Privacy Policy

1. About this policy

This policy explains how VendingBay collects, uses, discloses, and protects your personal data, and is issued in accordance with Singapore’s Personal Data Protection Act 2012 (PDPA). It applies to everyone who uses the Platform, whether as a buyer, seller, or visitor. It should be read alongside our Terms of Service.

2. What we collect

• Account details: first and last name, email address, mobile number, hashed password, and your role (buyer or seller).
• Business details: for company accounts, your company name and Singapore Unique Entity Number (UEN).
• Listing content: machine descriptions, locations, revenue figures, and any photographs or supporting documents you upload.
• Transaction records: unlocks purchased, sales, payment status, and payout records. Card details are handled entirely by Stripe — we never see or store your full card number.
• Communications: messages exchanged with other users through the Platform, and your correspondence with us.
• Technical data: IP address, browser and device information, and session cookies needed to keep you logged in.

3. Why we use it

• To create and administer your account and verify your identity.
• To publish listings, operate the unlock mechanism, and connect buyers with sellers.
• To process payments, hold funds until a deal is complete, and make payouts.
• To send transactional messages — verification codes, unlock receipts, payment status, and password resets.
• To review listings, detect fraud, enforce our terms, and keep the marketplace safe.
• To meet legal, tax, accounting, and anti-money-laundering obligations.

4. Consent and withdrawal

By creating an account you consent to the collection and use of your personal data as described here. You may withdraw consent at any time by contacting us, but note that we cannot continue to provide the Platform without the data necessary to operate your account, and withdrawal does not affect processing already carried out or records we are required by law to keep.

5. Who we share it with

We do not sell your personal data. We share it only with the service providers needed to run the Platform, each bound to protect it:

• Stripe — payment processing, seller onboarding and identity verification, and payouts.
• Twilio — delivery of SMS one-time passcodes for mobile verification.
• Resend — delivery of transactional email.
• Cloudinary — hosting and delivery of listing images.
• Neon — managed database hosting.
• Other users: when a buyer unlocks your listing, your contact details are disclosed to that buyer so the two of you can communicate.
• Authorities: where disclosure is required by law, court order, or to investigate suspected fraud.

Some of these providers process data outside Singapore. Where that happens we take reasonable steps to ensure a standard of protection comparable to the PDPA.

6. How long we keep it

We retain personal data only while your account is active or as needed to provide the Platform. Transaction and payment records are kept for at least five years to satisfy Singapore tax and accounting requirements. Verification codes expire within minutes and are deleted after use. When data is no longer needed for any legal or business purpose, we delete or anonymise it.

7. Security

Passwords are stored hashed, never in plain text. Traffic is encrypted in transit over HTTPS, and access to production data is restricted to staff who need it. No system is perfectly secure, so please use a strong, unique password and tell us at once if you suspect your account has been compromised.

8. Your rights

Under the PDPA you may:

• Access the personal data we hold about you and ask how it has been used or disclosed in the past year.
• Correct data that is inaccurate or incomplete — much of this you can do yourself in account settings.
• Withdraw consent or request deletion, subject to the retention obligations above.

We will respond to requests within 30 days. A reasonable fee may apply to access requests, and we will tell you before proceeding.

9. Cookies

We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. These are required for the Platform to function and cannot be disabled without preventing login.

10. Contacting our Data Protection Officer

To exercise any of the rights above, or to raise a concern about how we handle your personal data, contact our Data Protection Officer at hello@vendingbay.com. If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or on-Platform notice before they take effect.