Privacy Policy

1. Personal Data We Collect

Account information includes your name, email address, phone number, and the role assigned to you within a shop (Owner, Manager, or Operator). Business information includes your shop name, business description, collection address, operating and ordering hours, menu content, and images you upload. Payout and verification information is collected by our payments provider and is described in section 4. Technical information includes device type, browser, IP address, and session identifiers. Usage information includes sign-in activity, actions taken in the dashboard and terminal, order and pre-order records, and an activity log of changes made to your shop.

2. How We Collect Data

We collect personal data when you register a shop, accept an invitation to join a shop, sign in, complete onboarding, publish shop details, upload menu or reward images, take orders through the terminal, start a subscription, connect a payout account, join a waitlist or Founding Seller form, or contact support. Certain technical and usage data is collected automatically when you use the Merchant Platform.

3. Purpose of Collection

We use personal data to create and administer merchant accounts, authenticate sign-in, control which staff may perform which actions, operate ordering, pre-orders, and the collection experience, publish your shop to customers, process subscriptions and platform fees, enable payouts, prevent fraud and abuse, provide support, maintain an audit trail of changes to a shop, improve reliability and performance, and comply with legal and regulatory obligations. We will not use personal data for unrelated purposes without your consent unless permitted under the PDPA.

4. Payment and Payout Data

Payments and subscriptions are processed by Stripe. We do not receive or store full card numbers, CVC codes, or bank credentials. Card details are submitted directly to Stripe and handled under Stripe's own terms and privacy policy.

To receive payouts you connect a Stripe account. Stripe collects the identity and bank information it requires to meet its regulatory obligations, and may verify your identity directly. We receive only the limited information needed to confirm your account status and reconcile transfers — for example, a Stripe account identifier, onboarding and payout status, and transaction and invoice records.

5. Third-Party Service Providers

We engage third-party providers to operate the Merchant Platform. Amazon Web Services (AWS) in the Singapore (ap-southeast-1) region hosts our databases, file storage, transactional email, and merchant sign-in. Stripe processes payments, subscriptions, and payouts. Google Firebase is used for limited form submissions and product analytics. Vercel hosts the web application and provides aggregate traffic analytics. These providers process personal data on our instructions and for the purposes described in this policy. We do not sell personal data.

6. Disclosure to Customers

Information you choose to publish — your shop name, description, menu, images, collection address, and operating hours — is shown publicly to customers on HomeFood. Order-related information is shared with the customer who placed that order so they can identify their collection. Consider carefully what you publish: your collection address is visible to customers who order from you.

7. Cross-Border Transfers

Core infrastructure is hosted in the AWS Singapore region. Certain providers — for example Stripe, Firebase, and Vercel — may process data on servers outside Singapore. Where personal data is transferred outside Singapore, we take reasonable steps to ensure the receiving organisation provides a standard of protection comparable to that required under the PDPA.

8. Data Retention

We retain personal data while your shop account remains active, and afterwards where necessary for fraud prevention, dispute resolution, tax, accounting, and other legal obligations. Transaction, invoice, and payout records are retained for the periods required by law. If you close your account, we delete or anonymise personal data that we are no longer required to keep.

9. Security Measures

We implement reasonable administrative, physical, and technical safeguards. These include hosting in the AWS Singapore region, encrypted transmission over HTTPS, managed authentication, role-based access controls that limit what each staff member can do, and signed verification of payment events received from Stripe. No online system is completely secure, and you are responsible for keeping your own sign-in credentials confidential.

10. Your Rights Under the PDPA

Under Singapore law you may request access to the personal data we hold about you, request correction of inaccurate or incomplete data, and withdraw consent, subject to legal and contractual limitations. Requests may be sent to support@homefood.sg. We may need to verify your identity before acting on a request.

11. Withdrawal of Consent

You may withdraw consent for marketing communications at any time. Withdrawing consent for data necessary to operate the Merchant Platform — for example account, order, or payout data — will mean we can no longer provide the service, and your shop may need to be closed.

12. Cookies and Website Technologies

We use cookies and similar technologies to keep you signed in, maintain session state, secure form submissions, and measure aggregate traffic. Sign-in cookies are strictly necessary: if you block them, you will not be able to use the Merchant Platform. You may manage other cookies through your browser settings.

13. Updates to This Policy

We may update this Privacy Policy from time to time. Revised versions take effect on publication to the Merchant Platform, and the effective date at the top of this page will be updated. Continued use of the Merchant Platform after publication constitutes acceptance of the updated policy.

14. Contact Information

For questions about this Privacy Policy or your personal data, contact COLLBINE PTE. LTD. at 254 Ang Mo Kio Avenue 4 #10-143, Kebun Baru View, Singapore 560254, or by email at support@homefood.sg. Our appointed Data Protection Officer may be contacted at the same address.