Privacy Notice

farefolk (“we”, “us”, or “our”) is a sole proprietor operating the farefolk platform in Singapore. This Privacy Notice explains how we collect, use, disclose, and protect your personal data in accordance with the Personal Data Protection Act 2012 (PDPA) and its 2020/2021 amendments.

By using the Service you consent to the collection, use, and disclosure of your personal data as described in this notice. If you do not agree, please do not use the Service.

We collect the following categories of personal data:

We collect and use your personal data for the following purposes (PDPA Notification Obligation, s.20):

• To create, authenticate, and maintain your account
• To operate group orders, process payments, and issue refunds
• To send transactional emails (magic links, payment receipts, order updates)
• To power the ratings system and Steady Kaki trust designation
• To detect, investigate, and prevent fraud, abuse, and security incidents
• To comply with legal, tax, and financial record-keeping obligations under Singapore law
• To investigate complaints and resolve disputes between users
• To improve the Service through aggregated, de-identified analysis

We will not use your personal data for purposes materially different from those above without obtaining your fresh consent.

We process your personal data on the following bases under the PDPA:

• Consent: you provide consent by creating an account and accepting these terms (PDPA s.13–14)
• Deemed consent by contractual necessity: processing reasonably necessary to provide the Service you have contracted for (PDPA s.15)
• Legitimate interests: security monitoring, fraud prevention, and aggregated service analytics, where these do not override your rights (PDPA s.15(1)(a))

We engage the following data processors to operate the Service:

We do not sell your personal data. We may disclose personal data when required by a valid court order, Singapore law, or to protect the safety and rights of users or third parties.

Several of our processors operate outside Singapore (PDPA Transfer Limitation Obligation, s.26). When transferring personal data overseas, we take steps to ensure that the recipient maintains a standard of protection comparable to the PDPA, including through Data Processing Agreements, Standard Contractual Clauses, or equivalent safeguards.

We retain personal data only for as long as necessary for the purposes set out above, or as required by Singapore law (PDPA Retention Limitation Obligation, s.25):

• Account and profile data: retained while your account is active; deleted or anonymised within 30 days of account closure, unless further retention is required by law
• Payment and order records: retained for 5 years to meet Singapore financial and tax record-keeping requirements (Income Tax Act, GST Act)
• Chat messages: retained for 12 months
• Anonymised aggregate analytics: retained indefinitely (no personal data)

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction (PDPA Protection Obligation, s.24). These measures include:

• HTTPS encryption for all data in transit
• Supabase Row Level Security (RLS) restricting access to your own data
• Hashed authentication credentials
• Rate limiting on sensitive operations
• No storage of card numbers or PayNow proxies
• Access to production systems on a need-to-know basis

No system is completely secure. If you believe your account has been compromised, contact hello@farefolk.app immediately.

Under the PDPA, you have the following rights:

• Right to access (s.21): request a copy of personal data we hold about you
• Right to correction (s.22): request that we correct inaccurate or incomplete personal data
• Right to withdraw consent (s.16): withdraw your consent at any time; note that withdrawal may affect your ability to use parts of the Service
• Data portability: when this PDPA obligation comes into force in Singapore, you may request that we transfer your data to another organisation in a commonly used machine-readable format

We aim to respond to all verified requests within 30 days. A reasonable administrative fee may apply to access requests in accordance with the PDPA.

Email hello@farefolk.app from your registered email address and state the request clearly (e.g. “access request”, “correction request”, “withdrawal of consent”). We may ask you to verify your identity before processing the request.

The Service is available to users aged 13 and above. Users under 18 must have the consent of a parent or legal guardian. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has provided us with personal data, please contact hello@farefolk.app and we will delete that data promptly.

We set only first-party Supabase authentication cookies, which are strictly necessary for sign-in and maintaining your session. We do not use advertising cookies, social-media tracking pixels, or cross-site tracking technologies.

Vercel Analytics does not use cookies and does not track you across other websites. You cannot opt out of authentication cookies without losing the ability to sign in.

In the event of a data breach notifiable under the PDPA (s.26D) (i.e. one likely to result in significant harm to affected individuals, or involving 500 or more individuals), we will:

• Notify the Personal Data Protection Commission (PDPC) within 3 calendar days of assessing the breach to be notifiable
• Notify affected individuals as soon as reasonably practicable

If you have a complaint about how we handle your personal data, please contact us first at hello@farefolk.app. We will investigate and respond within 30 days.

If you remain unsatisfied, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

farefolk has designated hello@farefolk.app as the point of contact for all PDPA-related queries (PDPA s.11). This inbox is monitored and we aim to respond within 5 business days for DPO-specific matters.

We may update this Privacy Notice from time to time. For material changes (particularly changes to the purposes for which we use your personal data), we will notify you by email or via an in-app notice at least 7 days before the change takes effect. The “Effective date” at the top of this page will always reflect the date of the most recent revision.

Continued use of the Service after the effective date of material changes constitutes your consent to the updated notice. If you do not agree, you must stop using the Service.

For any questions about this Privacy Notice or our data practices, contact us at hello@farefolk.app.