Dasar Privasi

Summary

This summary is provided for convenience only. The sections that follow constitute the policy.

• We hold your account details (mobile number, verified email address and profile preferences) in order to authenticate you and provide the service.
• Each store you join maintains its own records of your bookings, points, packages, balances, invoices and notes. The store controls those records and responds to requests concerning them.
• You pay stores directly. We do not receive card or bank details at any time.
• We do not sell personal data, conduct behavioural advertising or train artificial intelligence models on your data (section 3.1).
• You may delete your account at any time (section 9), or contact admin@kyglu.com regarding any matter in this policy.

Definitions

In this policy, the following expressions have the meanings set out below. Other expressions are defined where they first appear.

"Applications" means the Kyglu customer mobile applications for iOS and Android.

"Customer" means an individual who books services, holds a balance or earns rewards with a store through Kyglu, whether through the applications or the portal.

"Customer Terms" means the Kyglu Customer Terms of Use, which govern a Kyglu customer account.

"Data intermediary" has the meaning given in the Personal Data Protection Act 2012, namely an organisation that processes personal data on behalf of another organisation and not for its own purposes.

"Kyglu", "we", "us" and "our" means KYGLU TECHNOLOGY PTE. LTD. (UEN 202639469E), 68 Circular Road, #02-01, Singapore 049422.

"Merchant Terms" means the Kyglu Merchant Terms of Use, which govern a business's use of Kyglu to operate its store.

"Personal data" has the meaning given in the Personal Data Protection Act 2012, namely data about an individual who can be identified from that data, or from that data together with other information to which we have or are likely to have access.

"Portal" means the Kyglu customer web portal accessed in a web browser using the same account as the applications.

"Service provider" means a company that provides services to us and handles personal data on our instructions in the course of doing so (section 6).

"Store" means a business that operates on Kyglu, including its public listing and its authorised staff.

"Website" means the Kyglu corporate website at kyglu.com.

"Workspace" means the area of our systems belonging to a store that holds that store's records, settings and staff accounts.

"You" and "your" means the customer, unless a provision states that it is addressed to store owners and staff or to individuals without a Kyglu account (section 1.1).

1. Who we are and what this policy covers

KYGLU TECHNOLOGY PTE. LTD. (UEN 202639469E), 68 Circular Road, #02-01, Singapore 049422 ("Kyglu", "we", "us" or "our"), is responsible for the personal data described in this policy.

This policy applies to our website, kyglu.com, and to enquiries sent to us by email; to the Kyglu customer mobile applications; to the Kyglu customer web portal; and to the systems that support them. Where a provision applies to only one of these, this policy states so.

Two agreements accompany this policy. The Customer Terms govern a Kyglu customer account, whether used in the application or the portal. The Merchant Terms govern a business's use of Kyglu to operate its store.

1.1 To whom this policy is addressed

Customers. This policy is addressed primarily to customers: individuals who book services, hold a balance or earn rewards through Kyglu. In this policy, "you" refers to the customer.

Store owners and staff. This policy explains how the personal data of your customers is handled. Personal data relating to your own business account (name, email address, sign-in and security records) is governed by the Merchant Terms rather than this policy.

Individuals without a Kyglu account. A store may keep records about you and send you messages through our systems even if you do not hold an account. Those records belong to the store; see section 1.3.

1.2 Your Kyglu account and a store's records are distinct

We operate your Kyglu account, including sign-in, security, store discovery and support. That is our responsibility, and this policy describes it.

Each store operates its own business and determines which customer, appointment and payment records it keeps and how it uses them. We hold those records on the store's behalf and on its instructions; under Singapore's Personal Data Protection Act 2012 we act as the store's data intermediary. The Merchant Terms establish that allocation of responsibility, and the store's own privacy policy applies to its records.

An individual may hold one Kyglu account and have records at several stores. Joining one store does not give any other store access to your activity.

1.3 Individuals who have not created a Kyglu account

A store may keep records about you, and send you reminders through our systems, without your holding an account. Those records belong to the store and its privacy policy applies to them. Please contact the store directly regarding such records, or refer to section 10.

2. Personal data we collect

2.1 Website visitors and enquiries

The website has no user accounts, contact form, payment facility or login. We hold only the information you send us by email (name, email address, organisation, message and attachments); ordinary technical data used to operate and protect the website (IP address, browser and device type, page requested, time and security signals); our correspondence with you; and website analytics data (section 5).

2.2 Your account

Your account holds your mobile number and country code; a recovery email address and its verification status; your chosen name, gender, service interests and language; and identifiers for the account itself. Your telephone number is used to sign you in, and a verified email address enables you to recover the account should you lose access to that number. You may clear optional profile details at any time. Where the details required to sign you in or to complete a booking you have requested are not provided, that feature will not be available.

2.3 Information a store records about you

Each store you join maintains its own records, which may include:

• Your relationship with the store: membership and invitation details, contact details you have provided to it, date of birth, preferences and membership tier.
• Services and visits: bookings and amendments to them, attendance, and session packages purchased and used.
• Rewards: points earned and redeemed, vouchers and benefits.
• Payments: quotations and invoices issued to you by the store, and the store's record of what you paid, when and by what means. You pay the store directly; we do not receive your card or bank details.
• Prepaid balances: the amount you paid, any amount added, the amount spent, the balance remaining, and the expiry date of any bonus. This information is displayed in your wallet for that store, together with a receipt for each top-up.
• Notes: information recorded by staff in order to serve you properly, which may include allergies or sensitivities you have disclosed to them (section 2.6).

These records belong to the store. Its authorised staff may view them, and the store's own privacy policy applies to them.

Prepaid balances are funds held by the store, not by us. We record the balance so that you and the store hold a consistent account of it; we do not receive or hold the funds and are unable to pay them out. If a store closes or leaves Kyglu, any unused balance is a matter between you and the store; the Customer Terms explain the position of each party. For so long as the store's records remain with us, we will provide you with a copy of your balance record on request. If the store deletes its workspace (section 9), that record is deleted together with everything else the store held. You should retain your own receipts; the application displays one for each top-up.

2.4 Information we record when you use the service

Location, camera and notification permissions are controlled through your device settings and may be withdrawn at any time. We do not track your location in the background, upload your address book, record audio or read files on your device. Any new use of that nature would require specific notice and permission beforehand.

2.5 Reviews and shared links

Reviews. You may review a service following a completed appointment. Your reviewer name, rating, review text, date and the store's reply may appear on the store's public listing. Reviews are public and are not private messages to the store; you should not include other individuals' contact details, health information or confidential material. To remove your own review or to report inappropriate content, please contact us; there is no self-service control, and we act on such requests manually.

Document links. A store may send you a link to view a quotation or invoice without signing in. Any person holding the link is able to open the document; you should therefore treat the link with the same care as the document itself.

2.6 Sensitive information

The service is not designed to hold identity documents, banking passwords, full card details or medical records. You should not enter unnecessary sensitive details in free-text fields. A store that requires sensitive information for its services must explain its purpose and handling to you separately.

3. Purposes for which we use personal data

We use personal data for the following purposes:

• to operate your account, sign you in and maintain the security of the service;
• to provide the bookings, balances, rewards and notifications you have requested;
• to deliver messages that a store asks us to send you, in accordance with your preferences (section 6.2);
• to respond to enquiries and maintain records of them;
• to operate, troubleshoot and secure the website, portal and applications;
• to protect our rights, investigate misuse and prevent security incidents; and
• to comply with legal, accounting and regulatory requirements.

Any new purpose that requires your consent will be explained to you separately.

3.1 What we will not do with your data

We do not sell, rent or license personal data, whether to data brokers, advertising networks or any other party seeking a marketing list.

We do not conduct behavioural advertising or profile you for that purpose. We measure how our website and portal are used (section 5); however, we do not use that information to target advertising at you, do not enable our analytics provider's advertising features, and do not share personal data with advertising platforms.

We do not build a cross-store profile of you. Each store sees only its own relationship with you; we do not combine stores' records into a profile that we use, sell or license.

We do not train artificial intelligence models on your personal data or private content, including reviews, service notes, appointments, messages and support correspondence, whether the model is our own or that of another company, and we do not permit any provider to do so.

There are two exceptions. First, we produce aggregated statistics from which you cannot be identified. Secondly, if Kyglu is acquired or merges with another entity, personal data may pass to the successor, which remains bound by this policy until it lawfully amends it (sections 6.3 and 13).

4. Consent, notifications and marketing

When you email us, you provide the information for the purpose of your message and for the related purposes set out in this policy. Where we rely on your consent, you may withdraw it by contacting us. Withdrawal takes effect prospectively and may mean that we are no longer able to provide the related feature or message; we will then cease the collection, use or disclosure concerned unless the Personal Data Protection Act 2012 or other applicable law requires or permits us to continue.

4.1 Two sets of controls

Per store. Each store you join holds its own permissions in respect of its record of you: whether it may send you marketing communications (disabled unless you or the store records your agreement) and appointment messages (enabled by default, as they form part of the service you booked). These settings are located in your profile for that store.

Per device. Each device on which the application is installed has its own notification settings (all notifications, marketing, appointment reminders and points activity), in addition to the permission granted at operating-system level.

Both sets of controls apply. A promotional notification reaches you only where the store is permitted to send you marketing communications, the device accepts marketing notifications and the operating system allows them. To stop all marketing communications from a particular store, you should change that store's permission rather than the device setting.

4.2 Matters unaffected by your preferences

Disabling push notifications does not remove items from the in-application notification centre or from public store pages. Booking confirmations and account-security and recovery messages are sent irrespective of marketing preferences. Acceptance of the Customer Terms does not constitute permission for unrelated marketing. A notification may be visible on a locked device; you may wish to disable previews if that is unsuitable.

5. Cookies, analytics and crash reporting

5.1 Website

We use Google Analytics, deployed through Google Tag Manager, to understand how kyglu.com is found and used: pages read, search terms and links, approximate location, and device and browser. We use this information to improve the website, not to identify you or to advertise to you. Google Analytics sets cookies that recognise a returning browser and processes your IP address to estimate location. Google is our service provider for this purpose and processes the information outside Singapore (section 7). You may block or delete analytics cookies in your browser or use Google's opt-out tool.

5.2 Customer portal

The portal uses necessary session and request-protection cookies to keep you signed in and to protect forms; blocking them prevents those functions from operating. The portal also uses Google Analytics, in the same manner as the website. We do not transmit your identity to Google: your name, telephone number, email address and account number are not passed to it. Google receives the pages viewed, approximate location, device and browser, and not your identity or the contents of your records.

5.3 Mobile applications

The applications store sign-in state and preferences on your device (section 2.4). If the application crashes, a report is sent to Firebase Crashlytics, a Google service, describing the failure, the device and application version, and the steps taken immediately beforehand, together with an identifier that distinguishes one device's crashes from another's. Reports are used to rectify faults, not to identify you or to study how you use the application. Crash reporting forms part of the application and is not a configurable setting.

6. Disclosure and service providers

We disclose only such personal data as a stated purpose reasonably requires. Section 3.1 sets out what we will never do.

Certain companies that provide services to us handle personal data in the course of doing so; we refer to them as service providers. They act on our instructions and may use the data only for the service they provide to us, save where their own legal or security obligations require otherwise.

6.1 Stores

Joining a store, requesting to join, accepting an invitation or presenting a linking code enables that store to identify you and administer the relationship; its authorised staff may use the relevant contact, membership, booking and payment information. Browsing a public listing does not create a membership. A store's notes are not shared with other stores. Leaving a store ends the membership within Kyglu but does not erase records that the store is separately required to retain.

6.2 Authentication, messaging and push notifications

Telephone verification. Google verifies that the number belongs to you and receives the number and the technical data required for that purpose. We retain the result, and a reference to your account, for so long as the account exists.

SMS. Where a code is sent by SMS, a messaging provider receives your number and the message; the provider used may depend on your country.

Email. Our email provider delivers verification, recovery, enquiry and support messages, together with messages that a store asks us to send you, such as appointment and payment reminders, subject to your permissions for that store.

Push notifications. Firebase Cloud Messaging and the operating-system push service handle device identifiers and notification content.

Analytics and crash reporting. Google, as described in section 5.

Calendar. Where a store connects a Google account, we send its appointments, including your identity on them, to its calendar on the store's instructions.

We name providers where doing so is material to you, and describe interchangeable infrastructure such as hosting, email and SMS delivery by category. A current list is available on request.

6.3 Other disclosures

We may also disclose personal data to the companies that host, secure and support our systems; to professional advisers, auditors or insurers under obligations of confidentiality; to authorities, regulators, courts or law enforcement agencies where the law requires or permits; and to a successor in a genuine corporate transaction, subject to appropriate protections. None of the foregoing authorises disclosure to another Kyglu customer.

6.4 Links and external services

A WhatsApp click-to-chat link passes the destination number and prepared text to WhatsApp; it does not upload your chat history or send anything automatically, and it is used by store staff rather than within the customer applications. Map, website and payment links are handled by the service you open, under its own privacy policy.

Payments. You pay a store directly. No payment passes through us, we hold no card or bank details, and there are no in-application purchases. The store records in the application that you have paid, so that your invoice, receipt and any prepaid balance are accurate.

7. Processing outside Singapore

Some of our service providers process data outside Singapore. Where that occurs, we take reasonable steps to ensure that the data remains protected to a standard comparable to that required by the Personal Data Protection Act 2012. Please contact us for details of the arrangements that apply.

8. Retention

We retain personal data only for so long as it is required for its purpose or for a specific legal or business reason, after which we delete it or remove the identifying link. The retention of a financial record does not justify the retention of an unrelated profile, public link or marketing permission. Residual copies may remain for a limited period in backups and logs; they remain protected and are not used for any other purpose.

9. Deletion of your account or workspace

Customers. You may request permanent deletion of your Kyglu customer account by using the delete-account control in the mobile application, or by emailing admin@kyglu.com with the subject line "Kyglu account deletion".

We verify that you are the account holder before acting, as described in section 10. Uninstalling the application or signing out does not constitute deletion.

Deletion removes your account and profile, your memberships and per-store profiles, devices, notifications and reviews, and signs you out on all devices.

Deletion does not remove a store's own records of you. Records such as appointments, invoices and payment history may remain with the store with the link to your account removed. Tax law requires the store to retain invoices and payment records for a number of years after the sale (section 8), and those records may continue to hold your name, telephone number and email address. Removal of the link does not render those records anonymous.

You are not required to settle any matter with a store before requesting deletion. Deletion does not cancel a booking or alter any amount a store owes you; the Customer Terms address those matters. You should retain any receipts you may require. Registering again creates a new account and does not restore your previous history.

Businesses. If you operate a store on Kyglu, you may delete your workspace by writing to admin@kyglu.com from the workspace owner's email address, with the subject line "Kyglu workspace deletion". There is no self-service control in the web application. We verify that the request originates from the owner and then remove the workspace from our active systems; backup copies expire on the 30-day cycle described in section 8, so that deletion is complete within 30 days of a verified request.

Workspace deletion removes everything in the workspace: the store's profile and settings, staff accounts, customer records, appointments, quotations, invoices, receipts, prepaid balances, packages, points, notes, reviews and activity history. Deleted records cannot be recovered. Before submitting a request, you should take copies of anything you need to retain, including the invoices and payment records that tax law requires your business to keep; Kyglu does not retain them on your behalf.

Workspace deletion does not remove Kyglu's own records of your subscription, such as the invoices we issued to you and our payment-provider references, which we retain for our own accounting and tax obligations (section 8); nor does it remove your customers' own Kyglu accounts, which continue without the link to your store.

10. Access, correction, withdrawal of consent and complaints

Please write to admin@kyglu.com to access or correct your personal data, withdraw consent, enquire about deletion or make a complaint. There is no self-service export facility; we handle requests manually.

We aim to respond promptly and will complete requests within 30 days. Should we require longer, we will notify you in writing before the 30 days have elapsed and provide an expected date. We verify that a request originates from the account holder, and we never request your password or a verification code for that purpose. We may decline or limit a request where the law permits or requires, and will inform you of the reason.

For a store's records, please contact the store; Kyglu does not determine whether a store must amend or erase them. If you contact us instead, we may assist in identifying the store from information that remains lawfully available and, with your permission, forward the request to it.

If our response does not resolve the matter, please inform us and we will review it again. You may also lodge a complaint with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

11. Security

We apply reasonable safeguards appropriate to the data, including encrypted connections, access restrictions, separation of each store's data from that of every other store, and the use of reputable service providers. Sign-in codes are never stored in readable form and expire promptly.

A small number of named Kyglu staff are able to access platform data in order to operate the service, rectify a fault, respond to a support request, or view the product as a store's staff see it. Such access requires two-factor authentication and is recorded in a log that those staff cannot alter.

No internet system is entirely secure. In the event of a data breach, we will assess it and notify the Personal Data Protection Commission, affected individuals and any affected store where the law so requires.

12. Children

Kyglu customer accounts are available to individuals aged 18 or over, as the Customer Terms require. We do not knowingly permit an account to be held by a child. A store may nonetheless lawfully hold information about a younger customer for the purposes of its own services, for example where a parent books on behalf of a child; those are the store's records.

If you believe that a child holds an account, please contact admin@kyglu.com. A mobile number assists us in locating the account but is not proof of guardianship. We take proportionate steps to verify the requester's identity and authority before acting, without requesting unnecessary documentation concerning the child, and if the account is confirmed to be ineligible we delete it in accordance with section 9. We also act on credible concerns that we identify ourselves.

13. Changes to this policy

We may update this policy when our services, practices or legal obligations change; the published version displays its date. Where a change materially affects data you have already provided to us, we will take reasonable steps to inform you. An update does not constitute consent to any new use that requires consent.

14. Data Protection Officer and contact details