Privacy Policy
AICT One (AI Construction Technology Unified Platform, the “Product”) is operated by AI Construction Technology Pte. Ltd. (“we”, “us”), which also provides technical support to users. This Policy explains how we collect, use, store, share, and protect personal data. The Product is available only to authorized employees and related personnel and does not offer public registration. Please read this Policy before use. We will obtain your consent where required by applicable law; some personal data may be processed for employment management, contract performance, legal compliance, or other legitimate business needs.
1. Information We Collect
Relevant personal data may be provided by you, your employer, labour agencies, intermediaries, or authorized company administrators. To support login, authorization, HR, dispatch, attendance, certificates, payroll administration, and site records, we may process the following categories of personal data:
- Identity and contact data: name, employee number, mobile number, gender, date of birth, nationality, address, and similar.
- Document and employment data: FIN No, passport, work pass, WP, IPA, role/position, project, and labour-company related data.
- Attendance and location data: GPS clock-in location, clock time, shift, hours, and project records.
- Payroll, bank, and tax data: salary master data, bank account details, and tax/compliance administration related data.
- Health and supporting materials: medical check, medical leave, work injury, and related evidence.
- Operational records: certificates, site photos, task start videos (including ambient audio captured together with the video), leave, resignation/offboarding, complaints, and blacklist-related records.
- Handwritten signature samples and related confirmation records: see the “Handwritten Signature Samples” section below.
- Account and technical data: account information, device identifiers (e.g. push ClientId), IP address, operation and diagnostic logs.
- Local credential cache: staff ID may be cached; if you enable “Remember password”, only a device-bound encrypted login credential (not a plaintext password) is stored on-device for next-time autofill and is cleared on logout; it is not uploaded to our servers for other purposes.
We do not request access to your entire photo library; images/videos are selected by you through the system picker. In-app photo preview for certificates/signatures uses the uni-app LivePusher component (underlying Tencent Cloud LiteAVSDK) and requires microphone permission to start preview; that path is on-device preview and local snapshot only, with no live push URL configured, so audio/video is not streamed to that provider. When recording a task start video, the system uses the microphone to capture sound; the audio track is saved and uploaded together with the video for site construction records and management. We do not use the microphone for independent call recording or unrelated audio collection.
2. Handwritten Signature Samples
The Product collects and stores workers’ handwritten signature samples and associates them with identity data such as name and employee number. A signature is used only after the worker confirms the specific matter, for the corresponding TBM (Toolbox Meeting) Report and related safety-management records. Worker confirmation is required before each use of a signature, and such confirmation is recorded. Signature and confirmation records may, to the extent necessary for safety audits, incident investigations, or compliance checks, be provided to project-related parties, auditors, or relevant Singapore regulators. Signatures will not be used for other documents without confirmation, or for purposes unrelated to safety management. Signatures may be entered by handwriting on the phone screen; in some business scenarios, signature-related images may also be captured with the camera or uploaded.
3. Purposes
We do not sell personal data. Data is mainly used for:
- HR and work-pass/document management for employees and foreign workers;
- Project dispatch, personnel transfers, attendance clock-in, and hours verification;
- Payroll, banking, tax, and related administration;
- Leave, offboarding, work injury, complaints, and safety management;
- Upload, storage, and playback of task start videos (including audio-visual content) for construction process records, verification, and safety management;
- Compliance matters such as MOM, IRAS, WP, and IPA;
- Approvals, access control, system security, audit, and dispute handling;
- Providing and improving product features, necessary business notifications, and meeting applicable legal obligations.
4. System Permissions
| Permission | Use case and purpose | Can revoke? |
|---|---|---|
| Camera | Capture certificates, site photos, and task start videos for upload | Yes; related capture/recording unavailable if revoked |
| Microphone | (1) Start the in-app LivePusher photo-preview component; (2) Capture ambient audio when recording a task start video; the audio track is uploaded together with the video for construction records and safety management. Not used for independent call recording or other unrelated purposes | Yes; may affect photo preview or video-with-audio recording if revoked |
| Location (while in use) | Confirm whether clock-in is within the site/office geofence and show position on the map | Yes; location-based clock-in unavailable if revoked |
| Notifications | Push business alerts such as dispatch, approvals, and attendance | Yes; push unavailable if revoked |
| Storage / Photos (if applicable) | Support image/video picking and local cache; prefer the system picker and do not read the entire album | Yes; may affect uploads if revoked |
5. Third-Party Services and SDKs
To provide Product features, we integrate the following services and share only the minimum data necessary to deliver those features. Service providers process personal data only to the extent required to provide the relevant services and must comply with applicable data-protection obligations:
| Service | Provider | Purpose | Data that may be involved | Storage location | Privacy policy |
|---|---|---|---|---|---|
| Google Maps | Map display and location-related display | Location, device and network-related information | Per Google service configuration | policies.google.com/privacy | |
| UniPush (including vendor channels) | DCloud and related push channels | Business message push | Device identifiers, push tokens, notification-related information | Per push-channel configuration | dcloud.io/license/appprivacy.html |
| Cloud servers (Alibaba Cloud International ECS) | Alibaba Cloud (Singapore) Private Limited | Host system operations, logs, and business data storage | Account identifiers and business data | Singapore region | This Policy; Alibaba Cloud International: Privacy Policy, Terms of Use |
| Object storage (Alibaba Cloud International OSS) | Alibaba Cloud (Singapore) Private Limited | Upload and storage of certificates, photos, signature samples, start videos, and other business files | Uploaded images, videos (including audio tracks), business files, and account identifiers | Singapore region | This Policy; Alibaba Cloud International: Privacy Policy |
| LivePusher underlying SDK (Tencent Cloud LiteAVSDK) | Tencent Cloud Computing (Beijing) Co., Ltd. | Powers in-app framed camera preview and local snapshot for certificates/signatures; this Product does not configure a live push URL and does not stream audio/video to that provider | Per vendor rules, may involve device model, operating system, network type/Wi‑Fi status, IP, and similar; camera frames are used for on-device preview and snapshot, then uploaded by us to our own object storage | Per Tencent Cloud service configuration | Tencent Cloud Live SDK Personal Information Protection Rules |
For HR, tax, safety, audit, and project-management matters, we may provide relevant personal data, to the extent necessary, to MOM, IRAS, auditors, project-related parties, and other bodies lawfully entitled to receive such information. We may also disclose data where required by law to regulators/law-enforcement authorities, or transfer it in a merger/acquisition (the successor must continue to provide equivalent protection). Except as stated above, we do not provide personal data to unrelated third parties without a lawful basis.
6. Cookies and Similar Technologies
The App/web may use local storage, device identifiers, and similar technologies for in-session login state, language and font preferences, push identifiers, and optional on-device encrypted “Remember password” credentials. We do not use these for personalized advertising.
7. Storage Location, Cross-Border Transfer, and Retention
Primary business data and backups are mainly processed and stored in the Singapore region. We engage Alibaba Cloud (Singapore) Private Limited to provide cloud servers (ECS) and object storage (OSS). That provider acts only as a data processor, processes data strictly on our instructions, and must not use it for other purposes. If processing outside Singapore is involved, we will manage it under the applicable terms of service and data-protection arrangements to meet Singapore PDPA cross-border protection requirements. We manage related data in accordance with the applicable terms of service and data-protection arrangements with the cloud provider. For system development, testing, deployment, maintenance, and technical support, we may engage authorized technical service providers located in China to process personal data to the extent necessary. Through contractual controls, access control, confidentiality measures, and secure transmission, we require them to process data only on our instructions and to provide protection comparable to Singapore PDPA requirements. External technical-support contact details are set out below.
Employee files and related business records are, in principle, retained for 7 years from the date of termination of employment, end of the engagement, or account deactivation. After the retention period, unless law requires continued retention or a dispute, investigation, or audit is ongoing, the personal data will be deleted, destroyed, or anonymized. Signature samples, signature confirmation/use records, employee files, attendance, payroll, tax, and related business records follow the applicable 7-year period; temporary caches and diagnostic logs without long-term need may use a shorter period. If deletion from backups is temporarily impossible, data is isolated and further processing is restricted until deletion is possible.
8. Security Measures
We apply reasonable technical and organizational safeguards, including encrypted transit (e.g. HTTPS), access control and least privilege, logging and audit, and staff confidentiality requirements. For sensitive data such as FIN No, passport, bank account details, health information, and handwritten signatures, we apply stricter access controls, masked display where appropriate, and retain corresponding operation logs. If a personal-data security incident occurs, we will notify you as required by applicable law (or via your enterprise administrator) and take remedial measures.
9. Your Rights
- Access and correct personal data relating to you;
- Request deletion, restriction of processing, or other rights where applicable law allows;
- Withdraw consent by revoking relevant device permissions, or by submitting a withdrawal request via your enterprise administrator or the data-protection email below; withdrawal does not affect the lawfulness of processing based on consent before withdrawal;
- Account deactivation or deletion: apply via your enterprise administrator, or email the data-protection contact below with your staff ID and request. After identity verification, we will handle the request within a reasonable time (generally within 30 days unless law requires otherwise). Enterprise-managed accounts may be deactivated directly by the administrator. Account deactivation or deletion does not mean related employee records are deleted immediately; materials that must be retained by law or for business needs continue to follow the 7-year retention period in this Policy.
You may also complain to your local data protection authority (Singapore users may contact PDPC).
10. Children’s Privacy
The Product is not directed to users under 18. We do not knowingly collect children’s personal data. If you believe such data has been collected in error, please contact us and we will delete it promptly.
11. Policy Updates
We may update this Policy from time to time. Material changes will be notified through in-product notices or similar means, and the date on this page will be updated. Where required by applicable law, we will re-obtain consent for material changes.
12. Contact Us
For privacy and personal-data matters, please contact:
AICT One is operated by AI Construction Technology Pte. Ltd., which also provides technical support to users.
Data Protection Officer (DPO) / privacy contact: Maintenance@siong.com.sg (for access, correction, deletion, complaint, and similar requests)