Heymate Privacy Policy
Effective date: 27 July 2026 · Last updated: 14 August 2026
1. Introduction
This Privacy Policy explains how Heymate Pte. Ltd. ("Heymate", "we", "us", "our"), UEN 202221326D, collects, uses, discloses, and protects your personal data when you use the Heymate platform, website, and mobile applications (collectively, the "Platform"). It is issued in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA").
By creating an account or using the Platform, you acknowledge that you have read and understood this Policy. Where we rely on your consent, we will make that clear at the point of collection.
2. What is personal data
"Personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data and other information we have or are likely to have access to. This includes obvious identifiers like your name and contact details, and can include your account and usage information.
3. Personal data we collect
We collect different data depending on how you use the Platform.
All users
- Name, email address, mobile number
- Account credentials
- Profile photo (optional)
- Communications you send us or other users through the Platform
Tenants / room-seekers
- Budget, preferred locations, move-in timing
- Lifestyle and housemate preferences (e.g. sleep schedule, cleanliness, pets, smoking, gender preference where lawfully applicable) used to power our matching filters
- Occupation or student status, and nationality/residency status where relevant to a listing's eligibility
Landlords / room providers
- Property address and unit details, rental terms, photos, and listing content you provide
- Payment or payout details where applicable
- Evidence of ownership or authority to let, if we request it
Property agents
- CEA registration number and registered agency details, which we verify against the CEA Public Register at signup
- Listing and transaction-related information you submit
Collected automatically
- Device, browser, and IP information
- Usage data (pages viewed, searches, clicks, referral source)
- Cookies and similar technologies, including analytics identifiers (see Section 8)
Identity verification (all users)
At signup, tenants and landlords provide the basic account information above. Where applicable, we verify identity through Singpass, Singapore's national digital identity service. Where you consent to retrieve verified details via Myinfo, we receive only the specific fields authorised on the Myinfo consent screen:
- For tenants: name, date of birth, sex, nationality, employment sector, and — where applicable — pass type, pass status, and pass expiry date.
- For landlords verifying HDB ownership: HDB ownership address and ownership type.
- For property agents: name, CEA registration, company name and job title.
We do not request or receive your NRIC or FIN number through Singpass or Myinfo verification. Authentication is performed entirely through Singpass; we never see or store your Singpass password.
Provisional accounts (manual verification)
Where you are unable to complete Singpass verification at signup — for example, if you are a foreign user who has not yet arrived in Singapore or been issued the credentials required for Singpass — you may register for a provisional account pending manual verification. For this purpose we collect the identity and supporting documents we request, which may include a copy of your passport or other government-issued identity document and evidence of your immigration or residency status. We use these documents solely to verify your identity and to decide whether to approve, limit, or maintain your provisional account, and we handle and retain them in accordance with Section 10.
Verification documents
Where a landlord does not verify ownership via Singpass, we may instead request a property ownership or tenancy document as proof of authority to let. We treat these as sensitive, use them solely for verification and fraud prevention, restrict internal access, and never display them to other Users. We retain them for 12 months after the listing is removed or the account is closed, then securely delete them.
Payment data
Where payments or credit top-ups are made through the Platform, they are made by PayNow using the QR code displayed at checkout. Heymate does not collect or store your card or bank account details; we receive only the payment and transaction reference information needed to confirm and reconcile your payment.
4. How we collect personal data
We collect personal data when you register, complete your profile, create or respond to a listing, message other users, contact support, or interact with the Platform. We also collect data automatically through cookies and analytics tools, and we may receive data from third parties such as agents who list on your behalf or login providers you choose to use.
5. Purposes for collection, use, and disclosure
We collect, use, and disclose your personal data for the following purposes:
- To create and manage your account and verify your identity
- To operate our core matching service — presenting relevant listings, housemates, or tenants based on your preferences and filters
- To enable communication between tenants, landlords, and agents
- To process transactions, payments, or payouts where applicable
- To provide customer support and respond to enquiries
- To maintain the safety, security, and integrity of the Platform, and to detect and prevent fraud, misuse, or prohibited activity
- To send you service-related communications (e.g. account, listing, and match notifications)
- To send you marketing communications where you have consented (see Section 7)
- To analyse and improve the Platform, our features, and our marketing (see Section 8)
- To comply with applicable laws and respond to lawful requests from authorities
Where required, we rely on your consent. In some cases we may rely on deemed consent or an applicable exception under the PDPA (for example, the legitimate interests or business improvement provisions), and we will do so only within what the PDPA permits.
Automated matching. Our matching filters use automated processing to highlight listings, housemates, or tenants that fit your stated preferences. This is to help you find relevant options; it does not make any decision that produces a legal or similarly significant effect on you, and you remain free to choose which Listings or Users you contact or deal with.
6. Disclosure of personal data
We may disclose your personal data to:
- Other users, as necessary to provide the service — e.g. sharing a tenant's relevant profile details with a landlord or agent when you express interest in a listing, and vice versa. We share only what is reasonably needed to facilitate the connection. Users who receive your contact details or other personal data through the Platform are required, under our Terms of Service, to use that data only for the rental-related purpose for which it was shared and to comply with the PDPA; misuse — including unsolicited marketing, disclosure to third parties, or building databases — is prohibited and may result in account termination.
- Service providers who support our operations — including cloud hosting (Google Cloud Platform / Firebase), messaging (Twilio, for WhatsApp notifications), analytics (Google Analytics), and rental-related service providers such as cleaning, maintenance, moving, and repair services. Where you request or book such a service through the Platform, we share only the personal data needed to fulfil it (e.g. your name, contact number, and service address). All providers are bound by contractual obligations to protect your data.
- Professional advisers, authorities, or regulators where required by law or to protect our rights, users, or the public.
- A successor entity in connection with a merger, acquisition, or business transfer.
We do not sell your personal data. While we use analytics services that involve sharing limited data as described in Section 8, we do not sell your personal data to third parties for their own independent marketing.
7. Marketing communications
Where you have given consent, we may send you marketing messages about Heymate features, promotions, and relevant listings by email, SMS, or in-app notification. You can withdraw consent or unsubscribe at any time using the opt-out link in the message or by contacting our DPO.
If you send us messages via channels covered by the Do Not Call provisions, we will only send telemarketing messages to your Singapore number where you have given clear consent or as otherwise permitted under the PDPA.
9. Transfers of personal data outside Singapore
Some of our service providers store or process personal data outside Singapore — for example, Google Cloud Platform (which hosts our Firebase infrastructure) and Twilio (WhatsApp messaging), which may process data in the United States and other locations. Where we transfer personal data overseas, we take steps to ensure the recipient is bound to provide a standard of protection comparable to the PDPA, through contractual safeguards such as standard contractual clauses, the provider's own recognised certifications, or other means the PDPA permits.
10. Retention
We retain personal data only for as long as necessary to fulfil the purposes above or as required by law:
- Active account data is kept while your account is open.
- Inactive accounts are anonymised or deleted after 24 months of inactivity.
- Identity-verification documents for provisional accounts (such as passport or immigration documents) are kept only for as long as necessary to complete and evidence verification, and are then securely deleted or anonymised.
- Transaction records are kept for 5 years, to meet our record-keeping obligations under the Income Tax Act and Companies Act.
When data is no longer needed, we delete or anonymise it.
11. Protection of personal data
We implement reasonable administrative, technical, and physical safeguards to protect personal data against unauthorised access, use, disclosure, or loss — including encryption in transit (SSL/TLS), access controls, and regular reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
In the event of a data breach that is assessed to be notifiable under the PDPA — that is, a breach that results in or is likely to result in significant harm to affected individuals, or that affects the personal data of 500 or more individuals — we will notify the Personal Data Protection Commission (PDPC) as soon as practicable, and in any case no later than three (3) calendar days after we assess the breach to be notifiable. We will notify affected individuals as soon as practicable where the breach is likely to result in significant harm to them, unless an exception under the PDPA applies.
12. Your rights
Under the PDPA, you may:
- Access the personal data we hold about you and information on how it has been used or disclosed
- Correct any inaccurate or incomplete personal data
- Withdraw consent for the collection, use, or disclosure of your personal data, on reasonable notice (this may affect our ability to provide the service to you)
To exercise these rights, contact our DPO (Section 13). We may need to verify your identity and may charge a reasonable fee for access requests as permitted under the PDPA. We will respond within the timelines required by law.
13. Data Protection Officer
Our Data Protection Officer is responsible for overseeing our data protection practices and handling your queries and requests:
Data Protection Officer, Heymate Pte. Ltd. — Email: enquiry@heymate.com.sg — 10 Anson Road, #22-02, Singapore 079903
14. Third-party links
The Platform may contain links to third-party websites or services (e.g. an agent's page or a payment provider). This Policy does not apply to those third parties, and we encourage you to review their own privacy policies.
15. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified through the Platform or by email. The "Last updated" date reflects the most recent revision. Continued use of the Platform after changes take effect constitutes acceptance.
16. Governing law and contact
This Policy is governed by the laws of Singapore. If you have questions, complaints, or requests, contact our DPO at enquiry@heymate.com.sg. We aim to acknowledge your query or complaint within 3 business days and to resolve it within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC).
Also see our Terms of Service.