Privacy Policy

Effective date: 9 July 2026 · Last updated: 10 November 2026

This Privacy Policy explains how HomeAuto Solutions Pte Ltd (UEN 202014984H) ("Claify", "we", "us", "our") collects, uses, discloses, and protects personal data when you use the Claify accounting platform at claify.homeauto.sg and related services (the "Service"). We are committed to complying with the Singapore Personal Data Protection Act 2012 ("PDPA") and, where applicable, the EU General Data Protection Regulation ("GDPR").

1. Data we collect

Account data

• Name and email address (including via Google sign-in, if you choose it)
• Password (stored only as a cryptographic hash — we never see or store your plain password)
• Business name, GST registration status, and organisation settings

Support requests

• When you contact us through the support page: your name, email address, the subject and text of your message, any file you attach, and our replies. Please do not send NRIC/FIN, bank or card numbers or passwords. We keep support requests for 2 years after they are resolved.

Business and financial data you enter

• Contacts (your customers and vendors): names, emails, addresses
• Quotations, invoices, payments, receipts, and journal entries
• Bank transaction data you import (e.g. CSV exports from DBS, OCBC, UOB) or that a connected bank feed delivers
• Documents you upload (e.g. receipts and supporting files)

Data from connected accounting platforms

If you connect a third-party accounting platform such as Xero or QuickBooks Online, we access the accounting data you authorise strictly to provide the Service. From QuickBooks Online we read your chart of accounts, customers and vendors, and open invoices and bills, and we write draft bills that you have asked Claify to create (for example from a scanned receipt); we do not read payroll, payment card, or banking credentials held by the platform. Connection tokens are encrypted at rest with AES-256-GCM and are used only to make the calls you have authorised. You can disconnect a platform at any time from Settings, which stops all further access; you can also revoke Claify from within the platform itself. Data already copied into Claify remains in your organisation until you delete it.

Data from connected bank accounts

If you connect a bank account (OCBC, DBS or UOB), Claify receives statement lines for the accounts you nominate: date, description, amount, and the bank's reference. We never see or store your internet banking password. Depending on the bank, access uses either a login you complete at the bank (OCBC), which issues Claify a short-lived token, or application credentials and a certificate that your company obtains from the bank (DBS, UOB). Tokens and credentials are encrypted at rest with AES-256-GCM. You can remove a bank feed at any time from Bank Accounts.

Data processed by AI features

Some features use a large language model provided by Anthropic (Claude): reading receipts you upload, suggesting an account for a bank transaction, and answering questions you ask Maya, our finance assistant, about your books. Only the content needed for the task is sent (for example the receipt image, or the transaction description and your chart of accounts). Anthropic processes this data under its commercial API terms: it does not use it to train its models and retains it only for a limited period (currently up to 30 days) for abuse monitoring. Claify keeps a record of each AI suggestion and whether you accepted it, so we can report accuracy to you. AI features never change your ledger on their own: every posting, match or settlement happens only after you confirm it.

Data processed by the Telegram bot (optional)

If your organisation's owner connects its own Telegram bot (a paid-plan feature), the messages your team sends to that bot are processed by Telegram, which provides the messaging service, and by Claify, which reads them so it can draft quotations for you.

The text, images and PDFs sent to the bot are passed to the AI model that your organisation chose and configured, using your organisation's own API key. Claify does not supply the model for this feature. That provider is your organisation's own service provider, not a Claify sub-processor in the usual sense, but it receives whatever your staff send, so you are responsible for choosing a provider whose terms suit you. Images and screenshots are included when staff send them, and a payment screenshot can show bank details, so send only what you are comfortable sharing with that provider. For PDFs, the text inside the PDF (not the file itself) is sent to the model, and scanned PDFs without text cannot be read.

• The bot token and the model API key are stored encrypted in a secrets vault.
• The chat history stores the text of staff messages and of the bot's replies (up to 4,000 characters each, the last 12 messages) so the conversation works. Claify also stores each linked person's Telegram user ID and chat ID against their Claify user.
• A pending draft quotation stores its full content: customer name, line items, prices and notes.
• The bot ignores chat history and pending drafts older than 2 hours. They stay stored until replaced by newer messages, or until the bot is disconnected or the organisation is deleted. Claify does not store the images or PDFs sent to the bot.

Only people the organisation owner has linked can use the bot, and the owner can remove their access at any time. The bot creates a draft quotation only after the user taps a confirm button, and it never emails your customers.

Payment data

Card and payment processing is handled by Stripe. We do not receive or store your full card details — we receive only confirmation of payment and limited metadata (e.g. amount, status, reference).

Technical data

• Log data: IP address, browser type, pages visited, timestamps
• Cookies strictly necessary to keep you signed in and secure the Service, plus your language and theme preference
• On our public pages only (home page, blog, sign-in, sign-up and legal pages): visit statistics collected through Google Analytics 4, such as pages viewed, referring site, browser, device and approximate location
• An audit trail of changes to your accounting records (who did what, and when), and plan usage counts (e.g. number of AI uploads this month)

2. How we use your data

• To provide, operate, and maintain the Service (invoicing, accounting records, GST computation, reports)
• To send transactional emails you initiate or configure (e.g. invoices, receipts, overdue payment reminders) via our email provider
• To authenticate you and secure your account (including optional two-factor authentication)
• To process payments and subscriptions
• To respond to support requests
• To comply with legal obligations, including Singapore tax and accounting record-keeping requirements

We do not sell your personal data. We do not use your accounting data for advertising.

3. Who we share data with

We share data only with service providers needed to run the Service:

We may also disclose personal data where required by law, regulation, or a valid request from a public authority.

4. Where your data is stored

Your account and accounting data are stored in Supabase's Singapore region (ap-southeast-1). Where a provider processes data outside Singapore, we ensure a comparable standard of protection as required by the PDPA's transfer limitation obligation.

5. How we protect your data

• Encryption in transit (TLS) for all connections
• Encryption at rest for stored data; third-party platform tokens encrypted with AES-256-GCM
• Row-level security so each organisation can only access its own records
• Passwords and API keys stored as cryptographic hashes (bcrypt)
• Optional two-factor authentication (TOTP)
• Private, access-controlled document storage

6. How long we keep your data

We retain your data for as long as your account is active. Accounting records may be retained for up to 5 years after the relevant financial year, consistent with Singapore statutory record-keeping requirements (e.g. under the Income Tax Act and GST Act), even after account closure. When you delete an organisation, its live data is removed immediately and a single encrypted snapshot is retained for 30 days solely so we can restore it if the deletion was a mistake, after which it is purged. Other personal data is deleted or anonymised within a reasonable period after your account is closed.

7. Your rights

Under the PDPA (and the GDPR, where it applies), you may:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete personal data
• Withdraw consent to our collection, use, or disclosure of your personal data
• Request deletion of your account and associated personal data (subject to legal retention requirements)
• Export your accounting data

You can exercise most of these yourself: Settings → Export downloads your accounting data (CSV, Excel, XML), Settings → Organisation lets the owner delete the organisation and every document in it, and Settings → Security deletes your login.

For anything else, contact our Data Protection Officer at dpo@homeauto.sg. We will respond within the timeframes required by the PDPA.

8. Cookies

Inside the signed-in Service we use only cookies that are strictly necessary for it to function (session authentication and security) and two preference cookies for your chosen language and theme. On our public pages (home page, blog, sign-in, sign-up and legal pages) we also use Google Analytics 4, which sets analytics cookies (such as _ga) and sends visit statistics to Google to help us understand how the site is used. We do not run Google Analytics inside the signed-in Service, and we do not use advertising features or advertising cookies. A notice on those pages lets you decline analytics, and your choice is remembered in a cookie. You can also block analytics cookies in your browser settings or with Google's opt-out browser add-on.

9. Children

The Service is intended for business use and is not directed at individuals under 18. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email. The "Last updated" date above reflects the latest revision. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact us

Data Protection Officer
HomeAuto Solutions Pte Ltd (UEN 202014984H)
Email: dpo@homeauto.sg
General support: claify.homeauto.sg/support