Privacy Policy

1. Information we collect

• Account details: name, email address, phone / WhatsApp number and password (stored only as a secure hash by our authentication provider).
• Vendor applications: brand name, contact person, business category, social media links, answers to the Organiser's questions, and any photos, logos or documents you upload.
• Organiser business verification: company or business name, registration number (e.g. SSM), and the identity and registration documents you upload. These are stored in a private bucket that only you and Popgo's admin reviewers can open.
• Payout bank details (Organisers): bank name, account holder and account number. Account numbers are encrypted at rest.
• Payment records: amounts, dates, status and the payment reference from our payment partner. We never see or store your full card number or online banking credentials.
• Usage data: basic device, browser and page-view information used to keep the platform secure and working.

2. How we use your information

• To create and run your account and let you apply for, approve and manage event booths.
• To process booth payments, refunds, safety deposits and Organiser payouts.
• To verify Organisers before they can receive payouts, and to prevent fraud and abuse.
• To send transactional messages by email and WhatsApp (application updates, payment confirmations, event reminders). You can opt out of non-essential messages at any time.
• To meet our legal, tax and accounting obligations, and to improve the platform.

3. Who we share it with

We do not sell your personal data. We share it only where needed to provide the service:

• Event Organisers: when you apply to an event, the Organiser sees your application, brand details, contact details and uploads.
• CHIP (chip-in.asia), our licensed Malaysian payment partner, to collect payments, issue refunds and send payouts.
• Service providers that host or deliver the platform for us: database and file storage (Supabase), website hosting (Vercel), email delivery (Resend) and WhatsApp messaging (Meta). They process data only on our instructions.
• Authorities, where required by Malaysian law or a valid legal request.

Some of these providers may store data on servers outside Malaysia. Where that happens we rely on providers that apply security measures at least as protective as those required by the PDPA.

4. How long we keep it

• Account and profile data: for as long as your account is open.
• Application uploads and verification documents: for as long as your account is open, and deleted within 30 days after you close your account or ask us to delete them, unless they are still needed for an open dispute.
• Payment, refund and payout records: 7 years, as required for Malaysian tax and accounting purposes. These records cannot be deleted early, even if you close your account.
• Messages and logs: up to 12 months.

5. Your rights

Under the PDPA you may ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is inaccurate or out of date (most of it you can edit yourself in your account settings);
• delete your account and uploads, subject to the record-keeping rules above;
• stop sending you marketing or other non-essential messages.

Email teampopgo@gmail.com from the address on your account with the subject "Data request". We will confirm your identity and respond within 21 days. If a request cannot be completed (for example, payment records we must keep), we will tell you why.

6. Data security

We use encryption in transit, encrypted storage for bank account numbers, private storage for identity documents, row-level access rules on our database and access limited to authorised staff. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.

7. Cookies

We use cookies needed to keep you signed in and to protect forms, plus privacy-friendly analytics that measure page views without advertising tracking.

8. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date and, for significant changes, notify you by email.