Privacy Policy

When you visit the site, we collect:

• Standard web request data (IP address, browser, page visited) for security and aggregate traffic counting.
• Usage analytics (page views, referrer) via Google Analytics — only if you accept analytics cookies; off by default.

When you opt in for a checklist email, we additionally collect:

• The email address you provide.
• Which listing or vehicle make/model triggered the opt-in.
• Timestamp of your consent and when we sent the checklist.

When you register interest in advertising (via the Advertise page), we collect:

• Your business name, your name, and email address.
• Your phone number, if you choose to provide it (optional).
• The category and ad format you're interested in, and any message you add.

We never collect your NRIC, financial details, government IDs, or any sensitive personal data. Checklist subscribers give only an email — no name or phone.

• Email address — to deliver the inspection checklist you requested and (with your consent) occasional related offers from BuyCarLeh.
• Listing / model context — to personalize the checklist for the specific car you're considering and to measure which checklists are useful.
• Web request data — to keep the site secure (rate-limit abuse, detect attacks) and to understand aggregate usage so we can improve the analytics.
• Advertiser details — to respond to your advertising enquiry and work out the right placement. Used only for that — never added to a marketing list without your separate consent.

We hold your email and opt-in record for 5 years from your last interaction (download, click, or login), or until you unsubscribe — whichever comes first. After that the record is deleted.

Aggregate analytics (no email attached) is retained indefinitely since it cannot identify an individual.

Advertising enquiries are kept while we're in touch about your enquiry and for up to 12 months after, then deleted — or sooner if you ask us to.

We keep cookies to a minimum. A few are necessary — they remember your session, your sign-in (when that's live), and your cookie choice itself. Beyond those, we use Google Analytics to understand which pages help people and where they get stuck. Analytics cookies are off until you accept them — decline and none are set. You can change your mind anytime by clearing the choice; we re-ask every few months. We never put your email or any personal identifier into analytics, and IP addresses are anonymised.

Only BuyCarLeh operators access your data directly. We use the following service providers (sub-processors) to operate the site:

• AWS SES (transactional email, Singapore region) — delivers the checklist PDF to your inbox. Processes your email address solely to send the message; data stays in the ap-southeast-1 (Singapore) region.
• Hosting provider — runs our application server and Postgres database. Data is encrypted in transit (HTTPS) and at rest.
• Cloudflare — content delivery + DDoS protection. Logs request IPs for short windows.
• Google Analytics (usage analytics) — only after you accept analytics cookies. Receives anonymised page-view events; never your email or any identifier.

We do not sell, rent, or share your email or opt-in record with third parties for their own marketing.

Under PDPA you may:

• Access — ask what data we hold about you.
• Correct — request fixes to inaccurate data.
• Withdraw consent — unsubscribe at any time. Every checklist email contains a one-click unsubscribe link, or you can email us.
• Complain — to us first via [email protected], or to the Personal Data Protection Commission.

Checklist PDFs may include sponsor placements (workshops, insurers, financing brokers). Sponsors pay us for visibility but do not influence the underlying checklist content — that is editorially independent. Sponsors never receive your email or any identifying information. We may share aggregate impression statistics with sponsors (e.g. "your placement appeared in 87 PDFs this month").

If our systems are breached in a way that compromises your data, we will notify the PDPC and affected users within 72 hours of confirming the incident, in line with PDPA Section 26D.

If we make material changes (new data collection, new processors, retention period changes), we'll notify subscribers by email and update the "Last updated" date above. Cosmetic clarifications don't need notification.

For privacy questions, access/correction/withdrawal requests, or general questions, write to [email protected]. We respond within 30 days as required by PDPA.