Privacy Policy
What this site collects, it collects because you typed it, plus the anonymous page counts and the cookies described below.
Last updated 25 September 2026
Who is responsible
Paul Garcin (CEA Reg. No. R074475G), of PropNex, Licence No. L3008022J, is the data controller for hiddengems.sg. Reach me on WhatsApp through any button on the site.
What is collected
- Your details, when you fill in the form
- Your name, mobile number, email, the bedrooms and purpose you tick, the button and page you used, and the advert that brought you, recorded with the consent you ticked, word for word (
Paul Garcin (PropNex) may contact me about new launches by phone, WhatsApp or email.
) and the time you gave it. They are saved first in this site's own database (run by Upstash for the site's host, Vercel), then kept in a Google Sheet in my Google account and emailed to me, and used only to contact you about the launches you asked about. A request to delete them deletes them from all three. - Whatever you send on WhatsApp
- The conversation itself, carried by WhatsApp under Meta's own terms and privacy policy.
- Which advert brought you
- If you arrive from an ad, the campaign parameters in the link (
utm_*,fbclid,gclid) are held in your browser's session storage, so that a tap on a WhatsApp button can be matched to the advert it came from. Nothing is added to the message you send. It is cleared when you close the tab. - A test cookie
- When wordings of a button are being compared, a cookie (
hg_v, a single letter, kept for 30 days) remembers which one you saw so it stays the same on your next visit. It identifies nothing about you. - Booking details, if you book a call
- Held by Calendly under their terms.
The host, Vercel, counts which pages are visited. It sets no cookie and keeps no identifier that follows you between visits or sites; it records the page, the country and the kind of device, in aggregate.
The map on a residence page is drawn with tiles from OneMap, the Singapore Land Authority's map service, which sees your IP address when you open the map. It is not told who you are or what you read.
The site also carries the Meta Pixel, which sets a cookie and tells Meta which pages you viewed and whether you tapped a WhatsApp button, so that advertising can be measured and shown to people who read a project. The site's server sends Meta the same events, with your IP address, your browser and that cookie, so they are still counted when a browser blocks the pixel. Neither receives your number or anything you type. You can opt out of Meta's ad tracking in your Facebook or Instagram settings.
If you arrived from a Google advert, the site carries the Google Ads tag, which sets a cookie holding the identifier of the advert you clicked, and tells Google when you tap a WhatsApp button, so that the advertising can be measured. It is told that the tap happened and nothing else: not your number, not anything you type, not the Gem List, and no page you read without tapping. You can turn off ad personalisation in your Google account settings.
The site also carries Microsoft Clarity, which records how a page is read: where you tap, how far down you scroll, and the movements of the visit, which can be played back as a recording. Anything you type is masked in your browser before it is sent, so no number and no message reaches Microsoft, and a recording carries no name. It is here so that a page nobody reads to the end can be found and written better. Clarity sets a cookie on this site to tell one visit from the next, and Microsoft sets a few of its own on clarity.ms, one of which it also uses for advertising across its sites; you can turn that off in your Microsoft account's privacy settings. Microsoft's handling of the data is under its own privacy statement.
Standard server logs kept by the host may record your IP address and browser for security and reliability.
What it is used for
- Replying to you.
- Sending the top three you asked for, and which units in each.
- Telling which advertising campaign a conversation came from, in aggregate.
- Seeing where a page loses its readers, so it can be rewritten.
Your details are never sold, rented, or shared for anyone else's marketing.
Your choices under the PDPA
You can ask what is held about you, have it corrected, or withdraw consent at any time. Reply STOP to any message, or message me and say so. Withdrawal takes effect within ten working days, and your details are deleted. Your number reaches me only through the form you fill in or a WhatsApp conversation you open yourself.