Privacy Policy

Effective 22 December 2026

This policy explains how KOPIE BOY (UEN 53535194A), trading as Kopi Boy ("we", "us"), collects, uses, shares and protects your personal data when you use the Kopi Boy website and apps. We follow Singapore's Personal Data Protection Act 2012 (PDPA).

1. What we collect

When you sign in: your name, email address and profile photo from your Google account. We do not see your Google password.

When you order: your delivery address and postal code, phone number if you give one, the items you ordered, any notes you write, and your order history.

If you are a merchant (home cook or stall): your business name and UEN (if any), kitchen description, photos, cuisine and category, kitchen address and postal code, contact number, the PayNow details customers use to pay you, and your subscription and payment records with us.

If you are a rider: your name, contact number, the regions you ride in, and your live location only while you choose to share it for a delivery. We do not store a home address or postal code for riders.

Automatically: basic technical data such as device type, browser and error logs, and the notification settings you choose. We use only cookies and similar storage needed to keep you signed in and the service working. We do not use advertising cookies.

2. Why we use it

To create and run your account and let you sign in.
To let customers order, merchants prepare orders and riders deliver them.
To show kitchens by area and to find kitchens near you. We show customers a kitchen's area and postal sector, never its exact address or coordinates.
To send you service messages, such as order updates, notifications and billing reminders.
To keep Kopi Boy safe, prevent fraud and abuse, and enforce our Terms of Use.
To collect and record merchant subscription payments and meet our legal and accounting duties.
To improve the service, and to contact you about it if you agree.

3. Who sees it

Merchants and riders see only what is needed to complete your order: your name, delivery address, phone number if given, and the order. They must keep it private and use it only for that order.
Customers see a merchant's business name, description, photos, area and menu. Customers do not see a merchant's PayNow details until they place an order with that merchant.
Our service providers process data for us: Supabase (database and sign-in), Vercel (hosting), Google (sign-in) and an email provider that sends our sign-in emails. They may process data on servers outside Singapore. We take reasonable steps so that your data receives a standard of protection comparable to the PDPA.
Authorities: when the law requires it.
We do not sell your personal data.

4. How long we keep it

We keep personal data only as long as we need it for the reasons above or as the law requires. Order and payment records may be kept longer for accounting, tax and dispute purposes. When you ask us to close your account, we delete or anonymise your personal data unless we must keep some of it by law.

5. How we protect it

We limit who can see private details such as PayNow numbers, exact locations and contact details, and we use access controls, encrypted connections and regular reviews. No system is perfectly secure; if a data breach is likely to cause you serious harm, we will tell you and the Personal Data Protection Commission (PDPC) as the law requires.

6. Your choices and rights

You can ask us to:

tell you what personal data we hold about you and how it is used,
correct data that is wrong, or
withdraw your consent to our using your data, or delete your account.

Email kopiboysupport@gmail.com. We may need to confirm who you are first, and we will reply within a reasonable time (usually within 30 days). Withdrawing consent may mean we can no longer provide some or all of the service. You can switch off notifications in your device or app settings.

7. Children

Kopi Boy is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, tell us and we will remove it.

8. Changes to this policy

We may update this policy. We will post the new version with its date, and tell you in the app or by email if the change is important.

9. Contact and complaints

Our Data Protection contact is the owner of KOPIE BOY.
Email: kopiboysupport@gmail.com

If you are not happy with how we handled your concern, you may also contact the Personal Data Protection Commission at www.pdpc.gov.sg.

1. What we collect

When you sign in: your name, email address and profile photo from your Google account. We do not see your Google password.

When you order: your delivery address and postal code, phone number if you give one, the items you ordered, any notes you write, and your order history.

2. Why we use it

To create and run your account and let you sign in.

To let customers order, merchants prepare orders and riders deliver them.

To show kitchens by area and to find kitchens near you. We show customers a kitchen's area and postal sector, never its exact address or coordinates.

To send you service messages, such as order updates, notifications and billing reminders.

To keep Kopi Boy safe, prevent fraud and abuse, and enforce our Terms of Use.

To collect and record merchant subscription payments and meet our legal and accounting duties.

To improve the service, and to contact you about it if you agree.

3. Who sees it

Merchants and riders see only what is needed to complete your order: your name, delivery address, phone number if given, and the order. They must keep it private and use it only for that order.

Customers see a merchant's business name, description, photos, area and menu. Customers do not see a merchant's PayNow details until they place an order with that merchant.

Our service providers process data for us: Supabase (database and sign-in), Vercel (hosting), Google (sign-in) and an email provider that sends our sign-in emails. They may process data on servers outside Singapore. We take reasonable steps so that your data receives a standard of protection comparable to the PDPA.

Authorities: when the law requires it.

We do not sell your personal data.

4. How long we keep it

5. How we protect it

6. Your choices and rights

You can ask us to:

tell you what personal data we hold about you and how it is used,

correct data that is wrong, or

withdraw your consent to our using your data, or delete your account.