Privacy

What we hold, where it lives, and why.

This notice explains how StampedID handles personal data under Singapore's Personal Data Protection Act (PDPA). It is written in plain language on purpose. If anything here is unclear, write to us and we will explain it.

Effective from 18 September 2026. Last updated 18 September 2026.

Who we are

StampedID is operated by Ashiq Muhammad, a sole proprietor in Singapore, trading as Ashiq Muhammad, sole proprietor (business registration pending). We are not yet incorporated. When we say "we", "us" or "StampedID" in this notice, we mean that operator.

StampedID is a separate product from Stamped (stampedsg.com), which is run by the same owner. This notice covers StampedID only. Stamped has its own notice.

You can reach us at hello@stampedid.com.

What this notice covers

• stampedid.com — the marketing site you are reading.
• dashboard.stampedid.com — the web dashboard used by interior design firms.
• field.stampedid.com — the mobile web app used by the subcontractors a firm invites to a job.

The two hats we wear

Most of the personal data inside StampedID was not given to us. It was put there by a firm: its own staff, the people it engages, and the people who appear in site photos. For that data the firm decides what is collected and why, and we hold and process it on the firm's instructions. In PDPA terms we act as the firm's data intermediary.

For a smaller set of data we decide things ourselves: who signs up, who we reply to, who we invoice when the pilot ends. For that data we are the organisation responsible.

This matters for whom you ask. If you want to know why your photo is on a job, ask the firm that runs the job. If you want to know what StampedID holds about you as an account holder or an enquirer, ask us. We will help either way and will point you to the right party if it is not us.

What we collect, from whom, and why

If you visit stampedid.com

• Nothing we store ourselves. The site sets no cookies, runs no analytics, and writes nothing to your browser's storage.
• Standard request records. Our host (Vercel) and our DNS provider (Cloudflare) keep short-lived technical logs, including IP addresses, to serve the page and to block abuse.
• Fonts. Typefaces load from Google Fonts. Your browser contacts Google directly, so Google sees your IP address and browser details when it serves the font. We do not receive that information.
• If you write to us or book a call. We keep your name, email address, any phone number you give us, your firm, and what you wrote, so we can reply and follow up about the pilot.

If you are an interior designer

• Account details — name, work email, mobile number, role, firm name, and your password in hashed form. Used to sign you in, to attribute actions to you, and to contact you about the service.
• Project data — property address, job type, dates, areas, types of work, schedules, permits and their expiry, variations, and notes. Used to run the schedule.
• Quotations you upload — the document and the text inside it, including any names, addresses, prices and contact details it contains. Used to draft the project setup automatically. See Sending data outside Singapore below, because this is the one thing that leaves the country.
• People you invite — the names, email addresses and mobile numbers you enter for subcontractors and their crew, so we can send the invitation and identify them on the job.
• Your actions in the product — what you verified, when, and any correction you made with the reason you gave. This is an audit record. It is the point of the product and it cannot be edited away.
• Support correspondence — what you sent us and what we replied.

If you are a subcontractor or crew member

• Your identity on the job — the name, mobile number and email address the firm gave us when it invited you, plus your firm's name and, if provided, its UEN and phone number. Used to address the invitation, to show the firm who is assigned, and to attribute the work you submit.
• Evidence you capture — site photos and voice recordings, with the time of capture and, where enabled, the location. Used as proof that work happened, so the firm can verify it and release the next trade.
• Availability you declare — the dates you say you cannot work. No reason is recorded and no client is named.
• Your responses to schedule dates — accepted, declined, or a date you proposed instead.
• Automated checks on what you submit — a flag if a photo looks like a duplicate of an earlier one, was captured away from the site, was captured outside the planned window, or is too dark or too muffled to read. These flags are advisory. They inform the firm's judgement. They never decide anything on their own and they never block your submission.

If you appear in a photo or a voice note

You may be in a site photo, or your voice may be on a recording, without ever using StampedID. That is still personal data about you, and it is held on the firm's instructions.

• The firm that runs the job decides whether to collect it and is responsible for telling you and for obtaining your consent where consent is needed.
• We store it, keep it private to that firm and to the subcontractor who submitted it, and delete it when the firm deletes it or when the retention period ends.
• If you want it removed, tell the firm. If you cannot reach the firm, write to us at hello@stampedid.com and we will pass the request on and tell you we have done so.

Why we are allowed to hold it

The PDPA works through consent, with a set of defined exceptions. In practice:

• You gave it to us. When you fill in a form, sign up, or capture a photo after seeing the on-screen notice, you are consenting to the use described at the time.
• We need it to do what you asked. Running a project, sending an invitation, signing you in, and keeping an audit record are all necessary to provide the service you or your firm asked for.
• We have to. Some records are kept because the law or a legitimate business need requires it, for example tax and accounting records once we charge for the product.

We will not use your personal data for a new purpose that you would not reasonably expect without telling you first. We do not sell personal data. We do not use it to train machine-learning models, our own or anyone else's.

Photos of people, and geotags

Location tied to a named worker is the most sensitive thing StampedID holds. We treat it that way.

• Location capture is optional per project. A firm turns it on or leaves it off, and capture never fails because location is missing.
• The device also has to allow it. If the person on site declines the location permission, the photo still uploads.
• Before the first capture, the field app shows a plain-language notice saying what is collected, who sees it, and why.

What the firm must do. If you are an interior design firm using StampedID, these are your obligations, not ours:

• Tell the people on your sites that photos and voice notes are being taken and what they are used for, and get their consent where the PDPA requires it. This includes your client's household members and anyone else who may walk into frame.
• Tell your subcontractors and their crew before you switch location capture on, and give them a real chance to object.
• Only upload what the job needs. Do not use site photos to record people for any purpose other than evidencing work.
• Have a lawful basis for sharing your client's address and contact details with us and with the subcontractors you invite.

We give you the controls. Using them properly is on you.

Who else touches the data

We use a small number of suppliers. Each one is listed here with what it does and where it runs.

• Supabase, on Amazon Web Services, ap-southeast-1 (Singapore) — the database, file storage and sign-in for the product. Project data, evidence files, and account records live here and stay in Singapore.
• OpenAI — reads the text of a quotation you upload and returns a draft project structure. Processing happens outside Singapore. See the next section.
• Vercel — hosts stampedid.com and the product front ends, and keeps short technical request logs.
• Cloudflare — DNS for stampedid.com, and email routing for hello@stampedid.com.
• Google Fonts — serves typefaces to your browser on the marketing site. Google receives your IP address as part of that request.
• Google (Gmail), via Cloudflare Email Routing — sends invitations, notifications and replies. We will name it here before we send our first message through it, and we will say where it runs.

We do not use WhatsApp, SMS or any messaging platform to deliver product notifications. If that changes, this list changes first.

Sending data outside Singapore

Evidence — photos, voice notes, and the location and timing attached to them — is stored in Singapore and is not sent overseas. Project records and account records are stored in Singapore too.

There is one exception, and we would rather state it plainly than bury it. When a firm uploads a quotation for automatic extraction, the text of that document is sent to OpenAI, which processes it outside Singapore. A quotation often contains a client's name, the property address and prices. If you do not want that leaving the country, do not use the quotation upload; enter the project by hand instead.

Where personal data is transferred out of Singapore, the PDPA requires us to take steps so it receives a standard of protection comparable to the PDPA. We do that through our contract with the recipient.

We do not send evidence to any overseas service for analysis. Judging whether a photo shows the trade it claims is the firm's job, not a model's.

How long we keep things

• Evidence and project records — until the project is completed, plus twelve months. Twelve months is the usual defects liability period, which is when a photo of what went in behind the tiles is still worth having.
• Account records — for as long as the account is open, and {90 days} after it is closed, to allow for recovery from an accidental deletion.
• Enquiries from the website — {24 months} from your last message, unless you ask us to delete them sooner.
• Audit records of verifications and corrections — for the life of the project record. These cannot be altered, which is the point of them.
• Records the law requires us to keep — for the period the law requires.

When a firm deletes a project or its account, we remove the database records and the stored files, including the image and audio objects themselves. "We keep it forever" is not something StampedID does.

Backups are retained for 30 days and are overwritten on that cycle.

How we protect it

• Evidence sits in a private store. It is never publicly readable. Access is through short-lived signed links.
• Every record is scoped to the account that owns it, enforced in the database, not only in the interface.
• Traffic is encrypted in transit. Stored data is encrypted at rest by our hosting provider.
• We do not browse firm evidence in the course of normal operation. We access an account's contents only when you ask us to help with a specific problem, or where we must to investigate a security incident or comply with the law.

No system is perfectly secure, and we will not pretend otherwise.

If something goes wrong

If personal data in our care is lost or exposed, we will investigate immediately. If the breach is likely to cause significant harm to the people affected, or affects a significant number of people, we will notify the Personal Data Protection Commission within three calendar days of deciding that it is notifiable, and we will tell the affected individuals and the affected firms as soon as practicable.

Where we hold data on a firm's behalf, we will tell that firm without undue delay so it can meet its own obligations.

We will say what happened, what was affected, and what we are doing about it. We will not minimise it.

Your rights, and how to use them

Under the PDPA you may:

• Ask what we hold about you and how it has been used or disclosed in the past year.
• Ask us to correct it if it is wrong.
• Withdraw your consent to us using it. We will tell you what stops working if you do.
• Ask us to delete it, where we are not required to keep it.

Write to hello@stampedid.com. We will acknowledge within {3 business days} and answer as soon as we reasonably can. If we cannot answer within 30 days, we will tell you when we will. We may ask you to confirm who you are before we hand over personal data, and there are a small number of things the law does not require us to disclose.

A firm can export its own data at any time from the dashboard, without asking us, and can delete a project or the whole account itself.

If the data you are asking about was put into StampedID by a firm, we will pass your request to that firm and tell you we have done so, because the decision is theirs.

Our data protection officer

Our Data Protection Officer is Ashiq Muhammad. Write to hello@stampedid.com, or hello@stampedid.com, marked for the attention of the Data Protection Officer.

If you are not happy with how we handled your request, you can complain to the Personal Data Protection Commission of Singapore at pdpc.gov.sg. We would rather you came to us first.

Marketing

We only email you about StampedID if you asked us to, if you enquired about the pilot, or if you are a customer. Every message has a way to stop them. We do not send marketing to Singapore phone numbers unless you have given us clear and unambiguous consent to do so.

Children

StampedID is a tool for businesses. It is not intended for anyone under {18}. Do not create an account for a minor, and do not enter a minor's personal data into a project.

Changes to this notice

This is a pilot-stage notice and it will be replaced with a fuller one before StampedID becomes generally available. When we change it we will update the date at the top. If a change materially affects how we use your personal data, we will tell account holders by email before it takes effect and, where the law requires it, ask for your consent again.

Questions about any of this: hello@stampedid.com.