Draft — pending legal review

Privacy Notice

Version: draft-2026-10-24. This notice describes the present HERSw pilot and is not a legal certification. The operating legal entity, UEN, business address and Data Protection Officer contact have not yet been supplied. These details and qualified Singapore legal review are required before commercial launch.

What we collect

We collect account details (name, email and authentication information), optional profile and preference information, saved items, bookings, RSVPs and check-in records, enrollments, orders and quotations, concierge requests, community posts and support correspondence. Business onboarding includes legal name, registration number, business contacts, role applications and uploaded verification or legal documents. Please redact unnecessary personal identifiers before upload.

Why

We use this information to administer accounts and memberships; assess business applications and listing claims; provide bookings, orders, delivery quotations, events, introductions and support; maintain consent, audit and accounting records; prevent abuse; and comply with applicable obligations. Optional marketing uses separate consent. Providing information needed for a transaction or verification is necessary to deliver that requested service; optional preferences are not required.

AI discovery

On-demand recommendations send the interests, budget and dates you submit, with relevant catalogue information, to the AI service only after your per-request consent. These discovery preferences are not saved as profile preferences by HERSw. Service-provider processing, logging and retention must be assessed before launch; we do not promise that providers retain nothing. AI recommendations may be inaccurate and do not reserve availability or provide medical, financial or investment advice.

Your choices

• Withdraw marketing consent in Profile & privacy.
• Opt in or out of introductions; business directory participation is separately adult-confirmed and opt-in.
• Business meeting contacts are shared only after both parties consent; either may withdraw platform access to that exchange. Withdrawal cannot recall copies a recipient already lawfully received.
• Request access, correction, export or deletion through Profile & privacy. Requests require identity checks; legal retention and other applicable exceptions may limit deletion.

Sharing

Merchants and business transaction parties receive the information needed for their bookings, quotations or orders. HQ reviews private business documents and applications. Directory users see only the consented business projection, not family/dependent records or private registration documents. HERSw uses service providers for hosting, authentication, storage and AI processing. Payment and carrier integrations are not yet connected; if connected, the notice must be updated before additional disclosures. Lawful disclosures may also be made to regulators or professional advisers where necessary. We do not sell personal data.

Families and minors

Minor household members are guardian-created records without their own login and are excluded from business networking. Adult household invitations and wishlist sharing are optional. Do not upload minors’ identity documents to business verification.

Protection, retention and overseas processing

Access controls restrict private records to relevant account owners, transaction parties and authorised administrators. These controls do not eliminate security risk. Records are retained while needed for their stated purposes, dispute handling or applicable legal obligations; no automatic deletion schedule is currently configured. HERSw must establish a documented retention schedule, provider inventory and overseas-transfer safeguards before launch. Where data is transferred outside Singapore, applicable comparable-protection requirements must be met.

Incidents and changes

HERSw must assess suspected personal-data breaches and make notifications where required by applicable law. Material new purposes will be notified before the affected processing; additional consent will be sought where required. The current pilot notice remains subject to review.

Data Protection Officer

Owner action required: supply the operator’s legal identity, postal address and monitored DPO/privacy email. No contact address has been invented. Until supplied, signed-in users can submit privacy requests through Profile & privacy.

Reference: PDPC data protection obligations. This draft does not claim GDPR or PDPA certification.