MarqueTrack
Privacy Policy
MarqueTrack is a property-management platform operated by Allyvate Pte Ltd (UEN 201934150N), 8 Yio Chu Kang Terrace, Singapore 545477. This policy explains what personal data the platform holds, why, who it goes to, how long we keep it, and the rights of the people it is about. We comply with the Singapore Personal Data Protection Act (PDPA) 2012.
In short. A landlord's tenant records belong to the landlord; we keep them for the landlord and use them for nothing else. We never sell data, show ads or train AI on anyone's records. We count which parts of the app are used, never what is typed in it.
Who the data belongs to
MarqueTrack is used by property owners and managers (our clients), the agents who help them, and their tenants. This is the personal data in the platform:
- Client account data — the email address, name and profile of each person who creates or is added to an account, and the sign-in records the service keeps. An account is created by the client at marquetrack.com; team members are added by the account owner.
- Tenancy data entered by clients — tenant names and contact details, leases, rent records and documents, including what tenants send through the tenant app: the email they sign in with, repair reports and questions, the conversations about them and their photos, and payment screenshots. For this data our client is the organisation responsible for it under the PDPA, and MarqueTrack processes it only on their behalf, as their data intermediary. The terms of service set out what we do and do not do with it.
- Agent account data — an agent's email address, the name and one line they write about themselves, their mobile number if they choose to show it, and their sign-in records. MarqueTrack is the organisation responsible for this data.
- Set-ups entered by agents — the landlord's name and email, and each home and tenant the agent enters for that landlord (tenant name, mobile number, rent, deposit, lease dates). The agent enters it for the landlord, after confirming the landlord asked them to and that they may share it. Under the PDPA, the agent and the landlord they act for are responsible for it; we process it only on their behalf, as their data intermediary, and only to show it to that landlord. Once the landlord adds it, it becomes tenancy data in the landlord's account (above). See the terms, section 2A.
- Tenants who open a pay link — see "Tenant pay links" below.
- Visitors to our website, and anyone who writes to us — we are responsible for the little we keep about them, described below.
What else the app records
Usage counts. The app records which screens and features each owner and staff login uses, as counts and fixed words (for example "invoice drafted" or "payment recorded, by PayNow"), with the login, the account, the kind of device and the app version. Never names, amounts, phone numbers or anything typed. Tenants and agents are not counted. We use the counts to see which parts of MarqueTrack are used and where people get stuck, and keep them for 400 days.
Crash log. When the app breaks, it records the error, the page and the browser, with no account or person attached, so we can fix it. We keep it for 90 days.
Server logs. Our hosting providers keep short technical logs of requests, such as the internet address a request came from, to keep the service secure.
Why we use it
- To run MarqueTrack: sign-in, keeping records, preparing bills and reminders, and sending what the landlord asks us to send.
- To bill landlords for MarqueTrack and keep our tax records.
- To answer support requests and messages sent with Tell us.
- To keep MarqueTrack secure and find misuse.
- To improve MarqueTrack, using usage counts and the crash log only.
- To send landlords and agents service emails about their account, bills, outages and changes to our terms.
- To meet a legal duty, such as a request from a Singapore authority.
We do not use anyone's data for advertising, sell it, build profiles to market to people, or use tenants' data for any purpose of our own.
Consent, and withdrawing it
We collect landlords' and agents' data with their consent when they sign up, for the purposes above. A tenant's data is collected by their landlord, who is responsible for telling them and having their consent.
You can withdraw your consent at any time by writing to the address under Contact. We act on it within 10 working days and tell you first what will follow: MarqueTrack cannot run without sign-in and account data, so for a landlord or agent, withdrawing consent for those means closing the account. You can turn off optional things yourself: phone alerts in your phone's settings, and any marketing email from its unsubscribe link. A tenant who wants to withdraw consent writes to their landlord.
Marketing messages
We send service messages to account holders: bills, the reminders a landlord turned on, outage notices and changes to these policies. We send marketing only to people who agreed to it, each message with a way to stop, and we check Singapore's Do Not Call Registry before any marketing call, text or WhatsApp message to a Singapore number. We never market to tenants.
What we hold, and for how long
| Data | Kept while | After that |
|---|---|---|
| Financial records (invoices, payments recorded, statements, expenses) | The account is open, unless the client deletes them sooner | Deleted when the account is closed |
| Tenancy documents (leases, stamp certificates, other uploads) | The client keeps them in the account | Deleted with the document, the property, or the account |
| Tenant contact details | The tenant is in the account | Deleted with the tenant or the account |
| "I've paid" reports from pay links | The invoice exists | Deleted with the invoice |
| Phone push subscription | Notifications are on | Removed when they are turned off |
| Account and login data | The account is open | Deleted when the account is closed |
| Who introduced you (the agent code in the link you signed up through, if any) | The account is open | Deleted when the account is closed |
| Agent account and card | The agent uses MarqueTrack | Deleted when the agent asks us to |
| A set-up an agent entered | The landlord has not answered it | Tenant details removed from the set-up as soon as the landlord adds or declines it; the rest deleted 30 days later. Unanswered: deleted 30 days after the link expires, or 44 days after it was made if no link was sent. The agent can delete it at any time |
| Which agent helps an account, their permissions and the actions they took | The account is open | Deleted when the account is closed |
| Tenant sign-in (the email a tenant proved) | The tenant can sign in | Removed when the landlord removes the tenant's access, or with the tenant or the account |
| Repair reports, questions, the conversations about them and their photos | The tenancy, and 2 years after it ends (a deposit claim can be made up to 2 years later) | Deleted 2 years after the tenancy ends, or sooner if the landlord deletes the tenant or closes the account |
| Usage counts | 400 days | Deleted after 400 days, or with the account |
| Crash log | 90 days | Deleted after 90 days |
| Our bills to you | 5 years, as our tax records | Deleted after 5 years |
Closing an account deletes everything in it at once. The one exception is our own bills to you (MarqueTrack's monthly fee from Allyvate Pte Ltd): we keep those, with the name they were addressed to, for 5 years as our tax records. Singapore tax rules (IRAS) expect landlords to keep their rent records for 5 years; that duty is the client's, so export your records before closing. Deleted data can remain in the database's daily backups for up to 7 days, after which it is gone.
Identity numbers in uploads. Tenancy agreements often show NRIC or passport numbers. MarqueTrack stores the file privately, where only people in that client's account can open it. It never reads those numbers out of a document or shows them anywhere else. We ask clients to upload only what they need to keep.
When WhatsApp or another messaging channel is used for operational communication, the relevant messages and requests may be recorded in MarqueTrack so the team can track work, provide follow-up and maintain an audit trail.
How it is stored and protected
Data is stored with Supabase (database, authentication and file storage) in their Singapore region, encrypted in transit and at rest. Access is controlled by row-level security: each client account can only reach its own records. Passwords are hashed and never visible to us. If you enable push notifications, the platform stores your device's push subscription — a delivery address issued by your phone's platform, not your location or contacts — and removes it when you turn notifications off.
How the service is protected, who can reach the live data and what we check is set out on our security page.
Sharing
- Supabase, as our data processor for the database, sign-in and file storage, in Singapore.
- Vercel, which hosts and delivers the application. The public site counts page views with Vercel Web Analytics, which sets no cookie and keeps no personal data.
- An email delivery provider: Resend (United States), for the reminder and alert emails MarqueTrack sends you. Sign-up confirmations and password resets are sent by Supabase's sign-in service. The provider processes the address and the message outside Singapore, under protection comparable to the PDPA.
- Anthropic (United States), only to read a payment screenshot: when someone in a client's account asks MarqueTrack to ("Add payment screenshot", or sharing the picture to the phone app), or when a tenant adds one on their pay link. Anthropic's Claude reads that one picture and returns what it shows — the amount, date, reference and names — to fill in the payment for the client to check. Under Anthropic's commercial terms it is not used to train their models. It is processed outside Singapore, under protection comparable to the PDPA. The screenshot itself is kept in the client's account as the payment's receipt.
- Stripe (Stripe Payments Singapore; processing also in the United States), to send you MarqueTrack's monthly bill and take its payment by card or PayNow. Stripe receives your billing contact's name and email and the bill itself, never your tenants' data, under protection comparable to the PDPA.
- Apple and Google, to deliver push notifications to the phone app if you turn them on. They receive the notification as shown on your phone, for example a tenant's name and an amount, and nothing else from your records.
- Telegram, for MarqueTrack's own team only: a daily summary of how new accounts are getting set up goes to our team chat. It carries a client's or agent's name, their account name and how far along they are, never tenants' details or amounts, and no email addresses. It is processed outside Singapore. When someone sends us a Tell us message, its first line goes to the same chat, with the account name for a landlord; a tenant or agent is not named.
- Singapore tax and regulatory authorities, where legally required.
- Nobody else. We do not sell data. We update this list before we add a provider that handles tenants' data.
Data sent overseas
Where a provider above handles data outside Singapore, we send only what it needs for its job, under terms that require it to protect the data to a standard comparable to the PDPA, as the PDPA requires. Your records themselves are stored in Singapore.
Tenant pay links
Each invoice a client sends has its own private link, so the tenant can see what they owe and pay by PayNow. Anyone who has the link can see what the invoice shows: the landlord's name and payment details, the tenant's name, the unit and property, and the amount. The link is long and random, it cannot be guessed, and it shows nothing until the invoice is issued. A voided invoice's link stops showing it. When the tenant taps "I've paid", we record that and any reference they type, and tell the landlord. We also count how many times each invoice's page is opened, with the first and last time, so we can tell that the page works. That count holds nothing about who opened it or from where. No payment passes through MarqueTrack, and the page sets no cookie.
Automatic notices to tenants
If a landlord chooses to send automatically, MarqueTrack sends that landlord's tenants their bills, reminders, receipts, repair updates and the replies the landlord's side writes in a conversation about a problem or question, on the landlord's behalf. Each notice carries what it is about (the bill and amount, or the problem and its progress) and goes to the tenant's own phone, if they turned on alerts, and to the email they proved. Bills, reminders and receipts also go to an email their landlord gave us for them; such an email has a link to stop it, for anyone who gets it by mistake. We keep each notice and when it was sent, as part of the landlord's records, and use it for nothing else. A tenant can turn phone alerts off in their phone's settings; a landlord can switch back to sending bills themselves.
Messages you send us with Tell us
Anyone signed in can send MarqueTrack a message from the app. We keep what they wrote, who sent it, which screen they were on and their kind of device, so we can answer and fix the problem. If they choose to add a picture of the screen, it can show names and amounts, and it is deleted after 90 days. The words of a problem or question conversation are left out of that picture. These messages and pictures are for our support only: only MarqueTrack can read them, and we read them with the help of an AI assistant from Anthropic (United States). The message stays until the account or login is removed.
Conversations about a problem or question
Each repair report or question a tenant sends has one conversation. The tenant, the landlord and their team, and the landlord's agents can read it and reply, with photos; the reply box says who will see a message. A message can be changed or taken back for 10 minutes, then it stays as written, and each change keeps the earlier words. The landlord can remove a message (for example an abusive one) or close the conversation to new replies from the tenant: everyone then sees that it was removed and by whom, and the words stay in the landlord's records. Times are recorded by our server, and each photo's fingerprint is kept with it. The landlord and their agents can export a conversation as a PDF. No AI service reads these conversations or their photos.
Agents
An agent a landlord keeps on can see that landlord's homes, tenants (names and mobile numbers), bills, and the tenants' repair reports and questions with their photos and conversations, which the agent can reply in. Agents never see other uploaded documents or the NRIC or passport numbers in them, and cannot see or change a landlord's PayNow or bank details in the account (the pay link an agent sends a tenant shows them, as it shows any tenant). Tenants see their agent's name and line; the agent's mobile number and email only if the agent chooses to show them. Each action an agent takes is recorded with their name in the landlord's account.
If something goes wrong
If we learn of unauthorised access to, or loss or disclosure of, personal data in a client's account, we tell that client without undue delay and in any event within 72 hours of becoming aware — what happened, what data was affected as far as we know, what we are doing, and what we suggest they do — and we help with any assessment or notification they must make. The landlord decides whether the breach must be reported to the Personal Data Protection Commission (PDPC), within 3 days of deciding, and to the tenants affected. For data we are responsible for ourselves, we make that assessment and notify the PDPC and the people affected as the PDPA requires.
Your rights
- Clients can review and correct their data inside the platform and export their records at any time. The person who created the account can close it from Settings, which deletes everything at once. Any owner can also ask us by email; we send an export first, then delete the account within 30 days.
- Tenants whose details appear in a client's account should send access, correction or deletion requests to their landlord or property manager, who is responsible for their data. We help the client answer within the 30 days the PDPA allows.
- Agents can update their name, line and number in the app, and ask us to delete their account by email; we do so within 30 days. Requests about a tenant's details in a set-up go to the landlord it was for, or to us while it has not been answered.
- Requests made to us directly are answered within 30 days. We charge nothing to answer them. If you are not happy with our answer, you can complain to the PDPC at pdpc.gov.sg.
Cookies and what the browser keeps
MarqueTrack sets no tracking or advertising cookies and shows no ads, on the site or in the app. The site counts page views with Vercel Web Analytics, which sets no cookie and keeps no personal data. The browser keeps only what the app needs to work: your sign-in session, your light-or-dark choice, which notices you have seen, and saved views, all on your own device. Because nothing non-essential is stored, there is no cookie banner. Pay links set no cookie.
Children
MarqueTrack accounts are for adults. We do not knowingly hold an account for anyone under 18.
Changes to this policy
We post any change here with a new date. If a change affects how we use your data, we tell account holders by email and in the app before it applies.
Terms
The terms of service — what MarqueTrack does and does not decide on a client's behalf — are at marquetrack.com/terms (summary at marquetrack.com/legal).
Contact
For any data query, request or complaint, email max.marquetrack@gmail.com with the property manager or company the request concerns. This address reaches our Data Protection Officer, appointed under section 11 of the PDPA. By post: Allyvate Pte Ltd, 8 Yio Chu Kang Terrace, Singapore 545477.