Privacy Policy

1. Who we are

MaidCopilot is operated by Coreframes Lab, a sole proprietorship registered in Singapore. When this policy says "we", "us", or "our" it refers to Coreframes Lab.

MaidCopilot is a software-as-a-service platform designed for Singapore maid placement agencies. It provides a shared WhatsApp inbox, biodata management, case tracking, and PDPA compliance tools.

2. What personal data we collect

We collect personal data in the following categories:

Account and workspace data

• Email address and name of agency owners and coordinators
• Agency name, business address, and MOM licence number
• Role assignments and access logs

Employer and maid biodata

• Employer: name, contact number, address, NRIC/FIN (if supplied), household profile
• Maid: name, nationality, passport number, work permit details, skills, work history, references
• Documents uploaded to the platform (PDFs, identification copies)

WhatsApp communication data

• Inbound and outbound WhatsApp message content and timestamps
• Sender phone numbers linked to contact records
• Template sends and delivery receipts

Usage and technical data

• Audit log entries (actions taken, user ID, timestamp)
• Browser type, IP address, and session identifiers

3. Why we collect it (purposes)

• To provide, operate, and improve the MaidCopilot platform
• To enable agencies to manage maid placement cases and WhatsApp communications
• To authenticate users and maintain workspace security
• To generate audit logs that support your agency's PDPA compliance obligations
• To send product and service notifications relevant to your account
• To investigate and resolve support requests
• To meet legal obligations under Singapore law

4. Legal basis for processing

Singapore's Personal Data Protection Act 2012 (PDPA) governs how we handle personal data. We process personal data on the following bases:

• Contractual necessity — to deliver the services you signed up for
• Legitimate interests — to operate and improve the platform, prevent fraud, and maintain security
• Consent — where you or your contacts have provided explicit consent (e.g., via intake questionnaires)
• Legal obligation — to comply with Singapore law, including MOM and PDPA requirements

5. How we share your data

We do not sell personal data. We share data only with the third-party platforms and subprocessors required to operate the service.

Meta Platforms and the WhatsApp Business Platform

We integrate with third-party platforms and services, including Meta Platforms products such as the WhatsApp Business Platform (also known as the WhatsApp Business APIs / WhatsApp Cloud API), to provide messaging, onboarding, communication, and workflow-automation features for our customer agencies.

Inbound and outbound WhatsApp message content, sender phone numbers, message metadata, template send events, and delivery receipts flow through Meta's infrastructure as part of message delivery. Meta processes this data as a separate data controller under its own WhatsApp Business Privacy Policy.

We do not share WhatsApp message content, contact information, or biodata with advertising networks or any third party for marketing purposes. We use the WhatsApp Business Platform strictly in accordance with Meta's Platform Terms and the WhatsApp Business Solution Terms.

Other subprocessors

• Supabase (AWS ap-southeast-1) — database and file storage, Singapore region
• Railway (Singapore) — backend application hosting
• Vercel — frontend CDN and edge functions

Each subprocessor (including Meta) is bound by a Data Processing Agreement and is required to maintain appropriate security measures. A full list of subprocessors is published at /legal/subprocessors.

We may also disclose data if required to do so by law, court order, or a competent Singapore authority.

6. Data residency and transfers

All primary data (database, file storage) is stored in AWS ap-southeast-1 (Singapore). Meta's WhatsApp Cloud API processes message content on Meta's infrastructure, which may include servers outside Singapore. Meta is certified under applicable data transfer frameworks.

We take steps to ensure that any cross-border transfers are governed by appropriate contractual safeguards as required under the PDPA.

7. How long we keep your data

• Account and workspace data — retained while your subscription is active and for 90 days after termination
• Maid and employer biodata — retained for the duration you hold it, plus 5 years after case closure (aligned with MOM record-keeping guidance)
• WhatsApp message logs — retained for 2 years
• Audit logs — retained for 5 years
• Backups — purged within 30 days of account deletion

You may request earlier deletion of specific records subject to our legal obligations.

8. Security

We apply the following technical and organisational measures to protect your data:

• Row-Level Security (RLS) — each agency's data is isolated at the database layer
• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Magic-link authentication — no passwords stored
• HMAC-verified inbound webhooks
• Role-based access control (Owner and Coordinator roles)
• Audit logging of all material data changes

In the event of a data breach that affects your personal data, we will notify you within 3 business days of becoming aware, in accordance with PDPA obligations.

9. Your rights

Under Singapore's PDPA, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data by emailing admin@coreframeslab.com. We will delete your data subject to any legal retention obligations and the retention periods described in Section 7
• Withdrawal of consent — withdraw consent where processing is consent-based
• Data portability — receive your data in a machine-readable format (where technically feasible)

To exercise any of these rights, contact our Data Protection Officer at admin@coreframeslab.com. We will respond within 30 days.

10. Cookies and tracking

MaidCopilot uses only functional cookies necessary to maintain your authenticated session. We do not use advertising cookies or third-party tracking pixels. No analytics service is currently deployed.

11. Children

MaidCopilot is a business-to-business platform and is not directed at individuals under 18. We do not knowingly collect personal data from minors.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify account owners by email and update the "Last updated" date at the top of this page. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

13. Contact — Data Protection Officer

If you have any questions regarding this Privacy Policy or your data, please contact us at admin@coreframeslab.com.

Questions, requests, or complaints about how we handle personal data should be directed to:

If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.