Version 2026-07-25· Governed by Singapore's Personal Data Protection Act (PDPA)
Before an uploaded PDF is stored, we detect and permanently remove personal identifiers (NRIC/FIN numbers, names, addresses, and similar identifying details) from the file itself — this is genuine removal of the underlying content, not a visual overlay — for every document type except wills.
Will documents are a deliberate, disclosed exception. Our estate cross-reference feature needs to read and store the testator, executor, guardian, and beneficiary details (names, NRIC/Birth Certificate numbers, addresses, relationships) as structured data, so these specific values — together with the verbatim text of each will clause — are extracted before file redaction and stored in our database. This is currently the one place in the app where this class of identity data is retained beyond the uploaded file itself.
These will-related identity fields are encrypted at the application level (AES-256-GCM, a unique key per value) before being written to the database, so a raw database credential or a copy of the database on its own is not enough to read them — only the application, holding the separate encryption key, can. Because this encryption is not searchable-by-design, these fields were never used for search or filtering to begin with.
Date of birth (from your profile, CPF, or SRS details) is also encrypted at the field level the same way, even though it is used directly in CPF/SRS/retirement-scenario calculations — the application decrypts it transparently wherever those calculations need it, so a raw database credential or a copy of the database on its own still cannot read it. Data at rest for anything not listed above as encrypted relies on the security of the underlying hosting and database infrastructure only.
We keep six years of statement history. A document whose data is older than that is deleted automatically, along with everything derived from it — the same permanent deletion described below, run daily rather than requested by you. A document is aged on the period it covers, not on the day you uploaded it, and a statement whose history is already older than six years is refused at upload rather than stored and deleted later.
When you delete a document, you choose a grace period (immediate, one week, two weeks, or one month). During that window you can undo the deletion. Once the grace period ends, the document's data and the stored file are permanently and irrecoverably deleted. We keep an internal record that a deletion happened and when — never the deleted content itself.
Deleting your entire account works the same way, applied to everything associated with it. While an account deletion is pending, signing in only lets you undo the deletion — no other feature is usable until you do.
Withdrawing consent: you can delete any document or your entire account at any time from Settings, as described above.
Access and correction: as of today, there is no self-serve way to view or export everything the app holds about you in one place. To request a copy of your data, or to request correction of inaccurate personal data, email privacy@clariplan.example and we will respond as promptly as we reasonably can. This is a genuine current limitation — we are not claiming a self-serve export feature that does not exist.
When you sign up, you are asked to affirmatively agree to this Privacy Policy and our Terms of Service via an unticked checkbox — consent is never assumed or pre-selected. We record the version of this policy you agreed to and when. If we make a material change to this policy, you will be asked to review and re-consent before continuing to use the app.
We use third-party infrastructure providers (hosting, database, object storage, and email delivery) to operate the service. Personal data may be processed by these providers strictly to provide the service to you — it is never sold, and never used for their own marketing purposes.
Questions about this policy, or requests relating to your personal data, can be sent to privacy@clariplan.example.