Privacy notice

What we collect

On the public pages of this website: no cookies, no analytics and no forms. Our hosting provider keeps ordinary server logs, such as IP address, browser type and the pages requested, to keep the site running and secure.

In the customer area: your email address and the way you sign in, which are handled by our sign-in provider; it sets the cookies needed to keep you signed in. We also keep the details of your business that you give us there, including what kind of business it is and how your customers reach you, your requests and our replies, and your monthly reports.

Pictures of your own pages: when you ask for a change to your website, we take a picture of the page for you to point at. These pictures are kept privately. Only you and our staff can open them.

When you write to us: your name, your email address and whatever you choose to tell us.

When you pay: checkout is run by Stripe. It asks for your email address, business name, phone number and card details. Stripe passes us your contact details and the status of your payments. We never see or store your full card number.

While we work for you: details of your business, the content you give us, and access to accounts such as your Google Business Profile. We also see figures from those accounts, such as how many people viewed your profile.

Your customers’ enquiries: the website we build for you may collect enquiries from your customers, and on Local Growth their outcomes are recorded in FormDumpling. We handle this information on your behalf, to provide the service to you and for nothing else.

Tests of your website: each week we have Google test your public website for speed and good practice, and we keep the scores. No personal data is involved.

If you connect your Google account

In the customer area you can connect a Google account, so that we can read the figures for your reports without you adding us to each account by hand. Google asks you what to share and you can untick anything. What we ask for:

• Google Analytics, to read only: the visits to your website.
• Google Search Console, to read only: the searches that lead people to you and where you appear for them.
• Google Business Profile: your profile’s details and activity, and the ability to post to it and edit it for you. Google offers no read-only access to a profile.
• Google Ads: the results of your ads, if you run any. The access Google offers also allows changes; we only read.

We use this access only to provide your plan: to set up and look after your profile, to show you your figures in the customer area, and to put them in your monthly report. We do not use it for advertising, we do not sell it, and we do not use it to train AI models. Our people look at it only to do that work, to keep the service secure, or where the law requires it.

We keep a copy of the figures we read, so that your dashboard and reports can show how they change: day by day from the last 16 months onwards, and each month's searches, pages and sources of visits. We keep them for as long as you are a customer.

Your figures also count, with no name attached, in the averages we show our customers for businesses of the same kind. Only where a group sits is ever shown, never one business's figures, and only for groups of at least five businesses. Apart from that, we do not pass what we read to anyone else.

Little Red Pin’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We store the key Google gives us in encrypted form. You can disconnect at any time in the customer area, which removes it from our records and from your Google account. You can also remove our access in your Google account’s own security settings.

If you have no Google Analytics or Search Console of your own, we set them up for your website in our own Google account and read your figures from there. They are for your website only, and we hand them over to you if you leave.

Why we use it

• To answer you when you write to us.
• To set up and run your plan, and to report to you each month.
• To take payment and keep our accounts.
• To keep our website and services secure.
• To meet our legal duties.

We do not sell personal data and we do not use it for advertising.

Who we share it with

We share personal data only with the services we need to run Little Red Pin: Stripe for payments, our hosting provider, our sign-in and database providers, Google for your Business Profile and search reporting, FormDumpling for enquiry tracking, and our email provider. We may also share it with our professional advisers, or where the law requires it.

Some of these services store data outside Singapore. Where they do, we take reasonable steps to make sure it is protected to a standard comparable to the PDPA.

How long we keep it

We keep personal data for as long as we need it for the purposes above, and for as long as the law requires us to keep business and accounting records. After that we delete it or make it anonymous.

You can ask us at any time to delete the figures we have read from your Google account or the pictures we have taken of your pages.

Your choices

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or withdraw your consent to our using it. If you withdraw consent we may not be able to keep providing the service, and we will tell you if so.

Email hello@littleredpin.com. We will reply as soon as we reasonably can, and within 30 days.

If you are not satisfied with our answer, you can contact the Personal Data Protection Commission of Singapore.

Keeping it safe

We limit access to the people who need it and use reputable providers. If a data breach is likely to cause significant harm, we will tell the people affected and the Personal Data Protection Commission, as the PDPA requires.

Changes to this notice

We will post any change on this page and change the date at the top. If a change is significant we will also email our customers.

Data protection contact

Our data protection contact is hello@littleredpin.com.