Privacy Policy

Qanvast Pte. Ltd. ("Company", "we", "us") operates the OpenMaison platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting your privacy in compliance with the Personal Data Protection Act 2012 (PDPA) of Singapore.

2.1 Information You Provide

• Account information: Name, email address, phone number, studio name, role
• Business data: Lead details, project information, quotes, invoices, and client communications uploaded to the platform
• Payment information: Billing details processed through our third-party payment provider
• Communications: Messages sent through the platform's chat feature

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, actions taken within the platform
• Device information: Browser type, operating system, IP address, device identifiers
• Cookies and similar technologies: See our Cookie Policy for details

Usage and analytics data: the pages you visit, the features you use, your device and approximate location, and how you reached us (campaign or referring site). When you are signed in, this is linked to your account, and your name and email are shared with Mixpanel so we can understand usage per account. We never send your phone number to analytics services. When a signed-in studio member uses the app, Mixpanel also records session replays (clicks, scrolling, and page changes) with all on-screen text and form fields masked and no images or video; this never happens on client-facing links and portals. We also use Microsoft Clarity to record heatmaps and session replays (mouse movement, clicks, and scrolling) so we can identify confusing or broken parts of the Service. Clarity never runs on client-facing links and portals — signing, payment, quote, render-share, homeowner-portal, and other bearer-token pages — the same pages our other analytics tools skip. Text and images are masked in every recording, and opting out (see our Cookie Policy) stops Clarity immediately, even mid-recording.

2.3 Third-Party Data

• Gmail integration: When you connect your Gmail account for lead ingestion, we access email metadata and content from whitelisted sender domains only. OAuth tokens are encrypted with AES-256-GCM at rest.
• AI processing: Content you submit for AI analysis (quotes, images, floor plans) is processed by third-party AI providers under data processing agreements.

We use collected information to:

• Provide, operate, and maintain the Service
• Process your transactions and manage your account
• Generate AI-powered insights, suggestions, and analyses
• Improve and personalise your experience
• Communicate with you about updates, security alerts, and support
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

We do not sell your personal data. We may share information with:

• Service providers: Third-party vendors who assist in operating the Service (hosting, AI processing, email delivery, payment processing)
• Within your studio: Team members within your studio workspace can access shared business data according to their role permissions
• Legal requirements: When required by law, regulation, or legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets
• Analytics providers — Google (Google Analytics), Mixpanel, and Microsoft (Clarity) — process usage data on our behalf.

We implement industry-standard security measures to protect your data, including:

• HMAC-SHA256 signed session cookies
• AES-256-GCM encryption for sensitive credentials (e.g., OAuth tokens)
• Rate limiting on authentication endpoints
• HTTPS encryption for all data in transit
• Role-based access control within studio workspaces

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

We retain your personal data for as long as your account is active or as needed to provide the Service. Upon account deletion, we will delete or anonymise your personal data within 90 days, except where retention is required by law.

Under the PDPA and applicable data protection laws, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Withdrawal of consent: Withdraw consent for data processing (this may affect your ability to use certain features)
• Data portability: Request your data in a structured, machine-readable format
• Deletion: Request deletion of your personal data, subject to legal retention requirements

To exercise these rights, contact us at hello@openmaison.ai.

Your data may be processed in jurisdictions outside Singapore where our service providers operate. We ensure that adequate safeguards are in place through data processing agreements that comply with the PDPA's transfer limitation obligation.

Mixpanel processes analytics data in the European Union, and Microsoft processes Clarity data on its own infrastructure. You can opt out of analytics at any time on our Cookie Policy page. Opting out applies to this browser going forward; billing events for a subscription you started before opting out, or one managed by a teammate who has not opted out, are still recorded.

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a prominent notice on the Service. Your continued use after such notification constitutes acceptance.

For privacy-related enquiries or to exercise your data protection rights, contact our Data Protection Officer at hello@openmaison.ai.

Qanvast Pte. Ltd.
Singapore