Privacy notice

DRAFT for the pilot. Have it reviewed before publishing. Last updated 29 Oct 2026.

MarginKaki ("we") helps cafés track supplier prices. This notice explains how we handle personal data under Singapore's Personal Data Protection Act 2012 (PDPA).

What we collect

• Sign-up details: café name, your name, email, WhatsApp number, number of outlets, the suppliers you mention.
• Invoices you send us: photos or PDFs of supplier invoices, and the line items we read from them. Invoices may show names or signatures of delivery staff; we don't use these.
• Security data: a one-way hash of your IP address, used only to stop spam sign-ups. We use no advertising or analytics trackers.

Why we use it

To run the pilot, contact you about it, track prices on your invoices, and send you alerts and weekly summaries. We rely on your consent, given when you sign up. You can withdraw it at any time.

Who processes it

We use cloud providers to host the service and store files (Cloudflare) and, where enabled, to read invoice images automatically (an AI provider). Some of them process data outside Singapore. We only use providers whose contracts protect your data to a standard comparable to the PDPA.

How long we keep it

Invoice images: 12 months, or until you ask us to delete them. Price history: while you're a customer and for 3 months after. Sign-ups that don't proceed: 6 months.

Your rights

You can ask us to access, correct or delete your data, or withdraw consent, by contacting our data protection officer at privacy@example.invalid. If we have a data breach that is likely to cause you significant harm, we'll notify you and the PDPC as required.