Effective date: 16 October 2026
Operator: Based App Pte. Ltd. (UEN: 202646548M), Singapore ("Based", "we", "us", "our")
Data Protection Officer: getbasedapp@gmail.com
1. Summary
- Based is a Singapore app for ordering from home-based and small local shops, with pickup only.
- We collect only what we need to run the app: your account details, orders, chats, saved shops and reviews, and (for shop owners) shop details.
- We do not sell your data, and we do not show ads.
- Your data is stored with Google Firebase (Google Cloud), on servers operated by Google, which may be located outside Singapore.
- You can see, correct or delete your data. You can delete your account in the app at any time.
- Questions? Email getbasedapp@gmail.com.
This policy explains how we collect, use, disclose and protect personal data in line with Singapore's Personal Data Protection Act 2012 ("PDPA"). It applies to the Based mobile app and related services (the "App"). It should be read with our Terms of Service.
2. Personal data we collect
2.1 From everyone with an account
| Data | Required? | Why |
|---|---|---|
| Email address and password | Required | To create and secure your account and sign you in. Passwords are handled by Firebase Authentication and are never visible to us. |
| Display name | Required | To show who you are to shops and customers on orders, in chat and on reviews. |
| Phone number | Optional | Stored on your profile. It is not shared with shops. |
| Profile photo | Optional | To show on your profile and in chat. |
| Area you select for search (Central, North, North-East, East or West) | Optional | To show you shops in that area. We do not collect your device's GPS location. |
2.2 When you use the App as a customer
- Orders and order history: shops ordered from, items, quantities, prices, chosen pickup time, order status (Placed, Ready, Picked up) and dates.
- Chat messages you send and receive, including any photos you share.
- Saved shops.
- Reviews and star ratings you post (when this feature is available).
2.3 When you register a shop
- Business details: shop name, category, area, opening hours, pickup time options.
- Pickup address, which may be your home address.
- Unit number: kept private. Your full pickup address, including the unit number, is shown only to the customer who placed an order, once that order is ready. Your public shop page shows only your area or region.
- Product listings: photos, names, descriptions, prices and stock.
- Orders you receive, chats with customers, and reviews about your shop.
2.4 Collected automatically
- Technical and security data processed by Firebase to keep accounts secure and the App working, such as account identifiers, sign-in times, IP address and device or app version information.
- Push notification token, if push notifications are enabled and you allow them, so we can tell you about order updates and messages.
- Crash reports: we may use crash reporting (e.g. Firebase Crashlytics) to find and fix problems in the App. Crash reports include technical information such as device model, operating system and app version.
We do not knowingly collect sensitive data such as NRIC numbers, health information or financial account details. Please do not share these in chat or reviews.
2.5 Payments
Customers pay the full amount upfront when placing an order, using in-app PayNow payments through Stripe, which are being introduced. Payments go directly into the Shop's own Stripe account. Payment data is processed by Stripe, not by Based. Based does not store your bank details. We will receive only limited information, such as payment status, amount and a payment reference.
3. How we use your personal data (purposes)
We use personal data only for these purposes:
- Running your account: creating it, signing you in, keeping it secure.
- Orders: sending your order to the shop, showing order status, letting you collect it, and keeping order history for you and the shop.
- Shop listings: displaying shops and products, and helping customers find shops by area and category.
- Chat: letting customers and shops message each other.
- Saved shops and reviews: saving your favourites and showing reviews to other users.
- Notifications and service messages: order updates, new messages, account and security notices, and changes to our Terms or this policy.
- Support and safety: answering your questions, handling refund requests and disputes between customers and shops, investigating reports, preventing fraud, abuse and breaches of our Terms.
- Improving the App: fixing bugs and understanding how features are used, using aggregated or minimal data where possible.
- Legal reasons: complying with laws, requests from authorities, and establishing or defending legal claims.
We will not use your data for advertising, we will not sell it, and we will not send you marketing messages unless you separately agree. If we want to use your data for a new purpose, we will tell you and, where required, ask for your consent first.
4. Consent
By creating an account and using the App, you consent to us collecting, using and disclosing your personal data for the purposes in section 3. Where you choose to give optional data (such as a phone number or profile photo), you consent to us using it for the stated purpose.
We may also rely on other grounds allowed by the PDPA, such as where the data is needed to fulfil your order (deemed consent), or for legitimate interests like preventing fraud and keeping the App secure.
If you give us personal data about someone else, you confirm you have their consent.
5. Who can see your data, and who we share it with
We do not sell, rent or trade your personal data.
5.1 Other users
- Shops you order from see your display name, your order details (including pickup time) and your chat messages with them.
- All App users see a shop's name, area or region, opening hours and listings on its public shop page. The shop's street address and unit number are not shown publicly.
- Customers who order from a shop see the shop's full pickup address, including the unit number, only on their own order and only once that order is ready.
- All App users can see shop profiles, listings and reviews. Reviews show the reviewer's display name.
- Chat messages are visible only to the people in that conversation.
Shops must use customer data only to fulfil and talk about orders (see our Terms).
5.2 Service providers
We use trusted providers to run the App. They process data on our behalf and under contract:
| Provider | What they do |
|---|---|
| Google (Firebase / Google Cloud): Firebase Authentication, Cloud Firestore, Cloud Storage (and Firebase Cloud Messaging, if push notifications are enabled) | Sign-in, database, photo storage, crash reporting (if used) and push notifications (if enabled) |
| FlutterFlow | The tool we use to build the App. FlutterFlow is used only as a build tool and does not receive user data. |
| Apple | App distribution, and push notification delivery on iOS (if enabled) |
| Stripe | In-app PayNow payments (being introduced), refunds and shop payouts. Stripe processes payment data; Based does not store bank details. |
5.3 Other disclosures
We may disclose personal data:
- when required or allowed by law, or at the request of a government or law enforcement authority (for example, the police or the Singapore Food Agency);
- to protect the rights, safety or property of users, the public or Based; or
- to a buyer or successor if Based is sold, merged or restructured, who must continue to protect your data in line with this policy.
6. Overseas transfer of data
Based stores data with Google Firebase, part of Google Cloud. Our database and file storage are hosted on servers operated by Google, which may be located outside Singapore. Some Firebase services, including Firebase Authentication, may store or process data in other countries, such as the United States, and Google may process data in other locations for support and security.
When your data is transferred outside Singapore, we take steps to make sure it receives a standard of protection comparable to the PDPA, as required by the PDPA's Transfer Limitation Obligation. We do this by relying on Google's contractual commitments, including the Google Cloud and Firebase data processing terms, and Google's security certifications (such as ISO 27001 and SOC 2). Other providers we use (such as Stripe) are bound by similar commitments.
By using the App, you consent to this transfer.
7. How we protect your data
We take reasonable security steps, including:
- encrypted connections (HTTPS/TLS) between the App and our servers;
- Google's encryption of stored data;
- Firebase Authentication to manage passwords securely (we never see your password);
- database security rules so users can only access the data they are allowed to see, for example keeping a shop's unit number visible only on relevant orders; and
- limiting access to personal data to people who need it to run the App.
No system is completely secure. If a data breach is likely to cause significant harm to you, or is of a significant scale, we will notify the Personal Data Protection Commission (PDPC) and, where required, you, as required by the PDPA.
8. How long we keep your data (retention)
We keep personal data only as long as we need it for the purposes in this policy or for legal or business reasons. Then we delete it or anonymise it.
| Data | How long we keep it |
|---|---|
| Customer profile and sign-in | Until you delete your account. Deleted immediately when you delete your account. |
| Orders and order history | Kept as part of the shop's records and ours, even after a customer deletes their account, for tax, accounting, record-keeping, dispute and legal reasons, for 5 years after the order. |
| Chat messages | While the accounts in the conversation are active. When you delete your account, your chat messages are anonymised: they may remain visible to the other person in that conversation, but are no longer linked to your name or profile. |
| Saved shops | Deleted when you delete your account. |
| Reviews | Anonymised when you delete your account. |
| Shop that is deactivated | Kept, hidden from customers, until the owner reactivates or deletes it. |
| Business that is deleted | Hidden and marked as deleted (not immediately erased) so past orders stay accurate. Kept for up to 5 years, then permanently deleted. Owners can ask for earlier permanent deletion by email (see section 10). |
| Backups and logs | Cleared within 30 days. |
We may keep data longer if the law requires it, or if it is needed for an ongoing dispute, investigation or legal claim.
9. Your rights under the PDPA
You have the right to:
- Access: ask what personal data we hold about you and how it has been used or disclosed in the past year.
- Correction: ask us to correct personal data that is wrong or incomplete. You can update most details yourself in your profile or shop settings.
- Withdraw consent: withdraw your consent for us to collect, use or disclose your data (see section 11).
- Deletion: delete your account in the App (section 10), or ask us to delete data.
- Complain: contact us, and if you are not satisfied, contact the PDPC (www.pdpc.gov.sg).
How to make a request: email getbasedapp@gmail.com from the email address linked to your account, with the subject "PDPA Request" and the details of what you want. We may need to verify your identity before acting.
We will respond within 10 business days. If we need more time, we will tell you within that period when we expect to reply. Access requests are normally free. If a request is complex, we may charge a reasonable fee, and we will tell you the amount first. In limited cases the PDPA allows us to refuse a request (for example, if it would reveal another person's personal data); if so, we will explain why.
10. How to delete your account
Customers: delete in the App
- Open the Based app and sign in.
- Go to Profile → Settings → Delete account.
- Confirm that you want to delete your account. You may be asked to enter your password again.
What happens:
- Your profile (display name, phone number, profile photo), saved shops and sign-in account are permanently deleted straight away. You will no longer be able to sign in with that account.
- Past orders remain in the records of the shops you ordered from, and in our records, for the retention period in section 8. This is so shops have accurate sales records and so disputes can be handled.
- Your chat messages and reviews are anonymised (see section 8).
- Backups are cleared within 30 days.
You can also ask us to delete your account by emailing getbasedapp@gmail.com from your account email address. We will process it within 7 days.
Shop owners
- Deactivate your shop in the App to hide it temporarily.
- Delete your business in the App. It will be hidden and marked as deleted. Past orders are kept so customers' order histories stay accurate.
- To delete your personal account as well, follow the customer steps above.
- To ask for your deleted business data to be permanently erased sooner, email getbasedapp@gmail.com. We will erase what we can, keeping only what we must for legal reasons or open disputes.
11. Withdrawing consent
You can withdraw consent at any time by:
- removing optional information (such as your phone number or profile photo) from your profile;
- turning off notifications in your phone's settings (if push notifications are enabled);
- deleting your account in the App; or
- emailing getbasedapp@gmail.com.
We will tell you what will happen if you withdraw consent. For example, we cannot provide an account, process orders or provide chat without the data needed for those features. We will act on your request within a reasonable time, usually within 10 business days. Withdrawing consent does not affect data we must keep by law, or past orders kept in shops' records as described above.
12. Children
The App is not intended for children under 13, and we do not knowingly collect personal data from them. Users under 18 should use the App only with a parent or guardian's permission. If you believe a child has given us personal data, please email us and we will delete it.
13. Do Not Call and marketing
We do not send marketing messages. If we ever do, we will ask for your consent first and follow Singapore's Do Not Call rules, and you can opt out at any time.
14. Changes to this policy
We may update this policy, for example when we add in-app payments or reviews, or when the law changes. We will post the new version in the App and at this page with a new effective date. For important changes, we will tell you in the App or by email before they take effect.
15. Contact us / Data Protection Officer
If you have any questions, requests or complaints about your personal data, please contact our Data Protection Officer:
Based App Pte. Ltd. (UEN: 202646548M)
Attn: Data Protection Officer
Email: getbasedapp@gmail.com
If you are not satisfied with our response, you can contact the Personal Data Protection Commission at www.pdpc.gov.sg.