Legal
Plain English summary: We collect only what we need to run the service. We never sell your data. Your financial records are yours, and only you can see them. The founder can only access your data when you raise a support request, and that access is logged. Sensitive identifiers are stored as one-way cryptographic hashes, not in plain text. You can delete your account and all your data instantly from Settings, with no email needed.
This Privacy Policy explains how app.kevinchia.sg ("snapbook", "we", "us", "our") collects, uses, and protects information about you when you use our bookkeeping service at app.kevinchia.sg.
By using app.kevinchia.sg, you agree to the practices described in this policy. This policy is governed by the Personal Data Protection Act 2012 (PDPA) of Singapore.
We have appointed a Data Protection Officer responsible for overseeing compliance with the PDPA. For any data protection matters or rights requests, you may contact our DPO at hello@kevinchiahd.com.
We collect the following categories of information:
| Data type | What it includes | Why we collect it |
|---|---|---|
| Account data | Email address, password (encrypted), account creation date | To create and manage your account |
| Business data | Business name, business structure type, UEN (registered companies only), GST status, financial year end | To personalise the service and pre-fill compliance forms |
| Telegram integration | A one-way cryptographic hash of your Telegram chat ID, and the raw ID is never stored | To link your Telegram account for mobile receipt capture |
| Financial records | Receipts, invoices, transaction data, amounts, vendors, categories | To provide bookkeeping and P&L reporting |
| Uploaded files | Images and PDFs of receipts and financial documents | To extract transaction data using AI |
| Employee & payroll data | For businesses using the Payroll module: employee name, NRIC / FIN, date of birth, salary, CPF and bank account details, entered by the employer | To run payroll and produce CPF, IR8A and MOM submissions. Sensitive fields are encrypted at rest. |
| Usage data | Pages visited, features used, upload counts | To improve the service and enforce plan limits |
We never collect or store credit card numbers. Card payments are handled entirely by Stripe. We do not ask for your own NRIC or passport number to open an account. Employee NRIC / FIN and bank account details are collected only where you, as an employer, enter them into the Payroll module, and are encrypted at rest.
We use your data solely to provide and improve app.kevinchia.sg. Specifically:
We never use your uploaded financial documents, receipts, or transaction data to train AI models. Any use of your data for model improvement would require separate, explicit consent from you. We do not use your data for advertising or marketing profiling.
We do not sell your personal data to third parties. We share data only with the following service providers, strictly to operate the platform:
The founder may access your data solely to investigate and resolve support requests raised by you. This access is not used for any other purpose.
We may disclose your data to government authorities or law enforcement if required by Singapore law.
Each of these providers acts as a data intermediary on our behalf. We have agreements in place requiring them to protect your data in accordance with applicable data protection obligations, including the PDPA. We remain responsible for ensuring your data is handled appropriately by these providers.
Bookings can connect to your Google Calendar. This is optional, is off unless you switch it on, and you can disconnect at any time from Setup → Google Calendar inside your account.
What we ask Google for. Three permissions, and nothing wider:
What we can see. Only the times you are busy, and the names and identifiers of your calendars. We cannot see the title, description, location, guests or any other content of your calendar entries, and that content is never sent to us. We cannot read, change or delete any entry we did not create ourselves.
What we store. The times you are busy, stored as blocked-out periods against your account so that your booking page can close them; the identifiers of the calendars you chose; the email address of the Google account you connected; and an encrypted key that lets us keep reading your availability until you disconnect. We do not store the contents of your calendar entries, because we never receive them.
What we use it for. Only the function you connected it for: writing your bookings into your Google Calendar, and closing your booking page during the times you are busy. We do not use it for any other purpose, we do not sell it, we do not use it for advertising, and we do not use it to train any AI model.
Disconnecting. Disconnecting withdraws our access and deletes the stored key. Time that was blocked out because of Google goes back on sale on your booking page. The “app.kevinchia.sg Bookings” calendar and the entries in it remain in your Google account until you delete them yourself.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Bookings can connect to a business account you hold with Aspire, so that a booking marks itself as paid when your customer’s payment arrives. This is optional, is off unless you connect it, and you can disconnect at any time from Bookings → Getting paid inside your account. Only the account owner or a co-owner can connect or disconnect it.
What you give us. A client ID and an API key that you create yourself in Aspire. We ask you to create the key with permission to read transactions and nothing else. We only ever read with it: nothing in app.kevinchia.sg can make a payment, move money or change anything in your Aspire account.
What we can see. Your recent transactions, which is what Aspire returns to a key with that permission. For each transaction this includes the date and time, the amount, whether money came in or went out, the payment reference, the name Aspire shows for the other party, and the account balance. We read at most the last 7 days at a time, and only while a booking is waiting to be paid, or when you connect the key or ask us to check that it works.
What we store. Your client ID and API key, encrypted, and the time the connection was last checked. When a payment matches a booking, we store Aspire’s identifier and bank reference for that one payment against the booking. We do not store any of your other transactions: they are held in memory for a few seconds while we look for a match and then discarded, and they are not shown on any screen.
What we use it for. Only to tell whether a booking has been paid. When a payment’s reference and amount both match a booking exactly, the booking is confirmed on your behalf in the same way as if you had confirmed it yourself. We do not use your Aspire data for any other purpose, we do not sell it, we do not use it for advertising, and we do not use it to train any AI model.
Other people in your transactions. Your transactions may name people and businesses who pay you or whom you pay. In reading them we act on your behalf, as your data intermediary under the PDPA, and only for the purpose described above.
Disconnecting. Disconnecting deletes the stored key immediately, and bookings go back to you confirming them yourself. You can also revoke the key in Aspire at any time, which ends our access at once. The identifier and reference already stored against confirmed bookings stay on those bookings as part of your records. Deleting your account deletes the key along with everything else.
You can connect app.kevinchia.sg to Claude, the AI assistant made by Anthropic, so that Claude can read your business records and answer your questions about them. Claude is currently the only app that can be connected in this way; we will add others on request. This is optional, nothing is connected unless you connect it, and you can disconnect at any time from Settings → Claude inside your account, or from Claude’s own connector settings.
How it is connected. You add app.kevinchia.sg in Claude, sign in to app.kevinchia.sg, and choose Allow. The connection belongs to you and to the one company that was open in your account when you allowed it. We give Claude a key that lasts one hour and a renewal key that lasts up to 60 days. We store only a one-way fingerprint of each key, never the key itself.
What Claude can read. Only the parts of app.kevinchia.sg your own access to that company includes, which may cover its profit and loss and the entries behind it, balance sheet, GST figures, invoices, payroll and staff costs, contacts, bookings, shop orders, stock and company compliance records. Contacts’ email addresses and mobile numbers are sent only when Claude asks for them. Claude can only read: it cannot add, change or delete anything in app.kevinchia.sg.
Where the data goes. What Claude reads is sent to Claude under your own Claude account, at your request, and is handled by Anthropic under the terms and privacy policy you agreed with them, not under this policy. Anthropic is not our service provider for this feature; you are directing us to send your records to a service you chose. Your records may include personal data about other people, such as your customers and staff. In sending it at your direction we act on your behalf, and you are responsible for having the right to share it with Claude.
What we store. The app that connected, which account and company it is for, when it was connected and when it was last used. We do not store the questions you ask Claude or its answers.
Disconnecting. Disconnecting ends Claude’s access immediately and deletes its keys. The connection also ends by itself if you are removed from the company or your account is deleted. Anything Claude has already read stays in your Claude account until you delete it there.
Your data is stored on Supabase infrastructure hosted on Amazon Web Services (AWS) in the ap-southeast-1 (Singapore) region. We take the following measures to protect your data:
No security system is perfect. While we take reasonable precautions, we cannot guarantee absolute security of your data.
In the event of a data breach affecting your personal data, we will assess the incident promptly and in accordance with our obligations under the PDPA. If the breach is notifiable, we will inform the Personal Data Protection Commission (PDPC) within the required timeframe and notify affected users if there is likely risk of significant harm.
We retain your data for as long as your account is active. When you delete your account via Settings → Delete Account, your personal data, financial records, uploaded files, and all associated data are deleted immediately. Backup copies are retained for up to 7 days as part of our infrastructure recovery process and are permanently purged thereafter. We may retain certain transaction records beyond account deletion where required by Singapore law, including for tax and IRAS compliance purposes.
Under Singapore's Personal Data Protection Act 2012, you have the right to:
You can delete your account and all associated data (receipts, transactions, payroll records and settings) instantly via Settings → Delete Account. No email required. For all other rights requests, email us at hello@kevinchiahd.com and we will respond within 10 business days.
app.kevinchia.sg uses two analytics tools to understand how the service is used: Microsoft Clarity (session recording and heatmaps) and Google Analytics (page and event tracking). These may use cookies or browser local storage. We also use local storage to remember your theme preference (light or dark).
We do not run advertising, so we do not use the Meta Pixel or any other advertising or conversion-tracking tool. The Meta Pixel was removed from the site in September 2026.
When you are signed in, we also keep our own basic usage record: which pages of the app you opened, when, and how long you were signed in for. This is used to understand which parts of app.kevinchia.sg are useful and which are not. It records page names and times only — never the figures, documents or customer details on those pages.
Your financial data is never shared with these analytics providers. We do not use advertising cookies or track you across other websites for marketing profiling purposes.
app.kevinchia.sg is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If changes are material, we will notify you by email. Continued use of app.kevinchia.sg after changes take effect constitutes acceptance of the updated policy.
A real person reads it, and a data request is answered within 10 business days.