Market Sensus — Privacy Policy

Operator: The Market Sensus, Singapore. Service: Market Sensus (themarketsensus.com). Last updated: 17 September 2026.

1. Introduction

This Privacy Policy explains how The Market Sensus ("Market Sensus", "we", "us") collects, uses, discloses, and protects your personal data when you use Market Sensus (the "Service"), in accordance with Singapore's Personal Data Protection Act 2012 (PDPA). By using the Service you consent to the practices described here.

2. The personal data we collect

Account & identity: first name, last name, email address, and, where you create an account with a password, that password (stored only as a secure hash — we never see it in plain text). Accounts created using Google or Apple sign-in have no password with us at all. Accounts created before 20 July 2026 may also have a date of birth and company name on file from our earlier sign-up form; you can ask us to delete these at any time.
Sign-in with Google or Apple: if you choose to sign in using Google or Apple, we receive from them your email address, your name and profile picture where they provide these, and a unique identifier that links your Google or Apple account to your Market Sensus account. We never receive your Google or Apple password. If you use Apple's Hide My Email, we receive only the anonymous relay address Apple generates for you, and any email we send is forwarded to you by Apple. Because that relay address does not match any other address you may already have with us, signing in that way creates a separate Market Sensus account.
Authentication: two-factor authentication (TOTP) enrolment and verification data.
Billing: subscription plan, status, and billing records. Card details are collected and stored by Stripe, our payment processor — we do not see or store full card numbers.
Usage & technical: log-in activity, device/browser information, IP address, and how you interact with the Service (used for security, including detecting shared accounts, and to improve the Service). On our public marketing and sign-up pages we also record whether a visit led to creating an account or starting a subscription, so we can tell which advertising is worth paying for — see sections 5 and 10.
Portfolio documents: if you use the Portfolio tab, the insurer statements and letters you drop in are read in your browser and the PDF is not uploaded. What we store is the transaction record they contain (dates, funds, units, amounts), the last three digits of each policy number alongside a one-way hash of the full number, and the client's name encrypted with a passphrase that never leaves your device, so we cannot read it. The one exception is a document the Portfolio tab cannot read: you may choose to send it to us so we can teach the reader its layout. That PDF, which may name your client, is held in private storage in our Supabase project and delivered to our support mailbox as an email attachment. It is used for one purpose only, teaching the reader that layout, and is seen only by us. The stored copy is deleted automatically 30 days after you send it, or sooner once the layout has been fixed, and we delete the email copy within the same period. The record we keep of the report holds the document type, the insurer and what failed, never your file name or your client's name. Nothing is sent unless you press the button. You are responsible for ensuring you are permitted to use your clients' documents in this way. Outside the Portfolio tab, you must not enter your clients' personal or confidential data into the Service.

3. Why we collect it (purposes)

To create and administer your account and authenticate you (including two-factor authentication, and where you choose to sign in with Google or Apple);
To provide the Service and its features;
To process your subscription, trial, and payments, and send billing-related notices (trial-ending, renewal, and failed-payment reminders);
To protect the Service and enforce our Terms, including detecting and preventing account sharing, fraud, and misuse (this is why we collect device/IP/usage data and apply a per-user watermark);
To communicate with you about your account and important service or legal updates;
To send you marketing or promotional communications about Market Sensus, where you have opted in;
To measure whether our advertising works — specifically, whether people who arrive from an advertisement go on to create an account or subscribe;
To comply with legal, regulatory, and tax obligations.

Marketing communications. We will only send you marketing or promotional emails if you have opted in to receive them. These are kept separate from essential account, billing, and legal-update messages, which you receive as part of the Service. You can withdraw your consent to marketing at any time — by using the unsubscribe link in any marketing email or by contacting us — without affecting essential service communications.

Age requirement. The Service is for professionals aged 18 or over. You confirm this at sign-up; we no longer collect your date of birth.

4. Consent and withdrawal

We collect and use your personal data with your consent, which you give by providing your data and using the Service. You may withdraw consent for any non-essential processing by contacting our DPO; note that withdrawing consent needed to run your account may mean we can no longer provide the Service.

5. Disclosure and third-party processors

We do not sell your personal data. We share it only with service providers who help us run the Service, under appropriate safeguards: - Stripe — payment processing and billing (card data, billing details). - Supabase — authentication and database hosting (account and profile data); project hosted in the Singapore region. - Netlify — website hosting/delivery. - Resend — sending transactional and, where you have opted in, marketing emails (e.g. account, billing, password emails). A document you choose to send us from the Portfolio tab travels to our support mailbox through Resend as an email attachment. - PostHog (PostHog Inc.), our product analytics provider: page views, clicks and other interactions, device/browser information, and session replays with typed input masked, used to understand how the Service is used and to improve it. Data is processed on PostHog's servers in the United States.

Sign-in providers. If you use “Continue with Google” or “Continue with Apple”, Google (Google LLC) or Apple (Apple Inc.) will know that you have signed in to Market Sensus. They act as independent controllers of that sign-in, not as our processors, and their handling of your data is governed by their own privacy policies rather than this one — see Google’s Privacy Policy and Apple’s Privacy Policy. We share no other personal data with them, and we do not use them to advertise to you.

Advertising measurement (Meta). We advertise Market Sensus on Facebook and Instagram. To tell whether those advertisements actually bring us customers, our public marketing page, our sign-up flow and our subscription page carry Meta's measurement pixel (Meta Platforms, Inc. and Meta Platforms Ireland Ltd). It records that a visit happened and whether it led to creating an account, completing setup, starting a trial, or subscribing. When a subscription payment succeeds, our server tells Meta that a subscription of that plan and amount occurred.

What we do not send Meta is as important as what we do. We have switched off Meta's automatic matching feature, so your email address, name, phone number and any other identifying detail are never passed from your browser to Meta. The events our server sends carry the plan and the amount and nothing about who you are. Meta acts as an independent controller of what it collects through the pixel, not as our processor, and its handling of that data is governed by Meta's own privacy policy rather than this one.

The Portfolio tab carries no pixel at all. We have deliberately excluded the Portfolio page, and every page where your clients' statements, names or policy numbers can appear, from all advertising measurement. No information about your clients is sent to Meta, in any form, ever.

If we engage further processors, we will update this list.

We may also disclose personal data where required by law, regulation, court order, or to a regulator, or to protect our rights and the safety of users.

6. Transfers outside Singapore

Some processors process data outside Singapore: for example Stripe (payment data), PostHog (analytics data, processed in the United States), if you choose to use them to sign in, Google and Apple (sign-in data, processed in the United States and in other countries where they operate), and Meta (advertising measurement data, processed in the United States, Ireland and other countries where Meta operates). Where personal data is transferred overseas, we take reasonable steps so that it is protected to a standard comparable to the PDPA, including through the processors' contractual commitments.

7. Retention

We keep personal data only for as long as needed for the purposes above or as required by law (for example, billing and tax records). When no longer needed, we will delete or anonymise it. Account data is kept while your account is active and for as long as required by law (for example, billing and tax records), then deleted or anonymised.

Two limits are fixed. A document you send us from the Portfolio tab is deleted from our storage no later than 30 days after you send it, by an automatic job. When you delete your account, every Portfolio record you created — clients, policies, statements, transactions and the encrypted names — is deleted with it.

8. Security

We use reasonable administrative and technical measures to protect personal data, including encryption in transit, hashed passwords, two-factor authentication, row-level access controls in our database, and access restrictions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affecting your personal data is likely to result in significant harm to you, we will notify you and the Personal Data Protection Commission as the Personal Data Protection Act requires.

9. Your rights (access and correction)

Under the PDPA you may request access to the personal data we hold about you and information about how it has been used, and you may request correction of inaccurate or incomplete data. To make a request, contact our DPO (below). We may verify your identity and may charge a reasonable fee for an access request as permitted by the PDPA, and will respond within the timeframe required by law.

10. Cookies and similar technologies

The Service uses cookies/local storage that are necessary to sign you in, keep you signed in, and remember preferences (such as light/dark theme). These strictly necessary cookies do not require consent.

We also use analytics cookies set by PostHog, our analytics provider, to understand how the Service is used and to improve it. These record page views, clicks and other interactions, and device/browser information, and enable session replays in which anything you type is masked before it reaches us. By continuing to use the Service you consent to these analytics cookies. If you would like the analytics data associated with your visits deleted, contact us at themarketsensus@gmail.com and we will action it.

On our public marketing page, our sign-up flow and our subscription page we also use advertising cookies set by Meta, so that we can tell which of our advertisements lead to sign-ups. These are not used anywhere inside the Portfolio tab. You can prevent them by using your browser's tracking-prevention settings or an ad blocker, and you can control how Meta uses activity from other websites through the Ad Preferences and Off-Facebook Activity settings in your Facebook or Instagram account. Blocking them does not affect your use of the Service in any way.

11. Data Protection Officer

We have appointed a DPO to oversee our compliance with the PDPA. You can reach the DPO at: Data Protection Officer, themarketsensus@gmail.com.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email or in-app, with an updated "Last updated" date.

13. Contact

The Market Sensus, themarketsensus@gmail.com.

← Back to The Market Sensus