Privacy Policy

A note on how to read this page: we've written this to describe what actually happens today, including the parts we're still fixing — not as a list of promises. Where something isn't in place yet, we say so explicitly rather than implying it's already handled.

1. Who we are

REFRAME is operated by Whitewords Pte Ltd (UEN: 200308025Z), a Singapore company. We operate the website at reframeasia.com (the "Platform").

For privacy enquiries, contact us at dpo@reframeasia.com.

2. Our Data Protection Officer

Our designated Data Protection Officer is Jacke Tan at Whitewords Pte Ltd, reachable at dpo@reframeasia.com. Contact the DPO for any question about how your personal data is collected, used, or protected, or to make an access, correction, or deletion request under Section 10 below. We will respond within 30 days.

3. What we collect

We collect the following personal data when you use the Platform:

• Account data: your name, email address, and password when you register
• Profile data: caregiving situation, Singapore district, and other optional profile information you provide
• Community data: posts, replies, and reviews you submit
• Enquiry data: name, email, phone number, and message when you contact a provider through the Platform
• Situation descriptions: free-text descriptions you type into Smart Intake or Smart Plans to describe your or a loved one's situation — this can include health or caregiving detail you choose to share
• Usage data: pages visited and server logs kept by our hosting provider (see Section 11 — we do not currently use a separate analytics or tracking tool)
• Payment data: billing information for Premium memberships (processed by Stripe — we do not store card details)

4. Why we collect it

• To operate the Platform and provide the services you request
• To match you with relevant providers, subsidies, and community resources
• To send transactional emails (account confirmation, enquiry confirmations, review updates)
• To improve the Platform based on usage patterns
• To comply with legal obligations

We're aware that some of our forms don't yet explain this purpose at the point you're asked for the information — right now the fuller explanation lives here, in this policy, rather than inline at each question. We consider this a gap we're working to close, not something to leave unaddressed.

5. Who we share it with

We do not sell your personal data. We do not share it with advertisers. We share it only with:

• Service providers: Supabase (database), Vercel (hosting), Stripe (payments), Resend (transactional email) — bound by data processing agreements
• Anthropic: if you use Smart Plans ("reFrame My Life" or "reFrame Care"), the situation text you enter is sent to Anthropic's API to generate your plan. See Section 8 for detail on this specific data flow
• The provider you contact: if you submit an enquiry to a provider through the Platform, we share your name, email address, and message with that provider — and your saved situation summary too, if you reached the enquiry form via Smart Intake. We do not forward your phone number to the provider by email; see Section 6 for the full detail
• Law enforcement: where required by Singapore law

6. Directory enquiries — what a provider actually sees

When you enquire about a provider, the provider receives, by email: your name, your email address, and the message you typed. If you reached the enquiry form after using Smart Intake, your saved REFRAME situation summary is included in that same email too. Your phone number is not included — it's recorded in our system but only reaches the provider if they contact you back through the details you gave them.

7. Smart Intake, Smart Plans, and automated matching

Smart Intake (the "tell us what's happening" matching on our Find Help page) runs on REFRAME's own rule-based logic against our own database. It does not call a third-party AI provider.

Smart Plans is different. When you use "reFrame My Life" or "reFrame Care," the situation text you type — up to 2,000 characters, which can include health or caregiving detail — is sent to Anthropic (the maker of Claude) to generate your personalised plan. We do not have a Zero Data Retention agreement with Anthropic in place today. Anthropic's standard commercial terms state they do not train models on API customer data, but may retain request data for a limited period for safety and abuse-monitoring purposes. We are reviewing whether to pursue a Zero Data Retention agreement or to change what reaches the API; we will update this section — and correct any past statement that no third-party AI provider is used — as that work progresses, not after the fact.

REFRAME does not store your Smart Plans situation text or the resulting plan on our own servers — it's kept only in your browser for that session, until you create an account and choose to keep a copy.

8. How and where we store it

Your data is stored using Supabase's managed database infrastructure and served via Vercel's hosting platform, both of which encrypt data in transit and at rest as part of their own infrastructure. Both are cloud services, which means your data may be stored or processed outside Singapore.

Both Supabase and Vercel have published Data Processing Agreements that use Standard Contractual Clauses (SCCs) as their mechanism for cross-border transfers: Supabase's DPA (Clause 12.1) applies the SCCs to any transfer of customer data to Supabase, and Vercel's DPA (Schedule 3, Cross Border Data Transfer Mechanism, together with Schedule 5, the UK IDTA) does the same for transfers from the UK, EEA, and Switzerland. SCCs are a contractual mechanism intended to hold the receiving party to a comparable standard of data protection regardless of location. This describes the mechanism our vendors have in place, not a legal determination that our own use of them satisfies the PDPA's Transfer Limitation Obligation — we have not separately sought independent legal certification of that beyond what these vendors publish.

9. How long we keep it

• Account data: retained until you request deletion
• Reviews and community posts: retained even after account deletion (anonymised to "Deleted member")
• Enquiry contact record (name, email, phone, which provider, when): retained for 3 years
• Enquiry message and situation summary specifically: cleared after 90 days — the contact record above is kept for 3 years, but the free-text content is removed once the provider has had a reasonable window to respond
• Smart Intake situation text (the `intake_sessions` table): deleted after 12 months if the submission wasn't linked to an account, or 24 months if it was
• Usage data (server logs): 12 months

These four are enforced by an automated monthly purge job, added September 2026. Before then, this data had no deletion schedule.

10. Your rights under PDPA

As a Singapore resident, you have the right to:

• Access your personal data (request a JSON export from Account Settings)
• Correct inaccurate data (via Account Settings or by emailing us)
• Delete your account (your profile data is deleted; community contributions are anonymised)
• Withdraw consent for marketing communications (unsubscribe link in every email)

To exercise these rights, email our Data Protection Officer at dpo@reframeasia.com. We will respond within 30 days.

11. Cookies

We use only essential cookies — set by Supabase — to keep you logged in. We do not currently use analytics, advertising, or tracking cookies of any kind, so we do not show a cookie consent banner: there is nothing non-essential to ask you to accept or decline. If we add an analytics or tracking tool in future, we will add a real consent choice before that tool goes live, not after. See our Cookie Policy for the full list.

12. Security

We use industry-standard security measures including encrypted storage, HTTPS, and access controls, including database-level row security policies that restrict who can read which records. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.

13. What we're still working on

In the interest of describing what actually happens today rather than what we intend, three things aren't fully resolved yet:

• We don't have a Zero Data Retention agreement with Anthropic for Smart Plans (Section 7) — Anthropic's standard terms apply instead
• Our transfer safeguards (Section 8) rely on Supabase's and Vercel's own DPAs; we haven't sought independent legal certification that this fully satisfies the PDPA's Transfer Limitation Obligation
• Several of our forms don't yet explain, at the point of collection, why we're asking for the information (Section 4) — the fuller explanation currently lives only in this policy

We'll update this section as each of these closes, rather than removing the item quietly.

14. Changes to this policy

We will notify registered users by email if we make material changes to this policy.