How we handle your data

To read spreadsheets you upload, we use a third-party AI service provider. It processes the data on our behalf, may do so outside Singapore, and is bound by contract to protect it to a standard comparable to Singapore’s PDPA. It doesn’t use the data to train its models and deletes it within 30 days, unless it has to keep it longer for safety or legal reasons.

Before any of your file reaches that provider, we remove phone numbers, email addresses and NRIC/IC numbers we can recognise, and we hold back notes columns. The file itself is read in Singapore and never stored. Only the rows you choose to save are kept, and you can undo an import within 24 hours.

If you’d rather not use an AI service at all, the plain CSV import brings in your guest list without it.

If you join the vendor waitlist, we collect your business name, what you offer, your email address and, if you give it, a Singapore phone number.

We use them only to tell you when the KahwinKoncept vendor portal opens, invite you to join, and ask if you’d like to give feedback. We don’t share them with anyone else.

If you haven’t joined the portal within 12 months of signing up, we delete your details. They are stored with Supabase in their Singapore region (ap-southeast-1).

To stop abuse we keep a scrambled form of your IP address for up to 24 hours.

To be removed from the waitlist at any time, write to the address under Contact and we’ll delete your details.

For vendor accounts, KahwinKoncept (operated by AstraRays, Singapore) is the organisation responsible for the vendor’s and staff members’ own details. For the couples a vendor serves, the vendor is responsible and KahwinKoncept runs the system for them.

When you run or join a vendor account we keep your login email and password (hashed), your business name, UEN and logo, the PayNow details couples pay, the names and emails you give as the privacy contact and for copies of documents, an optional WhatsApp number, your role on the team, and the settings you make: packages, payment terms, booking-form questions and your terms and conditions.

We use them to sign you in, to show couples who they are booking and paying, to issue invoices and receipts in your name, to send you and the other owners the alerts described below, and to answer your support questions. We do not sell them or use them for advertising.

Owners and managers of a vendor account can see every team member’s login email and role. Owners are alerted when a member’s password or email changes, when someone joins or is removed, when an invite is made for a new owner, and when business or PayNow details change. Owners see these alerts in the app; emails for them start later. This is so a stolen login can’t quietly redirect payments.

Actions on a vendor account (sign-ups, invites, role changes, PayNow and prefix changes) are written to an audit log that owners can read. The log holds account ids, roles and kinds of change, never a name, email or phone number. The period we keep audit entries for is set before launch and stated here.

When you confirm your password to change PayNow or the owners, we record the attempt and whether it succeeded, and keep that record for 30 days. A record that your password or email changed is kept for 12 months.

Roles are described in general terms: an owner can change everything, including PayNow and the team; a manager can sell, approve and record payments and edit settings. Further roles may be added later and will be described here.

Three companies process vendor account data for us. Supabase stores the account data and runs our sign-in and Edge Functions. Vercel hosts the website and handles the requests made to it. An email provider, named here before launch, sends sign-in confirmation emails and, later, alert emails. The region each one uses is confirmed before launch and stated here; where a region is outside Singapore, the contract gives protection comparable to the PDPA. Payments go straight from the couple’s bank to the vendor’s PayNow; we never hold the money.

Your account details stay while the vendor account exists. A removed member who has no other role in the system can ask us to delete their account by writing to the address under Contact. Audit entries and backups are each kept for a period that is set before launch and stated on this page.

Under Singapore’s Personal Data Protection Act you can ask what personal data we hold about you, ask for it to be corrected, or withdraw consent. Write to the address under Contact and we’ll reply within 30 days.

When a vendor sends you a booking link, that vendor is responsible for your details. KahwinKoncept (operated by AstraRays, Singapore) runs the booking system for them as a data intermediary and uses your details only to run it.

The vendor’s booking form collects your names, mobile numbers and emails, the event date, your answers to the vendor’s questions, any remarks you add, any notes the vendor writes about your booking, and any payment screenshot you upload. The payment and document pages show your names, package and amounts, never a phone number or email.

Your details are used to prepare your booking, invoices and receipts, to record your payments, and so the vendor can contact you about your booking. We do not sell them or use them for advertising, and the booking pages run no tracking scripts.

To stop abuse of the booking form, KahwinKoncept keeps a scrambled (hashed) version of your IP address for 24 hours.

Each link is private to your booking. A booking form link lasts 30 minutes and works once; your payment link and document links open only your own booking. Please don’t forward them.

Your details are stored and processed by our service providers Supabase (database), Vercel (website hosting) and Resend (email). Some of their servers are outside Singapore. We use providers that commit by contract to protect personal data to a standard comparable to the PDPA. You pay the vendor directly by PayNow; we never hold the money.

A payment screenshot is deleted 30 days after the payment is decided, or 60 days after upload if it is never decided. Your phone number, email, answers, remarks and the vendor’s notes are deleted 12 months after your event or 12 months after your booking is fully paid, whichever is later. Invoices and receipts, with your names, are kept as long as the law requires.

To see or correct your details, or to ask a vendor to stop contacting you (invoices and receipts are still sent), contact the vendor (their privacy contact is named on your booking form; if none is named, use the contact details on your invoice). You can also write to us at the address under Contact.

Email: privacy@kahwinkoncept.example