CareerNexus Workforce Platform · Last updated: 27 May 2026
INGENIA AI LAB PTE. LTD. ("Ingenia", "we", "us", "our") is a technology company incorporated in Singapore. We operate the CareerNexus Workforce Platform — a multi-tenant SaaS solution for Singapore hospitality and services employers that manages part-time workforce registration, scheduling, attendance, timesheets, payroll, and invoicing.
We act as both a data controller (for platform users' accounts and our direct communications) and a data processor (when we process workforce data on behalf of our hotel and employer clients, who are the data controllers for their workers' information).
This Privacy Policy applies to:
It covers data processed through our web application, mobile-optimised portal, and WhatsApp Business Cloud API integration.
When a worker registers on the platform, we collect:
| Category | Data Points | Sensitivity |
|---|---|---|
| Identity | Full name, preferred English name, NRIC/FIN number, date of birth, gender, race, ethnicity, nationality, citizenship status, Permanent Resident start date | High |
| Contact | Mobile number, WhatsApp number, email address, residential address, unit number, postal code | Medium |
| Financial | Payment method preference, bank name, bank account number, PayNow registration type and number | High |
| Documents | NRIC / FIN front and back photos, Singpass digital ID image, school ID front and back, school card expiry date, Foreign Student Verification documents | High |
| Employment | Work history, part-time experience, food hygiene certification status, preferred shift timings, preferred working days, institution/school name | Low |
| Health | Medical conditions (declared voluntarily), medical conditions details | High |
| Criminal History | Criminal conviction status (yes/no), conviction details (declared voluntarily) | High |
| Emergency Contact | Emergency contact person name and phone number | Medium |
| Consent & Signature | Digital signature image, consent checkbox timestamps, declaration acknowledgements | Medium |
See Section 5 for full details on WhatsApp data processing.
| Purpose | Legal Basis (PDPA / GDPR) |
|---|---|
| Worker registration and identity verification | Contractual necessity; Legitimate interest |
| Workforce scheduling, shift assignment and management | Contractual necessity |
| Attendance tracking and timesheet validation | Contractual necessity; Legal obligation (MOM compliance) |
| Payroll calculation and bank disbursements (CPF/SHG) | Legal obligation; Contractual necessity |
| Invoice generation for employer clients | Contractual necessity |
| Platform communications (shift notifications, payslips) | Contractual necessity; Consent |
| WhatsApp Business communications with hotel managers | Legitimate interest; Consent |
| AI-powered scheduling assistance and analysis | Legitimate interest |
| Security, fraud prevention, and audit compliance | Legal obligation; Legitimate interest |
| Platform improvement and analytics | Legitimate interest |
We use the Meta WhatsApp Business Cloud API to enable registered hotel managers to communicate with our platform via WhatsApp. This integration is only available to hotel contacts who have been explicitly registered by a platform administrator.
Meta Platforms, Inc. processes message metadata as part of the WhatsApp Business Cloud API service. This processing is governed by Meta's WhatsApp Privacy Policy and the WhatsApp Business Terms.
Hotel managers who no longer wish to be contactable via our WhatsApp integration may request removal of their number from our system by contacting support@ingenialab.io or asking their platform administrator to de-register their contact.
We use AI services to enhance platform capabilities:
AI-generated memories (observations about part-timers, work patterns, preferences) are stored in our database and associated with your tenant account. These are used solely to improve scheduling recommendations for that tenant.
We do not use your personal data to train third-party AI models. API usage is subject to Google's and OpenAI's respective data processing terms.
We share data with the following categories of sub-processors and service providers:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase, Inc. | Database, file storage, real-time messaging | All application data including worker profiles, documents, messages | AWS (Singapore/US) |
| Google LLC | AI inference (Gemini), OAuth authentication | Query context, message content for AI processing; email for OAuth | Global |
| Meta Platforms, Inc. | WhatsApp Business Cloud API | WhatsApp phone numbers, message content | US / Global |
| Stripe, Inc. | Payment processing (subscription billing) | Billing information (no worker bank details) | US |
| Redis / Upstash | Queue processing, API caching | Temporary job data and cached API responses | Configurable |
| SMTP provider (per tenant) | Transactional email delivery | Recipient email addresses and email content | Per tenant config |
We may also disclose data:
| Data Category | Retention Period |
|---|---|
| Part-timer registration profiles | Duration of engagement + 7 years (for CPF/MOM compliance) |
| Payroll records | 7 years (Singapore Employment Act requirement) |
| Timesheets and attendance records | 5 years |
| Invoices and financial records | 7 years (IRAS requirement) |
| WhatsApp messages | 2 years from receipt, or until contact de-registration |
| Platform chat messages | 2 years |
| Audit logs (PII access) | 5 years (append-only, cannot be deleted) |
| Deleted / inactive accounts | Anonymised after 90 days of inactivity notice |
After the retention period, data is securely deleted or anonymised. Legal obligations may require us to retain certain records longer than the above periods.
We implement appropriate technical and organisational measures including:
Despite these measures, no system is completely secure. If you become aware of a security issue, please contact support@ingenialab.io immediately.
Under the Singapore Personal Data Protection Act (PDPA) and, where applicable, the GDPR, you have the following rights:
To exercise any of these rights, submit a written request to support@ingenialab.io. We will respond within 30 days. We may need to verify your identity before processing your request.
To request deletion of data collected in connection with our WhatsApp integration or Facebook/Meta app, please visit our Data Deletion Request page.
You have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.
We use the following minimal cookies:
We do not use advertising cookies, third-party tracking cookies, or analytics cookies that identify individuals. There are no cookie consent banners because we only use strictly essential cookies.
Our platform is intended for adults entering the workforce. We do not knowingly collect personal data from anyone under the age of 16. Student workers between 16 and 18 who register must provide school verification, and by doing so, they or their guardians consent to this processing.
If we become aware that we have inadvertently collected personal data from a child under 16, we will delete it promptly.
Our primary database infrastructure is hosted on Supabase in the AWS Singapore region. Some data is processed by services with global infrastructure (Google, Meta). When data is transferred outside Singapore, we rely on:
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For material changes, we will provide notice via the platform or by email at least 14 days before the change takes effect.
Your continued use of the platform after the effective date of any changes constitutes your acceptance of the revised policy.
For privacy-related queries, data access requests, or to report a concern:
For urgent matters or data breach notifications, please mark your email subject line [URGENT DATA PRIVACY].