Privacy Notice
Carveat Pte Ltd (UEN 202621446W) takes your personal data seriously. This notice explains what we collect, how we use it, and your rights under Singapore's Personal Data Protection Act (PDPA).
Who we are
Carveat Pte Ltd operates carveat.com — a Singapore-based used car valuation and matching service. Our Data Protection Officer can be contacted at dpo@carveat.com.
What personal data we collect
When you sign up as a buyer
- Your name and mobile phone number
- Your email address
- Your car preferences (make, model, badge or variant, budget, holding period, COE preference)
- The consent choices you make at signup
When you request a valuation as a seller
- Your name and mobile phone number
- Your email address
- Details about the car you intend to sell (make, model, year, mileage, COE status, condition, registration details)
- The consent choices you make at submission
When you visit carveat.com generally
- Standard server-side session data — including IP address, browser type, pages visited, and time on page — used for security and basic operational monitoring
fonts.googleapis.com), which means Google may log your IP address when you visit our site; we do not control or receive this data.
How we use it
We use your personal data to:
- Respond to your buyer signup or seller valuation request
- Send you confirmation emails relating to your interaction with us
- Match your interest against available listings or interested buyers
- Send WhatsApp service communications if you consented at signup
- Operate, maintain, and improve carveat.com
We do not send you marketing emails beyond what is necessary to deliver the service you signed up for. We do not sell your personal data.
Who we share it with
We rely on the following service providers to operate carveat.com. They process data on our behalf and are bound by their own privacy policies and our contractual obligations:
| Provider | Purpose |
|---|---|
| Cloud hosting provider | Operates and serves carveat.com |
| Database provider | Stores buyer and seller records |
| DNS & email-routing provider | Domain routing and inbound email forwarding |
| Transactional email provider | Sends your confirmation and notification emails |
| Meta Platforms (WhatsApp) | Service messaging — only if you consented |
| Meta Platforms (Meta Pixel / advertising) | Advertising measurement & audience building |
| Internal messaging / notification tool | Alerts our team when a new request arrives |
Some of these providers operate servers outside Singapore. We use providers that maintain data protection standards comparable to or stronger than the PDPA.
We do not sell your data to advertisers, data brokers, or any third party.
How long we keep it
We retain your personal data for 12 months after your last interaction with us, after which it is automatically deleted — unless you remain an active user, or unless we have a legal or accounting obligation to retain it longer.
Your rights
Under the PDPA, you have the right to:
- Access the personal data we hold about you
- Correct any inaccuracies
- Withdraw consent for our ongoing use of your data
- Request deletion, subject to legal and operational requirements
To exercise any of these rights, email dpo@carveat.com. We will respond within 30 days.
How to contact us
For privacy-related questions, complaints, or to exercise your rights:
Entity: Carveat Pte Ltd (UEN 202621446W), Singapore
If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.
Changes to this notice
This is version 1.1. We may update this notice as our service evolves. Material changes — such as the introduction of new data collection categories, analytics tools, or third-party processors — will be communicated through carveat.com.
This notice is a plain-English summary of our privacy practices. A full legal review by a qualified lawyer is pending.