Privacy Policy

Mandy Tan determines why independently collected MyAdvisor.sg information is used and is responsible for its handling. MyAdvisor.sg is her website and brand, not a separate legal entity. Nylacore Private Limited provides technology and data-processing support on her behalf; its access is limited to what is needed for that role.

This policy covers the reflection service. It does not authorise the use of your information for a separate regulated financial-advisory engagement.

• Contact and booking details: your name, email, optional telephone number, appointment time and any message you choose to provide.
• Quiz and report information: your answers, skipped items, descriptive scores, money themes, archetype descriptions and the client report and restricted guide generated from them.
• Session information: points Mandy records from the optional conversation, including your priorities, examples, corrections and any reflection step or follow-up you choose. Saved drafts and completed session records may be held separately.
• Consent and access records: the relevant acceptance or permission, timestamp, source and policy versions; Mandy’s sign-in credentials and session records; and restricted report-link records.
• Technical information: information processed for website operation and security, such as IP addresses, device or browser details, request times and error logs.

Some answers or notes may include personal, emotional, health or family circumstances. Share only what is needed and what you feel comfortable discussing. You can skip questions. Please avoid identifying other people unnecessarily and do not submit passwords, one-time codes, identity documents, payment-card details or account statements.

We use your information to produce and make available your client report and Mandy’s restricted guide, respond to your enquiry, arrange a session you request, support that conversation and its notes, and protect and maintain the service. We also keep records of the permissions you give and handle privacy requests or legal obligations.

Reports use predefined scoring and interpretation rules applied to your answers. They provide reflection prompts, rather than decisions about credit, insurance, investment suitability, financial-advisory eligibility or a clinical diagnosis.

The quiz asks you to acknowledge its educational purpose and the preparation and storage of the two reports. Optional permission for Mandy to contact you about a reflection session is separate from seeing your report. A booking requires its own confirmation.

These choices do not authorise unrelated marketing, financial-product recommendations or advisory referrals. Where a new purpose requires consent, we will explain it and seek the relevant permission before using your information for it. Information may also be handled without consent where the law permits or requires it.

After you submit the Financial Psychology quiz, your responses are processed to prepare your reflection report. Your results are not displayed immediately on the completion screen. An email containing a link to access your report is sent to the email address you provided once the report is ready. Processing and email-delivery times may vary.

Your online report remains available for 30 days from quiz completion. Please keep the report email and access link private. Your client access does not provide access to Mandy’s restricted guide or session notes.

Mandy accesses the reports and any saved session notes through her password-protected administration portal. Access by technology-support providers is limited to what is necessary to operate, maintain and secure the service.

Mandy may prepare and save a separate document following a reflection session. You may request a copy or correction. Downloaded, printed or emailed copies are separate records; expiry of online access does not remove those copies.

If you choose the appointment button in your report, we reuse your saved name, email and optional telephone number to pre-fill the booking form. You can edit them before confirming. This step does not create an appointment or send the quiz answers to Microsoft.

The transfer uses a short-lived encrypted cookie. It expires after ten minutes and is cleared when the booking form reads it. The personal contact details are not added to the booking URL. Details entered or edited in the form are sent for appointment handling only when you submit the booking.

Necessary providers may process information to host the website, store and secure records, maintain the platform or handle a requested appointment. These include the Sites hosting platform and its Cloudflare infrastructure, Nylacore’s technology support, and Microsoft 365 services used for bookings and calendar communications.

For a confirmed booking, Microsoft Bookings or Outlook receives the contact details, appointment information and optional booking message needed to handle it and send the confirmation. Quiz responses, scores, reports and session notes are not automatically sent as part of that booking. Avoid putting sensitive reflection details into the optional booking message.

We do not sell reflection data or use the quiz, contact form, reports or session notes to create or transfer financial-advisory leads. Nylacore’s technology role does not permit it to reuse this information for its own marketing or referrals. A future service you independently request must have a separate process, purpose notification and any necessary permission; accepting this policy is not permission to transfer the reflection record to a financial-advisory firm.

Information may be disclosed to authorities or other recipients where legally required, or where otherwise permitted by law, including an applicable emergency exception. Only information relevant to that purpose should be disclosed.

Hosting, backups, security operations and appointment providers may process information outside Singapore. A Singapore-only storage or processing guarantee should not be assumed. We are responsible for meeting the applicable PDPA requirements for overseas transfers, including appropriate safeguards for a comparable standard of protection. Accepting this policy does not waive those requirements.

Contact us for current provider details and the applicable transfer arrangements.

Controls include HTTPS for production communications, encryption of stored quiz-report payloads and session-note records, restricted password access, expiring non-predictable report links and server-side handling of service credentials. Mandy’s password is stored as a salted password hash rather than readable text. Her portal session expires after four hours unless she signs in again.

No system can guarantee absolute security. Keep report links, credentials and downloaded documents private. Use a safe contact method if another person’s access to your device or finances is a concern.

Your online client report access expires 30 days after quiz completion. This access period is separate from the retention of information held by MyAdvisor.sg. Expiry of your report link does not automatically delete your quiz responses, generated reports or related session records from the administration portal.

These records may be retained beyond the client access period where reasonably necessary to support a reflection session or follow-up you request, address an enquiry or complaint, or meet an applicable legal or business requirement. Access remains restricted to authorised persons who need the information for those purposes.

We review retained information regularly and delete, anonymise or securely dispose of it when it is no longer needed for the purposes for which it was collected or for a legitimate legal or business purpose. We do not retain personal information indefinitely merely because no deletion request has been received.

Booking records, correspondence, consent records, security logs and backups may have different retention periods according to their purposes and applicable requirements.

You may request deletion by contacting dpo@myadvisor.sg. We will assess your request and explain any legitimate reason for retaining particular records.

You may request access to personal data we hold about you, information about how it was used or disclosed during the preceding year, and correction of inaccurate or incomplete personal data, subject to applicable legal exceptions. We may reasonably verify your identity before releasing information.

We will respond as soon as reasonably possible. If we cannot complete an access or correction request within 30 days, we will let you know in writing within that period when we expect to respond. Any reasonable access fee will be explained in advance; we do not charge for correcting personal data.

You may also raise a privacy concern or ask us to delete information. A deletion request is considered against the purpose of retention and applicable obligations; it is not an unconditional right to erase every record.

You can withdraw consent for future collection, use or disclosure by contacting us with reasonable notice. We will explain the consequences and stop the relevant activity unless continued handling is required or permitted by law. Withdrawal may prevent us from providing a report or session that depends on that information.

Permission to discuss a requested reflection session is not permission for unrelated campaigns. Any separate marketing must meet applicable consent, Do Not Call and other requirements and provide a way to opt out. You do not have to agree to marketing to access your report.

The site uses necessary cookies for Mandy’s secure portal session and the short-lived booking pre-fill described above. Website scripts may keep campaign-source parameters in browser session storage and record limited interaction events, such as starting the quiz or selecting a booking button. Quiz answers, archetypes, scores, report identifiers and personal contact details are not included in those analytics event fields.

If you choose to contact Mandy through WhatsApp, that provider’s terms and privacy practices apply. The current quiz flow does not automatically send reports through WhatsApp. Privacy settings or cookie restrictions may affect functions that rely on them.

We will assess suspected personal-data breaches, take appropriate steps to contain and address them, and notify the PDPC and affected individuals where the law requires. We will update this policy when the service or relevant requirements change. A revised policy does not by itself authorise a new purpose for data previously collected.

For privacy questions, access or correction requests, withdrawal of permission or complaints, write to dpo@myadvisor.sg. You can also contact Mandy by email or telephone. Please describe your request without sending unnecessary sensitive documents.