How HeyAda collects, uses and protects personal data — under Singapore's Personal Data Protection Act (PDPA).
Last updated 23 August 2026
We build websites and provide SEO, AEO and outsourced Data Protection Officer services. We ask our clients to take personal data seriously, so this notice sets out plainly what we do with yours.
We only collect what we actually need, and almost all of it is data you choose to give us.
Your name, email address, phone number, website address, and anything you write in the message box.
Your email address, the website address you want checked, and a record of what you agreed to and when. If you also opted in to occasional tips, that is recorded as a separate, independent consent — you can withdraw either one without affecting the other.
Your email address, and which guide you asked for.
Standard analytics data — pages viewed, approximate location (country/city level), device and browser type, and how you arrived. This is collected through cookies. It tells us which pages are useful; it does not tell us who you are.
Contact and billing details, and whatever is needed to deliver the work. Where we act as your outsourced DPO, we may handle personal data belonging to your customers — that relationship is governed by our services agreement with you, not by this notice. In that arrangement you remain the organisation accountable for that data; we act on your instructions.
We do not sell your personal data. We do not share it for anyone else's marketing.
Where we rely on your consent — marketing emails, for example — we ask for it separately from anything else, and we tell you what it is for at the time.
You can withdraw consent at any time: use the unsubscribe link in any email, or write to us at the address below. We will action it promptly. Withdrawing consent for marketing does not affect work we are already carrying out for you, and we may still need to contact you about an active project or a legal obligation.
We use a small number of established service providers to run the website and communicate with you. They process data on our behalf, under their own security obligations. Several are located outside Singapore, which means your data may be transferred overseas; we rely on their contractual commitments to provide a standard of protection comparable to the PDPA.
| Provider | What it does | Where |
|---|---|---|
| Vercel | Hosts this website | United States |
| Web3Forms | Delivers contact & site-check form submissions to us | Overseas |
| Resend | Sends guide downloads and reports by email | United States |
| Supabase | Stores enquiry and client records | Singapore region |
| Google Analytics | Website usage statistics | United States |
We do not keep personal data longer than we have a reason to.
Access is limited to people who need it. The site is served over HTTPS, private areas sit behind authentication, and our providers are chosen for their security posture. No system is perfect — if a breach occurs that is likely to cause significant harm, or that reaches the scale set out in the PDPA, we will notify the PDPC and affected individuals as the law requires.
Under the PDPA you may:
Write to our Data Protection Officer below. We will respond as soon as we reasonably can, and in any case within the timeframes set by the PDPA. There is no charge for a straightforward request.
If you are not satisfied with how we have handled your request, you may raise the matter with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.
We use cookies for two things: keeping you signed in to private areas of this site, and Google Analytics. We do not run advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; the site will still work, though signed-in areas will ask you to log in again.
If we change how we handle personal data, we will update this page and change the date at the top. Material changes affecting how we use data you have already given us will be notified to you directly.
HeyAda Pte. Ltd. · UEN 202602669E · hello@heyada.io