if our business is sold or reorganised (you will be told and this policy will continue to apply); and to professional advisers under confidentiality.

5. Aggregated and anonymised data

We may derive statistics from the figures users enter and from how the Service is used, and we may use, publish and license those statistics, including commercially, during and after your use of the Service. Examples: the distribution of loan-to-value ratios among households in a country, how assumed growth rates compare to recorded benchmarks, which features are most used, or the range of rental yields entered for a city.

We apply these safeguards to every such statistic:

identifiers are removed before aggregation: no email, name, account identifier, address, or free text is ever part of a statistic;
a statistic is released only where it describes a group of at least 20 households, and we do not release a statistic where the combination of attributes would single out a household;
figures are rounded, banded or otherwise coarsened where a precise value could be matched back to a person;
we do not attempt to re-identify anyone from aggregated data, and we contractually prohibit anyone we license it to from doing so;
we never publish or license a figure that describes one identifiable household, property, beneficiary or client.

Data that has been anonymised in this way is no longer personal data and this policy no longer applies to it. Deleting your account stops your figures from contributing to any statistic produced after deletion; statistics already produced cannot be reversed and contain nothing about you.

6. Where your data is stored and international transfers

Your account data is stored in Seoul, South Korea (AWS ap-northeast-2) by our database provider, and processed by application servers in the same region. Our other providers are in the United States. Whichever country you live in, your data is therefore transferred outside it.

EU and UK residents: the European Commission has recognised South Korea as providing adequate protection (Decision (EU) 2022/254), and transfers to our US providers are made under the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum) contained in each provider's data processing terms, or under the EU-US Data Privacy Framework where the provider is certified. Copies of the relevant clauses are available from the providers or from us on request.
Singapore residents: under the PDPA transfer limitation obligation, we transfer data only to providers bound by contractual obligations to protect it to a standard comparable to the PDPA.
Australian residents: under APP 8 we take reasonable steps to ensure overseas recipients handle your data in accordance with the APPs, by contract with each provider. Because the Service is hosted overseas, you should assume any data you enter is held outside Australia.

7. How long we keep it

Data	Kept until
Everything in your account (section 1, all categories except those below).	You delete the account or an administrator deletes it at your request. Deletion is immediate in the live database; provider backups that still contain the data expire within 30 days and are never restored to reinstate a deleted account.
The record that an account was deleted (account identifier, email, time, and whether a subscription was cancelled), and administrator actions on the account.	Up to 7 years, as our evidence that a deletion request was honoured and to answer any later query about the account. It contains no financial figures.
Payment records held by our payment processor and in our accounts.	As long as tax and accounting law requires (currently up to 7 years in Singapore and Australia, 6 years in the UK).
Assistant conversations.	Until you delete the account.
Saved answers and other data the AI keeps for you that you delete in Settings, My data.	30 days in Recently deleted, where you can restore it, then removed for good (or at once, if you choose Delete permanently now). An archived item is kept until you delete it or the account.
Share link snapshots.	90 days from creation unless you revoke them earlier, or when you delete the account.
Legacy Access summary released to beneficiaries.	365 days from release, then purged; or when you delete the account.
Monthly digest and rate-change reminder emails and their delivery events at our email provider.	Per the provider's retention, typically under 30 days for content.
Server logs at our hosting provider.	Per the provider's retention, typically under 30 days.
Aggregated, anonymised statistics (section 5).	Indefinitely; they contain no personal data.

8. Your rights and how to use them

Wherever you live, you can:

See and correct your data at any time: everything you entered is visible and editable in the app, with one exception. The Property Buying Shortlist is part of Premium and the 7-day trial; without either, the properties and the market evidence you saved in it are kept but cannot be viewed or edited in the app. They are included in "Download my data", you can delete them at any time on any plan (including the Free plan), they open again for viewing and editing with Premium or the trial, and they are deleted with your account like everything else.
Export it: Settings has a "Download my data" button on every plan that gives you a complete, machine-readable JSON copy of everything you entered, suitable for portability and for restoring into another account (saved Property Buying Shortlist properties and market evidence are restored only into an account with Premium or the 7-day trial). The copy also holds, for your own records, your saved answers, the change history of your saved values, the history of your document imports, the rent payments recorded from statements and how many payers are remembered for each property, the spending payments recorded from statements (with how each split payment is shared between categories) and how many shops are remembered under each category, and how many payments out each statement left unfiled, with their total; a restore does not read those from the file, and does not restore the monthly rent received those payments add up to. The paid plan's Export page adds spreadsheet and report formats.
Archive or delete what the AI keeps for you: Settings, My data lists your saved answers and anything else the AI keeps for you. Tick one item, several or all of them to archive, delete or download them. A deleted item stays in Recently deleted for 30 days, so you can restore it, and is then removed for good; deleting a saved answer stops its shared links at once.
Delete it: Settings contains a self-service account deletion. It erases every record listed in section 1 from the live database at once, cancels any subscription, signs you out, and leaves only the deletion record described in section 7. It cannot be undone.
Withdraw consent: turn the monthly digest, the rate-change reminders, Legacy Access, or the assistant off in the app at any time; every digest and reminder email has a one-click unsubscribe link.
Object to, or ask us to restrict, a use of your data based on legitimate interests, including the production of statistics under section 5, by emailing us.
Complain: we would rather hear it first, but you may also complain to your data protection authority: the Personal Data Protection Commission (Singapore), the Information Commissioner's Office (UK), the Office of the Australian Information Commissioner, or the supervisory authority of the EU country where you live.

To exercise a right you cannot exercise yourself in the app, or if you are a beneficiary or other person who does not hold an account, email support@nestworth.com (mark the subject "Privacy" or "Data Protection Officer"). We will confirm receipt promptly, may ask you to verify your identity in a way proportionate to the request (usually by replying from the account email address), and will respond within 30 days, or tell you within that time if a complex request needs longer (up to a further 60 days under the GDPR). We do not charge for a request unless it is manifestly unfounded or excessive, and we never treat you differently for making one.

Where we hold data about you as a processor for a business customer (for example an adviser who entered your details), we will pass your request to that customer and help them answer it.

If you are a California resident: we do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit. The rights above are available to you regardless of whether the CCPA applies to us.

9. Security

We designed the Service so that the most sensitive things are never collected at all: no bank logins, no full card numbers, no uploaded files kept. For what is collected:

every request to the database is limited by row-level security to the signed-in account; an administrative key is used only on the server for tasks such as billing and deletion, and every such use is scoped to a verified account identifier;
all traffic is encrypted in transit; the database and its backups are encrypted at rest by the provider;
passwords must be at least 12 characters with mixed character classes, are checked against known breaches at sign-up, and are held only as hashes by our authentication provider; sign-in and reset attempts are rate limited;
administrator access requires a second factor; sensitive actions on an account are recorded in an audit log that records what changed, never the amounts;
Legacy Access links and pass phrases are stored only as one-way hashes; every link is single-use and time-limited;
a content security policy, strict transport security and related browser protections are set on every page.

No system is perfectly secure. If we become aware of a breach that affects your personal data we will assess it without delay and, where the law requires, notify the relevant authority (within 72 hours under the GDPR; within 3 calendar days of assessment under the PDPA; as soon as practicable under the Australian Notifiable Data Breaches scheme) and notify you directly where the breach is likely to result in significant harm or high risk to you.

10. Children

The Service is for adults and we do not knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we will delete it.

11. Marketing and messages

We do not make marketing calls or send marketing text messages, and we are not on, and do not need to check, the Singapore Do Not Call Registry. Email from us is limited to the service messages in section 2, the monthly digest and the rate-change reminders you opted into, and occasional product announcements to account holders, each of which has an unsubscribe link; you can stop announcements without affecting service messages.

12. Changes to this policy

We will update this policy when the Service changes what it collects or who it shares it with. Material changes are notified by email or in the app at least 14 days before they apply. The date at the top is the date of the current version.

13. Contact and Data Protection Officer

[Freeholt Pte. Ltd.], [Registered office address], Singapore. Our Data Protection Officer, designated under section 11(3) of the PDPA, can be reached at support@nestworth.com (mark the subject "Privacy" or "Data Protection Officer").

If we appoint a representative in the European Union or the United Kingdom under Article 27 of the GDPR, their details will be added here.

Freeholt is a calculator based on the information you provide. It is not financial, tax or legal advice. Please consult a licensed professional.