Privacy Policy — HomeKampung
v0.4.20 · Last revised 6 November 2026 · In force since 1 Nov 2026
Status: In force since 1 Nov 2026. The version and revision date are in the line above.
Related documents: Terms of Service · Seller Terms · Cookie & Tracking Notice · Data Deletion & Retention. These form one agreement and should be read together.
1. Scope
This policy covers personal data collected by Yomiyyat, a sole proprietorship registered in Singapore (UEN 53533139L) ("we"), through HomeKampung. It applies to Sellers and Buyers.
2. What We Collect
| Category | Data | Who |
|---|---|---|
| Seller login | Email address and a hashed password. Buyers have no accounts. | Sellers |
| Seller profile | Shop name and address (handle), category, description, logo, banner, about-page text and images, location, opening days and hours, delivery and self-collect settings, the contact handles you choose to show (Instagram, WhatsApp, Facebook, Telegram, email, phone), your GST-registration declaration, the Muslim-owned declaration if you tick it, and your PayNow number and bank account for display to buyers (encrypted, §7) | Sellers |
| Seller verification | A food-safety course certificate you upload for operator review. Encrypted before storage; readable only by our operators; deleted when rejected, revoked or replaced (§7) | Sellers |
| Payment confirmation | The screenshot a Buyer attaches to an order to show they have paid the Seller — required to place an order — or the receipt a Seller attaches to an order they entered by hand (a DM or bazaar sale). Encrypted; readable by the Seller who received that order and by our operators; deleted with the order (§7) | Buyers |
| Orders | Name, phone number, delivery address or self-collect note, postal code, the delivery date, anything typed into the order note or into an add-on box, the discount code used, the items and amounts. Each order also creates or updates a customer profile at that shop: name, phone, orders and spend. An order the Seller deletes goes to the shop's bin for at least 30 days before it is removed for good, and our operators can see it there (§8) | Buyers |
| Abuse prevention | A random, opaque device identifier in a cookie (hk_did), to count how many orders one browser places at one shop in a day. Stored on our server with that day's count, and with any refused attempt for 30 days. Not a fingerprint and not derived from your device — see the Cookie Notice |
Buyers |
| Shop statistics | Per-shop, per-day counts of shop-page views and contact-button taps. No visitor identifier; a seller's own visits are excluded — see §2a | Nobody individually |
| User content | Product listings, photos, reviews and ratings, review photos (location data is stripped from them). A review is tied to the order it was written from - we and the Seller can see which order; the public cannot. The name is shown as first name and initial unless the reviewer ticks to show it in full; the full name as typed is kept and visible to the Seller and to us. The review link is not stored: it is computed from the order and stops working 30 days after the order was completed (or refunded, or reported not received). For an order the Seller entered by hand, the link opens a week after the Seller has recorded the buyer's name and phone, a product, a payment receipt, and marked it paid, completed and delivered, and stops 30 days later; its review is labelled "Ordered by DM". Review requests: a Seller on the Growth plan may send the buyer the review link from the Seller's own WhatsApp, to the phone number the buyer gave for the order; HomeKampung prepares the message and sends nothing. We record that the Seller asked (which order, when) and whether the Seller's own words read like a reward - never the message itself. A Seller on any plan may also mark a link as sent from their own chat; we record that mark (which order, when) and nothing about the chat. Search engines: a product page includes its published verified reviews (the shown name, rating, date and text) in machine-readable form so that Google and other search engines can show them with the product; these are the same reviews anyone can read on the page | Both |
| Usage | Our web server's access log — IP address, page, time and browser identification — kept 30 days. The cookies and browser storage in the Cookie Notice. No other usage data | Both |
| Communications | The reason you give when reporting a review; a Seller's "I've paid" note to us; emails you send us | Both |
| Shop History | A dated record of what is done in a shop: orders by order number (never the buyer's name or phone), order status changes, product, discount, review and settings changes (which fields changed — payment numbers, contact numbers and emails are recorded as "changed", never their values), and each sign-in to the shop's login with the date, time and type of device (for example "Chrome on Android"; no IP address). HomeKampung's own actions on the shop are recorded too. Shown to the shop's login (Starter and Growth plans) and to our operators; our operators' internal working notes about a shop are shown to operators only. See §8 for how long it is kept | Sellers |
| Terms acceptance | The date, the version and hash of each document accepted, the sentence shown, your IP address as our server saw it and your browser identification (§4) | Sellers |
| Billing and notes | Your plan, fee, renewal date and payment history; notes our operators write about the shop; a history of operator actions on the shop | Sellers |
| Record of a deleted shop | When we delete a shop, a short record that we did: the shop's name and link, its plan, the date it joined and the date it was deleted, and how many products, orders and reviews were removed. Nothing else from the shop is kept in it | Sellers |
| Email send log | For each email we send: what kind it was (password reset, new-order alert, a notice to a Seller or to us), which shop it concerned, the provider's reference for the message, whether the provider accepted it, and the time. Not the address and not the content. Kept so we can see our usage against the provider's limits and retry an alert that did not go out; see §8 | Sellers |
| Email suppression list | An email address the provider has told us bounced or reported our email as spam, with the reason and the time, so we stop mailing it. Removed by an operator once the mailbox is fixed | Sellers |
| Buyer reports | What a Buyer or visitor tells us when they report an order or a shop: the reason they pick, what they write, the order number (for an order report), and an email address if they choose to leave one so we can reply. Seen by our operators. For an order report the Seller sees the reason and the message — never who sent it; the Seller's reply is kept with the report. See §8 | Both |
| Identifier fingerprints | For each shop, a keyed one-way fingerprint (not the value) of its login email, phone and WhatsApp numbers, PayNow number or UEN, bank account and shop name, recorded when set or changed. When we close a shop for fraud, those fingerprints go on a banned list for 3 years, with the reason. A later signup or change that matches a strong identifier (PayNow, bank, phone, email) is held for review — the shop sees "being reviewed", never which detail matched; a matching shop name only flags the shop to us. Nothing is ever refused automatically. The key is kept apart from this data (§7) | Sellers |
| Payment-details changes in waiting | A change to a shop's PayNow number, bank account or PayNow QR, when the shop already has live details, is held — encrypted — for 72 hours before it takes effect, and the login address is told at once; the Seller can cancel it in that time. Deleted when applied or cancelled | Sellers |
We deliberately collect the minimum: no NRIC numbers (and never as an authentication identifier), no buyer payment credentials, no addresses unless an order actually needs one.
2a. What the shop statistics are, and are not
Views and contact-button taps are counted per shop, per day, on our servers. No per-Buyer browsing profile exists and nothing records which individual viewed which shop: a day's row holds the shop, the date and two numbers. A Seller sees these on their Analytics page.
The device identifier is a random value we generate — not a fingerprint,
not derived from your hardware or browser characteristics, and never used for
advertising, personalisation or measurement. It is held in the hk_did cookie
for 2 days. On our server, only the current day's count is ever consulted;
older rows are deleted by a clean-up that runs every night shortly after
midnight (Data Deletion & Retention Policy), and a refused order attempt keeps
the identifier for 30 days so a Seller can see what was blocked.
3. Purposes
Operating shops and the marketplace; routing orders to Sellers; passing a Buyer's payment confirmation to the Seller they paid; preventing order spam, prank orders and bot orders by counting orders per shop and per browser per day; per-shop statistics shown to that Seller; the shop's History, so a Seller can see what was done with their shop's login and by whom among the Seller, HomeKampung and buyers, and so we can support the shop and look into a problem; verification and trust badges; subscription billing (Sellers only); service communications; legal compliance.
4. Consent
Today: a Seller accepts the Terms of Service, the Seller Terms and this policy by ticking an unticked box at signup that links all three; the shop cannot be created without it. We ask for no marketing consent at all, because we send no marketing. Personal data you type into the signup form is collected on the basis that you provided it voluntarily for an obvious purpose, after being told what that purpose is. A Buyer gives their details to place an order, and is told on every shop page and at checkout that the purchase is with the Seller.
We record the acceptance: the date, each document's version and SHA-256 hash, the sentence you agreed to, your IP address as our server saw it and your browser's identification string. An operator can show you what you accepted and when.
If we ever add marketing, that consent will be a separate, optional, unticked choice — never bundled into accepting the Terms, and never a condition of having a shop.
5. The Seller as a Separate Data Controller
When a Buyer's order reaches a Seller, and when a Buyer contacts a Seller through the buttons on a shop page (WhatsApp, Instagram, Facebook, Telegram, email, phone), the Seller then handles that data under their own practices, outside our control. Sellers are independently responsible for their PDPA obligations over data they receive.
Two of those buttons carry data with them. After an order, the Buyer's "message the shop" button opens WhatsApp with the order details, address and postal code pre-filled; when a Seller confirms a payment, their button opens WhatsApp with the Buyer's name, order and address pre-filled. In both cases the message goes to WhatsApp (Meta) only when you tap send, under WhatsApp's own terms; nothing is sent by us.
6. Disclosure & Subprocessors
Personal data is never sold. We require processors contractually not to use it for their own purposes. Named subprocessors (living list — updated whenever infrastructure changes, and re-checked against the live server on the day this policy is sent for review):
| Subprocessor | Role | Location |
|---|---|---|
| OVHcloud (OVH Singapore) | Application, database and file hosting — one virtual server in their Singapore region. Holds all Seller and Buyer data at rest, and its daily backup image. | Singapore |
| Cloudflare | DNS and the network edge in front of the site. Traffic is decrypted at Cloudflare's edge and re-encrypted to our server, so Cloudflare sees your IP address and page contents in transit; it stores none of our data at rest. Separately, our responses carry Cloudflare's Report-To / NEL headers, which ask your browser to send Cloudflare a short network-error report if a page fails to load - the URL and the failure reason, not page contents. |
Global edge; no data at rest |
| Product images, payment screenshots and verification documents are stored on the same OVHcloud server in software we run ourselves (Garage), not with a separate storage provider. | ||
| Resend | Transactional email only: the password-reset link a Seller requests, the notice sent when a Seller's password is changed, the new-order alert sent to a Seller's login address when a Buyer places an order (the order number, the items and amounts, the delivery option and date, and a link to the order — never the Buyer's name, phone number, address or payment screenshot; the Seller can turn these alerts off in Settings), the notice sent to a Seller whose shop goes offline for having no contact button, the notice sent to a Seller when a Buyer reports a problem with one of their orders (the order number and the reason — never the reporter's details), and notices to HomeKampung's own operators about running the platform: a new shop, a shop ready to open, a plan or pre-order access request, a food-safety certificate upload, a subscription payment report, a shop taken offline or matched against the banned list, a Seller's reply to a report (the shop's name, what was asked, and any payment reference the Seller typed); an address that bounced or marked our email as spam (the address masked); and a server error (the page and the error, with email addresses, phone-number-like digits and the values of a failed database write removed). When a Buyer reports an order or anyone reports a shop, the operators' notice says only that a report was made (the shop, the order number and the reason chosen) - the reporter's own words and reply address stay in the reports queue, behind our operators' login. It receives the recipient's email address and the message body, and tells us when an address bounces or marks our email as spam (§2, "Email send log"). No Buyer's name, phone number, address or payment screenshot is sent by email, and no marketing email is sent at all. | Japan (Tokyo) |
| ntfy (notification software we run ourselves) | Operator push notices only. A one-line nudge to the operator's phone that a Seller asked for a plan change, uploaded a certificate or says they have paid: the shop name and what was asked - never a Buyer's name, phone number, address or payment screenshot. Runs on hardware we control; the posting account can write to its one topic and never read. | Singapore |
| Proton (Proton AG) | HomeKampung's own operator mailbox. It receives the operator notices described in the Resend row above - shop names and what was asked, any payment reference a Seller typed, masked email addresses, scrubbed server errors - never a Buyer's name, phone number, address or payment screenshot, and not the words of a report. Stored encrypted by Proton. | Switzerland |
| Telegram (Telegram Messenger Inc.) | Only for a Seller who connects a Telegram chat in Settings → Order alerts. Our bot (@HomeKampungSG_bot) then sends that chat the same new-order alert as the email — the order number, the items and amounts, the delivery option and date, and a link to the order that only the Seller's login can open — never the Buyer's name, phone number, address or payment screenshot — plus a confirmation when the chat is connected and a test message when the Seller asks for one. We store the chat's numeric id and its title (a group's name, or the Seller's first name for a private chat). The messages themselves sit in Telegram under Telegram's own privacy policy, and anyone in a group the Seller connected can read them. The bot sends only; nothing about a shop can be changed through it. Nothing reaches Telegram for a shop that has not connected a chat. |
Telegram's own data centres, outside Singapore — the location is not ours to choose |
| Removed 2026-08-25 — listed in error. No automation tool is connected to the platform. | — | |
| Not connected. The AI product-import tool is switched off, not offered in the Seller console, and refuses to run without a key the production server does not have. If it is ever switched back on, this row must be restored before the feature ships. | — | |
| Billing | None. Sellers pay their subscription to us by PayNow or bank transfer; there is no payment gateway. | — |
We deliberately prefer fewer subprocessors, Singapore-based where practical — less of your data leaves Singapore than on typical global tools. What leaves today: a Seller's email address, and the emails described in the Resend row above, to Resend in Japan (Tokyo); for a Seller who connected a Telegram chat, the order alerts described in the Telegram row, to Telegram's servers outside Singapore; the operator notices described in the Proton row, to Proton in Switzerland; and everything in transit through Cloudflare's edge.
6a. About the product-import tool
Dormant. When it was live it sent, only when a Seller chose to use it, only what that Seller supplied — pasted product text, or a web page they named — to a model provider, which was barred from using it to train models. No Buyer data, no order data and no contact details were ever sent. This section stays so that the limits are agreed before the feature is ever switched back on, not after.
7. Security
Passwords are hashed with argon2 — we never store, and cannot recover, the password itself. Three kinds of data are encrypted at the application layer with AES-256-GCM under a key our hosting provider does not hold, so they are unreadable to anyone with only the database or the file store, including the host: a Seller's PayNow number and bank account, verification certificates, and Buyers' payment screenshots.
HTTPS applies to the published deployment, with HSTS. Abuse limits are in place on sign-in, sign-up, the public upload routes (signup logo, review photos, payment screenshots), a Seller's banner-video upload, the public review and order-lookup forms and the dormant import tool; a signed-in Seller's own product photo and certificate uploads are not rate-limited. The app sends browser security headers (a content-security policy that blocks scripts that are not ours, anti-clickjacking, MIME-sniffing and referrer protections).
Uploaded files are public by design, with three exceptions. Shop logos, product photos, review photos and a Seller's own PayNow QR image are served to anyone holding the link, because a shop page has to show them; they cannot be listed, but they are not secret. The three exceptions — certificates, payment screenshots and nothing else — are stored only in encrypted form and are served decrypted only through a signed-in route that checks who is asking: a payment screenshot to the Seller who received that order and to our operators; a certificate to our operators. Reads of these are not logged — an access log is committed work.
What HomeKampung staff can see. We have two kinds of account, Seller and operator, and today every operator account can open every shop's console — orders, customers, decrypted payment details, screenshots and certificates — and can change a shop's plan, record its payments, suspend or delete it, approve or revoke its badge and correct its login email. Operator actions on a shop are written to that shop's event history; document reads are not. Narrower operator roles are a commitment for when there is more than one operator.
8. Storage, Retention & Cross-Border Transfer
Primary database and file storage: Singapore (OVHcloud). Traffic passes through Cloudflare's edge, where it is decrypted and re-encrypted (§6); a Seller's email address reaches Resend in Japan (Tokyo) when we email them (§6); for a Seller who connected a Telegram chat, the order facts listed in the subprocessor table above reach Telegram's servers outside Singapore. Backups are kept in Singapore and exist only to restore the service after a failure. Our nightly database backups are encrypted, and the key that reads them is not kept on the server they are made on. In the nightly copy of uploaded files, payment screenshots and documents stay encrypted as they are in the service; product and shop images are public anyway. The copy of those files we keep off the server is encrypted as a whole, with the same off-server key. The hosting provider's daily backup image (the OVHcloud row above) is a copy of the server's disk as it stands, kept for seven days. A record you delete can persist in a backup for up to about five weeks, and a deleted file for up to about a week, before every copy of it is gone (see the Data Deletion & Retention Policy). Retention of live data follows the Data Deletion & Retention Policy's per-category table (the shop History is there too, and so is the short record kept when a shop is deleted); data is disposed of when its purpose is exhausted, subject to legal retention needs.
9. Your Rights
Email dpo@homekampungsg.com (section 13) for access, correction or deletion; we action requests within 30 days. There is no self-service deletion of a Seller account — write to us and we delete the shop.
Asking a Seller directly. Because a Seller is a separate controller of the order data routed to them (§5), a Buyer may also ask that Seller to erase their record. Sellers have a one-step "Delete customer" control in their console: it deletes the customer profile and, on every order you placed at that shop, clears your name, phone number, delivery address, postal code, notes, anything typed into add-on boxes and the payment screenshot (which is purged from storage). The items, quantities, prices, dates and totals remain, because the Seller needs them for their own accounts and they no longer identify you. This is immediate. If a Seller does not act, write to our DPO and we will take it up.
10. Marketing Communications
We send no marketing today — no email, no SMS, no calls — and the platform has no mailing list.
If that changes: we will check the Do Not Call Registry and obtain unambiguous, separately-recorded consent before any SMS or call marketing, honour opt-outs within 10 business days (Spam Control Act), and put an unsubscribe link in every marketing email. Marketing consent will never be a condition of having a shop.
11. Data Breach Notification
We assess suspected breaches promptly and notify the PDPC and affected individuals without undue delay for any notifiable breach, with a plain-language account of what happened and what we're doing.
12. Children
The Platform is not directed at children. Sellers must be 18 or older (or hold a parent/guardian contract). This is a contractual requirement, not a verified one — we do not currently collect or check a date of birth.
13. Data Protection Officer
dpo@homekampungsg.com — a monitored, role-based contact (acceptable PDPA practice). Postal correspondence can be addressed to Yomiyyat's registered business address, which we provide on request through that mailbox.
14. Changes
Material changes are notified 14 days in advance as a notice on every Seller's dashboard (and by email), and each version carries its effective date. We record which version of this policy each Seller accepted — see section 4.