Privacy policy

Enquiries. When you send a message to an agent from their microsite, we collect your name, mobile number, and message. If you also add an intent tag (e.g. “Buying”, “Renting out”), that's stored with the message.

Accounts. If you create a PropTrust account, we collect your email address, a display name, and whether you signed up as a buyer or an agent. Your password is handled by our authentication provider and is never stored by PropTrust in readable form.

Agents claiming a profile. Agents who claim a listing verify their identity against their CEA registration number, which is checked against the public CEA Salesperson Register — a public record we don't need your permission to reference.

We do not collect payment details, government ID numbers, or precise location data, and we do not use tracking cookies to build advertising profiles.

Enquiry details (name, mobile, message) exist solely to let the agent you contacted get back to you — that's the entire purpose of the form, and it's the purpose we notify you of at the point of collection.

Account details (email, display name, role) exist to let you sign in, save agents, and — if you're an agent — manage a claimed profile and see enquiries addressed to you.

An enquiry you submit is sent only to the one agent it was addressed to (identified by their CEA registration number). It is not shared with any other agent, broadcast to a list, or sold to a third party.

We use Supabase to host our database and handle authentication, which means enquiry and account data passes through Supabase's infrastructure as our data processor. We don't share your data with any other third party, and we never sell personal data.

Enquiries are retained for as long as the agent's profile they were sent to remains active, so the agent keeps a record of who has contacted them. If you'd like an enquiry removed sooner, see “Requesting deletion” below.

Account data is retained for as long as your account exists. If you delete your account, your email, display name, and any saved-agent list are deleted; enquiries you previously sent are handled as described above, since they belong to the conversation history the recipient agent relies on.

To delete your account, or to have a specific enquiry you sent removed, email privacy@keystone.sg from the email address or mobile number the data was submitted under. We'll act on verified requests within 30 days, consistent with PDPA's requirements for access and correction requests.

You can also reach us in writing at the contact address above if email isn't practical for you.

Questions about this policy, or about how your data is handled, can be sent to privacy@keystone.sg. See also our Terms of service.