Privacy Policy

• Sellers (you, if you have a TaraBase account): we decide how your account details are used, as described here.
• Buyers (people who order from a seller's bot): the seller decides what their details are for, which is fulfilling their orders. We handle those details on the seller's behalf, as their data intermediary.

• Your email address and a password (stored only in scrambled form), to sign you in.
• Your shop: its name, items, prices, photos, service days, welcome message and settings.
• Your PayNow mobile number or UEN and the name your bank shows, to make your buyers' QR codes and check their receipts.
• Your Telegram bot token and your own Telegram ID, to run your bot and send you order alerts.
• Your collection address, if you add one. Buyers see it only after they've paid.
• At a TaraBase Live counter: your items, sales and counter sessions.

• Their Telegram ID and, if they have one, their Telegram username, so the bot can serve them and the seller knows whose order it is.
• Their orders: items, amounts, the day, and their status.
• A delivery address, if they choose delivery.
• What was read from their payment receipt (reference, amount, date and payee). The receipt image itself stays on Telegram; we keep only a pointer to it, so the seller can see it in Needs You.

We don't use buyers' details for advertising, and we don't sell anyone's details.

We use a small number of providers to run TaraBase. Each handles data only to provide its service to us:

• Supabase: our database and sign-in.
• Cloudflare: hosting for this website and for the service that runs sellers' bots.
• Telegram: carries every message between buyers, sellers and their bots.
• Google (Gemini): reads payment receipt images so they can be checked. The image is sent for reading only.

Some of these providers may process data outside Singapore. Where they do, we rely on their commitments to protect it to a standard comparable to the PDPA.

• Receipts that were never verified: deleted after 30 days.
• Saved receipt readings (kept so the same image isn't read twice): deleted after 30 days.
• Everything else for an open shop: kept while the shop is open, because it's the seller's record of their business.
• When a seller closes their shop: deleted for good 30 days later, including its orders and receipts. We keep only a count-level record that the shop existed, when it opened and closed, and why, with no buyer details.
• The demo kitchen holds no real people's details and resets every night.

TaraBase stores your sign-in on your own device so you stay logged in, and a few small preferences. We don't use advertising or tracking cookies.

This website uses Cloudflare Web Analytics to count visits. It sets no cookies and doesn't identify you. We see only totals, such as how many people visited a page, which site sent them, and their country.

Every shop's data is walled off from every other shop's at the database. Connections are encrypted. Only the services that need a piece of data can reach it.

You can ask to see the personal data we hold about you, and to correct it. Sellers can see and correct most of it directly in TaraBase, and download their records. Buyers can ask the seller they ordered from, who controls those records, or write to us.

Our Data Protection Officer can be reached at admin@mustechgroup.com. If you're not satisfied with our answer, you can contact Singapore's Personal Data Protection Commission.

If we change what we keep or who handles it, we'll update this page and its date first.