Privacy notice

1. What we collect, and why

If you are looking for work (candidate): your name, email, phone if you give it, nationality, where you are now, and the kind of work you want. Purpose: to show you jobs, to let you apply, and to let employers who have posted a job contact you when you apply. Nothing here is sold, and nothing here is shared with anyone except the employer you choose to apply to.

If an agency lists you (your details reach us from an overseas employment agency): your name, date of birth, email, phone, the country you are from, where you are now, the kind of work you do, how many years of experience you have, and the salary you are looking for. Your agency passes us these details under its agency agreement with us, and it confirms to us that it is authorised to list you. Purpose: to show you to Singapore employers hiring for a job that can get a work pass, so that an employer who wants you can reach your agency about you. Nothing here is sold, and nobody sees your details except the employers considering you for a job and the agency acting for them — not insurers, not property agents, not marketing lists. You can ask us to remove your details at any time, your agency can take you off, and nobody may charge you for being on the board.

If you are hiring (employer): company name, contact name, work email, the content of the ads you post, and the hiring criteria you write. Purpose: to publish your ad, to run the compliance check on it, and to take payment when you buy a plan or a boost.

If you use a tool: the text you type into it. Purpose: to produce the answer you asked for. If you use a CV tool, that text is your CV — it is handled under the separate consent in section 4.

Consent records: when you tick a consent box we store which statement you agreed to, the time, and the network address the request came from. Where your details reach us from your agency, the record we keep is your agency's warranty about you — which agency uploaded it, under which licence, and when — not a box you ticked. Purpose: to be able to show what was agreed and by whom. This is our evidence, and we keep it even after you ask us to delete other data.

Basic technical data: standard server logs (IP address, time, page requested) and privacy-friendly, cookieless visit counts. We do not run advertising cookie trackers and we do not build a profile of your browsing.

2. How long we keep it

• Candidate profile: while your profile is active, and deleted automatically 24 months after your last activity on the site (your last application or tool use). Our daily housekeeping job enforces this — it is not a promise on a page.
• Job ads and applications: 24 months from the date of the ad or the application, then deleted.
• Consent records: 5 years, because they are the proof that the consent happened.
• Payment records: kept as long as tax and accounting rules require.
• Server logs: short-lived.

You can ask for earlier deletion — see section 7.

3. Who else sees it

We use a small number of service providers to run the site, and we name them. Vercel hosts the site and serves every page. Supabase holds the database. Brevo sends our email (a second provider is tried first and refuses our domain, so nothing is delivered through it). Airwallex takes payments — card details are handled by Airwallex and we never see your card number. Cloudflare gives us cookieless visit counts. DeepSeek and OpenRouter run the AI behind the free tools, and they see the text you type only after you tick the consent box in section 6. They process data on our instructions only, and none of them may use it for their own purposes.

When you apply to a job, your application and the contact details you give go directly to that employer and to nobody else. It goes to that employer alone, not to other employers, and not back through us.

4. Sending data outside Singapore: a separate consent

Our AI tools and parts of our infrastructure are outside Singapore, so if you use a CV tool the text you submit is transferred out of Singapore to be processed. The PDPA requires a higher standard of care for transferring personal data out of Singapore, and the people most affected here are candidates outside Singapore — most often in the Philippines, Myanmar and India, whose data leaves their own country as well.

So this is a separate tick box, not buried in the general terms, on the candidate sign-up and on every CV tool: "I understand my personal data may be transferred outside Singapore for processing, and I agree to that transfer." You can use the site without ticking it — the tools simply will not run, because they need the transfer to work. We record that consent separately in the consent log, so it is visible on its own, and you can withdraw it at any time from the same address in section 7.

Where the law of your own country gives you a stronger right than this notice does, that stronger right applies to you.

5. Checks done by other people: verified credentials

Some things shown on this site are checked by somebody other than us. Those appear with the name of whoever checked them and the date, they are not our badges, and we do not grant them.

The free checks run by the Singapore government are not run by us. Work pass validity and safety training records are checked at MOM's own eServices, food hygiene at the Singapore Food Agency, security officer licences at the Singapore Police Force, and Singapore qualifications at SkillsFuture. We link you straight to them. We do not receive the result and we cannot see it, so nothing from those checks appears on your profile as a claim made by us.

An identity document check is different, and it is the only one that may cost money. It is not switched on yet, so nothing is checked, nothing is sent anywhere today, and nobody is charged anything. When it is switched on, the site will state plainly who pays the fee — the candidate or the employer — before anyone uses it. If you choose it once it is, a commercial identity company checks your document and matches your face to it. That sends a copy of your document and a photograph of your face outside Singapore, so it needs its own consent, separate from everything else, stating where the data goes and what protects it — that wording is written out in full and recorded separately in the consent log. The company doing it stores the data in Ireland and processes it in the European Union, the United Kingdom, the United States and Brazil, with a contracted review team based in India. You may withdraw that consent at any time using section 7 below.

You can use every other part of BestHirePath without that check. Nothing on this site holds an application back for not having one, and no employer sees a candidate differently for not having one.

A checked credential is shown with the company's name and the date it was checked, and it carries an expiry date. We do not display an expired check, and we do not display one that failed.

We never charge you for any check, and no employer's cost is passed on to you. Where a commercial company carries out a check, that company is paid by the employer or by us — not by you.

6. Nothing goes into an AI tool until you tick the box

Every tool on this site asks for consent first and records it. If the box is not ticked, the tool does not run and no text is sent anywhere. The AI does not make decisions about you: it does not screen, score, rank, reject or shortlist anybody, and it never tells you whether you personally qualify for a pass — MOM decides that.

7. Your rights: see it, correct it, delete it

Write to hello@besthirepath.com and ask to see what we hold, to correct it, or to delete it. We action deletion requests within 30 days, free of charge, including data held by the providers above. You can also ask us to stop contacting you.

If you are not satisfied with how we handled it, you can complain to the Personal Data Protection Commission of Singapore (pdpc.gov.sg).

8. Cookies and measurement

No advertising cookies, no cross-site tracking, no data sold. We count visits three ways and all three are cookieless: our own counter, which records the page viewed, the site you arrived from and the country you arrived from, and keeps no IP address and sets no cookie; Cloudflare Web Analytics, which counts page visits and does not follow you to other sites; and Vercel Speed Insights, our hosting provider's own measurement, which reports page speed and visit counts. None of them sets an advertising cookie, none of them profiles your browsing, and none of them sells anything. Signing in uses a session cookie that is necessary for the site to work.