Privacy Policy

Haylo Community App — Last updated: 26 April 2026

10tacle Pte Ltd ("Haylo", "we", "us", or "our"), a company incorporated in Singapore (UEN: [INSERT UEN]), operates the Haylo Community mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use the App.

This policy is designed to comply with the Personal Data Protection Act 2012 (PDPA) of Singapore, Apple's App Store Guidelines, and Google Play Developer Policies.

By using the App, you consent to the practices described in this policy. If you do not agree, please do not use the App.

1. Data We Collect

1.1 Information You Provide

Data Type	Purpose	Required
Full name	Account identification; displayed to management and intercom callers	Yes
Mobile phone number	Account registration, OTP verification, call forwarding	Yes
Email address	Account communication, password recovery	Yes
Unit and community details	Linking your account to your residential unit(s)	Yes
Face photograph	Face recognition for hands-free gate access	Optional
Vehicle plate number(s)	Vehicle registration for drive-in gate access	Optional
Visitor details (name, plate, visit time)	Creating visitor passes on your behalf	Optional
Family member phone numbers	Call forwarding for video intercom	Optional

1.2 Information Collected Automatically

Data Type	Purpose
Device information (model, OS version)	App compatibility, troubleshooting
Push notification tokens	Delivering intercom call alerts and notifications
IP address	Security, fraud prevention
Gate access logs (timestamp, gate ID)	Security audit trail for your community
App usage analytics	Improving app performance and features

1.3 Camera and Microphone

The App requests camera access for QR code scanning and face photo capture. Microphone access is used during video intercom calls. These permissions are requested at the time of use and can be revoked in your device settings at any time.

1.4 Location Data

The App does not collect continuous background location data. Limited location information may be inferred from IP address for security purposes (e.g., detecting unusual access patterns).

2. How We Use Your Data

We use your personal data for the following purposes:

Providing and operating gate access, video intercom, and visitor management services
Verifying your identity and linking you to your residential unit(s)
Processing face recognition for hands-free gate access (when you opt in)
Matching vehicle plate numbers for drive-in access
Delivering push notifications for intercom calls and visitor arrivals
Creating and sharing visitor passes as directed by you
Maintaining security audit logs for your community
Communicating with you about your account, service updates, or support
Improving the App's features, reliability, and user experience
Complying with legal obligations

3. How We Share Your Data

We do not sell your personal data. We may share your data with the following parties:

3.1 Your Community Management

Your name, unit, vehicle registration, and access logs are shared with the management body of your residential community for security administration purposes. This is a core function of the service.

3.2 Service Providers

We engage trusted third-party service providers who process data on our behalf:

Cloud hosting — Amazon Web Services (AWS), Singapore region
Push notifications — Apple Push Notification service (APNs), Google Firebase Cloud Messaging (FCM)
SMS/OTP delivery — Third-party SMS gateway providers

These providers are contractually obligated to protect your data and use it only for the services we engage them to perform.

3.3 Visitors

When you create a visitor pass, the visitor receives a link containing only the information necessary for entry (community name, visit date/time, and a QR code). Your personal details are not disclosed to the visitor through the pass.

3.4 Legal Requirements

We may disclose your data if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of Haylo, our users, or the public.

4. Data Retention

Account data — Retained while your account is active. Upon account deletion, personal data is deleted within 30 days, except where retention is required by law.
Access logs — Retained for up to 24 months for security audit purposes, in accordance with your community management's requirements.
Face recognition data — Deleted within 7 days of you withdrawing consent or deleting your enrolment from the App.
Visitor pass data — Automatically purged 90 days after the visit date.
Video intercom recordings — The App does not record intercom calls. Calls are real-time only.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit (TLS 1.2+) and at rest
Secure authentication with OTP verification
Access controls limiting data access to authorised personnel
Regular security reviews of our infrastructure

While we take reasonable steps to protect your data, no system is completely secure. We cannot guarantee the absolute security of your information.

6. Your Rights

Under the PDPA and applicable laws, you have the right to:

Access — Request a copy of the personal data we hold about you.
Correction — Request correction of inaccurate or incomplete data.
Withdrawal of consent — Withdraw consent for specific data processing (e.g., face recognition). This will not affect the lawfulness of processing performed before withdrawal.
Deletion — Request deletion of your account and associated personal data.
Data portability — Request your data in a structured, commonly used format where technically feasible.

To exercise any of these rights, contact us at support@10tacle.io. We will respond within 30 days.

7. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

8. International Data Transfers

Your data is primarily stored and processed in Singapore. If data is transferred to a jurisdiction outside Singapore, we ensure that adequate protections are in place in accordance with the PDPA.

9. Third-Party Links

The App may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email. The "Last updated" date at the top indicates the latest revision. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Data Protection Officer

If you have questions, concerns, or complaints about this policy or our data practices, please contact our Data Protection Officer:

Data Protection Officer
10tacle Pte Ltd
Singapore
Email: support@10tacle.io

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.