Cashew
Legal

Privacy Policy

Last Updated: 7 March 2026

1. Introduction

Welcome to Cashew ("Platform," "we," "us," "our"). We are committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://www.cashew.sg, use our mobile application (if any), or utilize our services (collectively, the "Services") to explore, compare, or apply for mortgage products.

This Policy is designed to comply with Singapore's Personal Data Protection Act 2012 ("PDPA") and other applicable laws. By using our Services, you consent to the data practices described in this policy.

2. Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions, concerns, or requests regarding your personal data, please contact our DPO at:

Sebastian Sieber, Managing Director
[email protected]
NMAKI SG Pte Ltd, Data Protection Officer, 8 Marina View, #43-01, Asia Square Tower 1, Singapore 018960

3. Personal Data We Collect

  • Identity Data: Full name, NRIC/FIN number, passport number, date of birth, gender, nationality, photographs, and other government-issued identification details.
  • Contact Data: Residential address, email address, telephone numbers.
  • Financial Data: Income details, employment history, bank account details, credit history, existing loans, assets, liabilities, and investment details.
  • Property Data: Property you intend to purchase or refinance (address, type, value, etc.).
  • Transaction Data: Applications and services you’ve used through our Platform.
  • Technical Data: IP address, browser, device, and system information.
  • Usage Data: Pages visited and time spent on our Platform.
  • Marketing and Communications Data: Marketing and communication preferences.
  • User-Provided Content: Feedback, survey responses, or support interactions.
  • AI Interaction Data: Messages, queries, mortgage parameters, property details, financial information, and any other content you provide during interactions with our AI-powered features, including the AI Assistant and AI-driven mortgage comparison tools.

4. How We Collect Your Personal Data

  • Direct Interactions: Account creation, form submissions, document uploads, and communication.
  • Automated Technologies: Cookies, server logs, and similar technologies.
  • Third Parties: Credit bureaus, lenders, government agencies, and analytics providers.
  • AI-Powered Features: When you use our AI-powered services (such as the AI Assistant or AI-driven mortgage recommendations), the content of your interactions — including messages, queries, and any mortgage or financial parameters you provide — is transmitted to third-party AI service providers for processing and response generation.

5. Purposes for Collection, Use, and Disclosure

  • Account registration and management.
  • Mortgage comparison and application facilitation.
  • Identity verification and KYC/AML compliance.
  • Communication and customer support.
  • Platform analysis and improvement.
  • Marketing and communication with your consent.
  • Compliance with legal obligations.
  • Internal audits, analytics, and business operations.
  • Consent-based additional purposes.
  • Providing AI-powered mortgage advisory, comparison, and conversational assistance services by transmitting relevant interaction data to third-party AI service providers for processing.

6. Disclosure of Your Personal Data

  • Lenders and Financial Institutions.
  • Credit Bureaus with consent.
  • Property Valuers and Insurers.
  • Service Providers under contract.
  • Professional Advisors (lawyers, auditors, insurers).
  • Regulatory and Government Authorities.
  • In Business Transfers.
  • Other Parties with your consent.
  • Third-Party AI Service Providers. To power our AI-driven features, we transmit AI Interaction Data (as defined in Section 3) to third-party AI model providers through our AI infrastructure partner, OpenRouter (OpenRouter LLC). The AI models accessed through this infrastructure are provided by Anthropic (Anthropic PBC) and OpenAI (OpenAI, LLC). The specific data transmitted includes conversation messages, mortgage queries, property details, and financial parameters that you provide during your use of AI-powered features. No data is transmitted to these providers unless you have consented to the use of AI-powered services.

    OpenRouter, our AI infrastructure provider, does not store prompts or responses by default and offers Zero Data Retention (ZDR) routing, which ensures that requests are only sent to provider endpoints that do not retain user data after processing. We configure our integration to use providers with zero data retention and no-training policies, meaning your data is used solely for generating responses and is not retained or used to train AI models.

    All third-party AI service providers are bound by their respective data processing terms, which require them to process data solely for the purpose of providing the requested service and to implement administrative, physical, and technical safeguards to protect user data. We select and configure providers to ensure protections that are consistent with or exceed the standards set out in this Privacy Policy and the PDPA.

7. AI-Powered Features and Data Processing

Our Platform includes AI-powered features such as the AI Assistant, AI-driven mortgage comparisons, and personalised mortgage recommendations. These features are provided through third-party AI services as described in Section 6.

What data is processed. When you use AI-powered features, the content of your conversation — including messages, mortgage preferences, property details, and financial parameters you provide — is transmitted to third-party AI service providers for processing. Technical metadata such as session identifiers may also be transmitted for operational purposes.

Who processes your data. AI requests are routed through OpenRouter (OpenRouter LLC) to AI models provided by Anthropic and OpenAI. OpenRouter acts as an infrastructure intermediary and is configured to not log or retain your prompts and responses.

How your data is protected. We configure our AI infrastructure to enforce zero data retention and no-training policies. This means your conversation data is processed only to generate a response and is not stored by the AI provider or used to train or improve AI models. All transmissions are encrypted in transit.

Your consent and control. Use of AI-powered features requires your consent. For users of our mobile app, consent is obtained through an explicit opt-in during account registration and may be withdrawn at any time through the Settings screen. For users who interact with our AI-powered services through third-party messaging platforms such as WhatsApp, consent is provided by initiating and continuing a conversation with our AI assistant. You may withdraw consent at any time by ceasing to use the AI-powered features or by contacting our Data Protection Officer. Withdrawal of consent does not affect data previously processed during prior interactions.

AI limitations. AI-generated content is advisory in nature and should not be treated as professional financial, legal, or tax advice. We do not guarantee the accuracy, completeness, or suitability of AI-generated responses.

8. International Data Transfers

Your data may be transferred outside Singapore. We ensure protection equivalent to PDPA using approved contracts or certified frameworks.

9. Data Security

We implement encryption, access controls, secure servers, and staff training. However, no online system is 100% secure. We take reasonable steps to safeguard your data.

10. Data Retention

We retain data as long as needed for its purpose and legal compliance. Once no longer required, we delete or anonymize it securely.

11. Your Rights under the PDPA

  • Right to Access: Request your personal data and usage.
  • Right to Correction: Fix inaccuracies in your data.
  • Right to Withdraw Consent: Cease data processing by request.
  • Right to Data Portability: Request data transfer in standard format (if applicable).

Contact our DPO to exercise your rights. We may verify your identity and charge a reasonable fee where applicable.

12. Cookies and Similar Technologies

We use cookies and tracking tools to enhance experience and analytics.

  • Essential: Enable core functions.
  • Performance: Understand usage.
  • Functionality: Remember preferences.
  • Marketing: Serve relevant ads.

Manage cookies via browser settings. Disabling cookies may affect site functionality.

13. Third-Party Websites

We are not responsible for the privacy practices of linked third-party sites. Please review their privacy policies before sharing your data.

14. Updates to This Privacy Policy

We may update this policy. The “Last Updated” date reflects changes. We notify users of material updates through the Platform or email.

15. Governing Law

This Privacy Policy is governed by Singapore law.

16. Contact Us

If you have any questions, please contact our Data Protection Officer:

NMAKI SG Pte Ltd
8 Marina View, #43-01, Asia Square Tower 1, Singapore 018960
[email protected]