Privacy Policy

1. Who we are

Website.sg is a review-generation service that helps Singapore businesses ask their customers for feedback by WhatsApp, and invite happy customers to leave a public review. It is run by Shaminder Tech (UEN 53524745A), a sole proprietorship registered in Singapore. In this policy, “we”, “us” and “our” mean Shaminder Tech, and “client” means a business that uses Website.sg.

2. Our two roles

The PDPA treats an organisation differently depending on whose data it is handling and why. We act in two different roles, and this policy covers both.

(a) Website visitors and prospective clients — we are responsible for the data

If you visit website.sg, fill in our enquiry form, or message us to ask about the service, Shaminder Tech decides why and how your personal data is used. We are the organisation responsible for it under the PDPA.

(b) Customers of our clients — we act as a data intermediary

If you are a customer of a business that uses Website.sg — for example you receive a WhatsApp message asking how your visit went, you give a rating, you leave feedback, or you chat with that business’s chatbot — we process your personal data on that business’s behalf and on its instructions. In the language of the PDPA, we are a “data intermediary” and the client business is the organisation responsible for your data. That business is responsible for having a proper basis (including your consent, where required) to contact you, and for answering most requests about the relationship it has with you. We still protect the data we hold for them, keep it only as long as needed, and tell the client without undue delay if we find a data breach affecting it.

If you want to exercise your rights over data a business collected about you, please contact that business first. We will help the business respond, and if you are not sure who the business is, tell us and we will help you find out.

3. The personal data we handle

Depending on your role, we handle some or all of the following:

• Identity and contact details: name, mobile or WhatsApp number, and email address.
• Ratings and feedback: the star rating or score you give, and any comments you write.
• Message content and metadata: the content of WhatsApp messages you exchange with us or with a client’s automated chatbot, and message metadata such as timestamps, delivery and read status, and opt-out (STOP) records.
• Enquiry form details: business name, your name, email, phone, website, business type, the package you are interested in, any message you write, and a record that you agreed to be contacted.
• Basic technical data: IP address, browser and device type, and request logs, used to keep the service secure and to limit spam and abuse.

We do not ask for NRIC numbers, payment card details, or other sensitive information through the review flow. Please do not include them in feedback or messages.

4. Why we use personal data

We use personal data only for purposes a reasonable person would consider appropriate, namely:

• Prospects and visitors: to reply to your enquiry, discuss and set up the service, contact you about Website.sg (with your agreement), and keep basic records of our dealings.
• Customers of clients: to send the review requests and follow-up messages the client has asked us to send; to record your rating and feedback and show it to the client; to invite you to leave a public review on a platform such as Google where that is appropriate; to route unhappy feedback privately to the client so it can put things right; and to operate the client’s chatbot and draft replies.
• Everyone: to run, secure, troubleshoot and improve the service; to detect and prevent spam, fraud and misuse; to comply with the law; and to establish or defend legal claims.

We do not sell personal data. We do not use the personal data of a client’s customers for our own marketing, and we do not use it for any purpose other than providing the service to that client.

5. WhatsApp and other messages

Review requests and chatbot conversations are sent over WhatsApp using Meta’s WhatsApp Business Platform, through messaging providers we work with. WhatsApp and Meta have their own terms and privacy practices that apply to messages sent over their network.

Clients must have a proper basis to message their customers, including consent where the law requires it, and must not use the service to send unsolicited marketing. Messages we send for a client identify the business that is asking for your feedback.

You can stop messages at any time by replying STOP to any message. We will record your opt-out and stop sending you further messages through Website.sg. You can also withdraw your consent by contacting the business that messaged you or by contacting us (see section 11). Withdrawing consent does not affect anything done before you withdrew, and we may keep a minimal record of your opt-out so that we do not message you again. Depending on what you ask us to stop, we will tell you if it may affect what we can do for you.

6. Who we share data with

We use trusted service providers to run Website.sg. They may process personal data only for the purposes of providing their service to us, and we require appropriate protection from them. The categories are:

• CRM and marketing-automation platform (we use HighLevel) to store contacts, run conversations, and run automations and workflows.
• Messaging providers that connect us to WhatsApp and other messaging channels.
• Cloud hosting (we use Vercel) to host this website and its application code.
• AI language-model providers used to draft replies and power chatbots. Message content and feedback may be sent to these providers to generate a response; we do not permit them to use it to advertise to you.
• Email delivery providers to send and receive email.

We also share data with the client business whose customer you are (they see your ratings, feedback and conversations), and with professional advisers, insurers, courts, regulators or law enforcement where we are required or permitted by law to do so. If our business were ever sold or restructured, personal data may be transferred to the new owner on terms that keep it protected.

7. Transfers outside Singapore

Some of our providers store or process data outside Singapore, for example in the United States or Europe. Before we transfer personal data overseas, we take reasonable steps to make sure the recipient gives it a standard of protection comparable to the PDPA, as the PDPA’s transfer limitation obligation requires. We do this mainly through contractual terms with our providers, and by choosing providers that publish recognised security and privacy commitments. You can ask us for more information about these safeguards using the details in section 11.

8. How long we keep data

We keep personal data only as long as we need it for the purposes above or for legal or business reasons.

• Client data (including customer lists, ratings, feedback and conversations) is kept while the client’s account is active. After the client’s contract with us ends, we keep it for up to 90 days so the client can request an export, and then we permanently delete it, unless the law requires us to keep it longer.
• Enquiry form details are kept for as long as we are in discussions with you and for a reasonable period afterwards, and are deleted or anonymised when we no longer need them.
• Opt-out records may be kept for longer, in minimal form, so that we respect your choice.
• Technical logs are kept for a short period for security and troubleshooting.

9. Security

We take reasonable security steps to protect personal data, including access controls, encrypted connections, separating each client’s data, and limiting who can see it. No online service is completely secure. If a data breach is likely to cause significant harm, or affects a large number of people, we will assess it promptly and notify the client, the Personal Data Protection Commission (PDPC) and affected individuals as the PDPA requires.

10. Cookies

We keep cookies and similar technologies to a minimum. This website uses only what is needed to load pages and keep the site secure, and we do not use advertising or cross-site tracking cookies. If we add analytics or other cookies in future, we will update this policy. Third-party platforms that you choose to visit from our pages (such as Google or WhatsApp) may set their own cookies under their own policies.

11. Access, correction and withdrawing consent

Under the PDPA you may:

• ask for a copy of the personal data we hold about you and how it has been used or disclosed;
• ask us to correct personal data that is inaccurate or incomplete; and
• withdraw your consent to our collecting, using or disclosing your personal data.

To make a request, or to reach our Data Protection Officer, please email hello@website.sg, WhatsApp us on +65 8064 4822, or use our contact form. We may need to verify your identity, and we will respond within 30 days or tell you if we need longer. We may charge a reasonable fee for access requests, and we will tell you the amount first. In some cases the law lets or requires us to refuse a request, and we will explain why.

For data that a client business collected about its own customers, we may pass your request to that business or ask you to contact it directly.

12. Children

Website.sg is a business service and is not aimed at children. We do not knowingly collect personal data from anyone under 13 for our own purposes. If you are a parent or guardian and believe a child has given us personal data, please contact us and we will delete it. Clients are responsible for not using the service to message children without appropriate consent.

13. Changes to this policy

We may update this policy from time to time, for example when our providers or the law change. The “Last updated” date at the top shows when it last changed (21 September 2026). If we make a significant change, we will take reasonable steps to let you know, such as a notice on this page.

14. Complaints

If you have a concern about how we handle personal data, please contact us first, using the details above, so we can try to put it right. If you are not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.