Privacy notice

Last updated 2 September 2026

Two different people

This notice covers two groups: the businesses who hold a Yesladder account, and the people who fill in their forms. For form answers, the business is the data controller and Yesladder is a processor acting on their instructions.

If you hold an account

We store your email address, an encrypted password, your workspace and forms, and a Stripe customer reference if you subscribe. We use them to run the service and to contact you about it.

If you filled in a form

We store the answers you gave, the time, the page you came from, your browser’s user agent, a reference code, and the consent wording you were shown. This is passed to the business whose form you completed. We do not sell it, and we do not use it to advertise to you.

We do not ask for your phone number. If you press send in WhatsApp, your number becomes visible to that business through WhatsApp, not through us.

Consent

The exact wording you agreed to is stored alongside your answers, with the time you agreed, so there is a record of what was actually shown rather than a tick in a box.

Who else processes it

Supabase (database and authentication, Singapore region), Vercel (hosting) and Stripe (payments, account holders only). No one else.

How long we keep it

Submissions are kept while the business’s account is open. A business can delete a form and its submissions, and can ask us to delete their account and everything in it.

Your rights

You can ask for a copy of your data, ask for it to be corrected or deleted, or withdraw consent. Write to andrew@heyandrewtan.com. If you filled in someone’s form, we will pass the request to that business, since the data is theirs.

Where it lives

The database is hosted in Singapore. Yesladder is operated from Singapore and handles personal data under the Personal Data Protection Act.

Contact

andrew@heyandrewtan.com