Data Deletion & Retention Policy — HomeKampung
v0.4.21 · Last revised 6 November 2026 · In force since 1 Nov 2026
Some timed deletions run automatically; the rest are honoured by hand. Since 7 October 2026 a clean-up runs every night shortly after midnight (Singapore time) and removes: order-throttle device counters from before today, blocked order attempts older than 30 days, order day counters older than 90 days, payment screenshots from checkouts that were never completed once they are more than 24 hours old, shop History entries older than 12 months (plan, payment, suspension and account entries excepted), email send log entries older than 13 months, closed buyer reports older than 24 months, orders past their clear-out date in a shop's bin (below), and banned-list entries past their 3 years. A Seller's per-day shop statistics are trimmed to their plan's window each time that Seller opens their Analytics page. Every other period in the tables below is a commitment we honour by hand, and on request. Deleting a product, a review, a customer or a shop does remove its files from storage at once, not just its database rows, unless another part of the platform is still displaying that same file, in which case it is removed as soon as nothing displays it any more. Deleting an order moves it to the shop's bin (since 19 October 2026): it leaves the Seller's lists and counts at once, can be restored for 30 days, and is removed for good — its payment screenshot with it — on its clear-out date (see "Order bin" below). Only an order that never went ahead can be deleted; one with a payment on it must be cancelled first. Email dpo@homekampungsg.com and we action a request within 30 days.
Timelines
- Deletion requests are actioned within 30 days of receipt, by email to dpo@homekampungsg.com. A Buyer can also ask the Seller directly, who has a one-step erasure control (below). A Seller cannot delete their own account from the console — write to us and we delete the shop.
- Backups. We keep backups, in Singapore, so the service can be restored after a failure; they are not used to bring deleted data back. Database backups are encrypted, with the key kept off the server; in the file backup, payment screenshots and documents stay encrypted as they are in the service, and the copy kept off the server is encrypted as a whole. A record you delete can persist in a backup for up to about five weeks before every copy of it is gone; a deleted file leaves every file backup within about a week (our own copies within two days; the hosting provider keeps its daily disk images for seven).
- You may withdraw a single consent without deleting your account. We hold no marketing consent to withdraw today, because we send no marketing.
What Happens to Each Data Category on Shop Deletion
Shop deletion is done by us, on the Seller's request, from the operator console.
| Category | On deletion | Why |
|---|---|---|
| Login, profile, settings | Deleted | No continuing purpose |
| Shop page, listings, images | Deleted, including every uploaded image: logo, banner, product and review photos, about-page images, the PayNow QR, and the Seller's own order photos. Files leave live storage at once (a file still displayed elsewhere on the platform is removed once nothing displays it) and the nightly mirror the following night | Seller-owned content |
| Seller verification documents | Deleted with the shop. Also deleted earlier if we reject or revoke the badge, or the Seller uploads a replacement | Retained only while a badge is pending or active |
| Seller payment display details | Deleted | No purpose post-account |
| Reviews of the shop | Deleted with the shop, including review photos. A review is about the shop, so it has no home once the shop is gone. (Buyer erasure, below, does not touch reviews: a review carries the name the reviewer typed and a link to its order, and the reviewer can ask us to remove it. When an order is erased, its review stays and the link points at an order with no name or phone left on it.) A review edited by its buyer keeps only the edited text and the time of the edit. Review links are not stored, so there is nothing of them to delete. A record that the Seller asked for a review or marked the link as sent (the order, the time, whether the message read like a reward) is deleted with its order, and so with the shop. A review HomeKampung removes is not deleted: it is taken off the shop page and out of the star rating, and kept with the reason, the date and which of our team removed it, so the removal can be explained or reversed; it is deleted with the shop | — |
| Orders and customers | Deleted with the shop, including payment screenshots and the shop's bin. Not automated while the shop exists: there is no age-based anonymisation of old orders; orders stay until the Seller erases the customer, bins the order (cleared after its period), or the shop is deleted. A shop under an evidence hold cannot be deleted until the hold is lifted | The Seller's own records |
| Our billing records for the shop | Deleted with the shop today. Keeping them for the five years the tax authorities may expect is a change we must make before relying on it | IRAS/audit obligations |
| ToS acceptance records | Deleted with the shop today. Keeping them six years as evidence of the contract is likewise a change we must make | Legal defence of the contract |
| Per-day shop statistics | Deleted with the shop | — |
| Shop History | Deleted with the shop | No continuing purpose |
| A record that the shop was deleted | Kept for 6 years after the deletion: the shop's name, its shop link, its plan, the date it joined, the date it was deleted, and how many products, orders and reviews were removed — nothing else. No listings, orders, customers, contact or payment details survive in it | So HomeKampung can account for removing a shop it hosted, if the Seller or anyone else later asks what happened to it |
| Buyer payment confirmations | Deleted when the order is removed for good (cleared from the bin, or deleted forever), with buyer erasure, and with the shop; purged from storage, not just unlinked | Held only to settle that one order |
| Order-throttle counters and blocked attempts | Deleted with the shop; otherwise removed by the nightly clean-up | Purpose exhausted |
| Email send log entries about the shop | Kept, unlinked: the entry stays (what kind of email, when, whether the provider accepted it) and its link to the shop is cleared. It never held the address or the content | Our usage against the provider's limits is a platform count, not shop data |
Retention While Active
Rows marked nightly clean-up expire automatically; every other period in this table is a target honoured on request — see the note at the top of this document.
| Category | Period |
|---|---|
| Enquiry message content | None held. An enquiry is a count, not a message; HomeKampung holds no chat inbox, so no WhatsApp/Instagram/Facebook/Telegram message content is stored at all |
| Verification documents | While the badge is pending or active. Deleted on rejection, revocation or replacement, and with the shop |
| Billing records | Life of the shop (see above; five years is the target once records survive deletion) |
| Logs | Three kinds. (1) Each shop's History — orders by number, status changes, product, discount, review and settings changes, sign-ins with device type, and HomeKampung's actions on the shop. The shop sees the last 90 days on Starter, 12 months on Growth, up to its latest 2,000 entries on screen. Entries are removed after 12 months by the nightly clean-up, except plan, payment, suspension and account entries, which are the shop's billing and account record and are kept for the life of the shop. (2) The web server's access log (IP address, page, browser) — 30 days. (3) There is no log of who opened which document or screenshot — committed work |
| Buyer payment confirmation images | Deleted when the order is removed for good — cleared from the bin, deleted forever by the Seller, or erased with the Buyer. A screenshot uploaded during a checkout that was never completed is removed by the nightly clean-up once it is more than 24 hours old. The same applies to a receipt a Seller attaches to an order they entered by hand; a receipt the Seller replaces is deleted at once |
| Order bin | An order the Seller deletes goes to the shop's bin. It can be restored at any time until it is cleared. An order no money was ever behind (unpaid, no screenshot) is cleared 30 days after binning by the nightly clean-up, or at once if the Seller deletes it forever. An order with a payment on it (marked paid, or carrying a screenshot) must be cancelled before it can be binned, cannot be deleted forever by the Seller, and is cleared at the later of 30 days after binning and 30 days after its delivery date — so a Buyer's chance to report it does not close before the goods were due. A Buyer who looks a binned order up is told it was removed by the shop and can still report it. The Seller's erasure control (below) reaches binned orders too, at once |
| Evidence hold | While HomeKampung has placed an evidence hold on a shop — for a report or an investigation — none of its data is purged by the clean-up (binned orders, History, closed reports) and the shop cannot be deleted. Lifted by an operator when the matter is settled; the normal periods then resume. Visible to our operators only |
| Identifier fingerprints (a shop's own trail) | Keyed one-way fingerprints of the login email, phone numbers, PayNow, bank account and shop name a shop has used, written when set or changed. Life of the shop; deleted with it |
| Banned list | Fingerprints copied from a shop's trail when it is closed for fraud, with the reason and the source shop's name and link as text. 3 years from the ban, then removed by the nightly clean-up unless renewed; an entry an operator removes earlier is kept as a record of the removal for 1 year, then removed. The shop the entries came from is usually deleted; the entries are not |
| Payment-details change in waiting | The requested new details, encrypted, for 72 hours or until the Seller cancels, then deleted (applied to the live details, or dropped) |
| Telegram chat links | The numeric id and title of each Telegram chat a Seller connected for order alerts, kept while connected. A disconnected chat's entry — with the reason it went — is kept 90 days, so Settings can say why alerts moved back to email, then removed by the nightly clean-up. Deleted with the shop. The one-time connection token is stored only as a hash, for 15 minutes or until it is used |
| Telegram delivery receipts | Which connected chats an order's alert reached — the order and the chat id, nothing else — so a retry after a failure does not send the same alert twice. Kept and deleted with the order |
| Pre-order details | On a product: its selling mode and the expected-arrival and close dates, cleared when the stock arrives or the pre-orders are cancelled. On an order: that it was a pre-order, the arrival date as promised to that Buyer, and the Seller's own refund record on a cancelled one — kept and deleted with the order. The order bin's clear-out for a paid pre-order is measured from its expected arrival date, as from the delivery date on any other order |
| Per-day shop statistics (views, enquiries) | 30 days on Starter, 12 months on Growth, trimmed each time the Seller opens Analytics. Shops on the Free plan have no Analytics page and their counts are not yet trimmed. No monthly-total table exists |
| Order-throttle device counters | Keyed by date; only today's row is ever consulted. The nightly clean-up removes anything before today |
| Blocked order attempts | Refused-checkout records carrying the same opaque device id. Removed after 30 days by the nightly clean-up |
| Order day counters | Per-shop, per-day refusal counts — no device id, no buyer, no order. Removed after 90 days by the nightly clean-up |
| Email send log | One entry per email we send: its kind, the shop it concerned, the provider's message reference, the outcome and the time — never the address or the content. Removed after 13 months by the nightly clean-up (this month compared with the same month last year is the longest use). On each order, whether and when the Seller's new-order alert was sent stays with the order |
| Email suppression list | An address the provider reported as bounced or as having marked our email as spam, the reason and the time. Kept until an operator clears it, which they do once the mailbox is fixed; there is no timed deletion, because mailing a dead address again harms every shop's email |
| Buyer reports | Open until an operator closes it. A closed report (reason, message, the reporter's email if given, the Seller's reply, the operator's note) is removed 24 months after it was closed by the nightly clean-up — long enough to recognise a repeat pattern across the platform. Deleted with the shop |
The periods above are the ones the nightly clean-up applies today. If a professional review changes any of them, the change arrives as a new, dated version of this policy.
Erasure a Seller Can Perform Themselves
A Seller is a separate controller of the buyer data routed to them (Seller Terms section 5), so a Buyer can ask the Seller directly. The Seller's console has a one-step "Delete customer (PDPA erasure)" control. It:
- deletes the customer profile held by that Seller, and
- on every order that Buyer placed at that shop (linked to the profile or carrying the same phone number), clears the name, phone number, delivery address or self-collect note, postal code, the Buyer's note, the Seller's own note and photo, anything typed into add-on boxes, and the payment screenshot, which is purged from storage,
leaving the items, quantities, prices, dates and totals in place, because the Seller needs them for their own accounts and they no longer identify anybody. This is immediate — it does not wait on the 30-day window above, which governs requests made to us. It does not touch reviews.
How to Request
Email dpo@homekampungsg.com from your account email. Identity is verified before actioning. We confirm completion in writing, including when the last backup copy will have expired.