Draft — not yet in force. This notice describes this website’s actual features under the Personal Data Protection Act 2012 (Singapore). The operator’s details still need to be completed and the text reviewed before launch.
Effective [effective date].
Who we are
Shioklist website is operated by [operator name] (“we”, “us”). For any question about personal data, contact our Data Protection Officer at [privacy contact email].
What we collect
- Account details if you create a free account: your name, email address and a securely hashed password. You don’t need an account to read anything on the site.
- Your lists and preferences: places you save, list names, whether a list is shared, your preferred area and email preferences.
- Newsletter records: your email address, the wording you agreed to, and when you subscribed, confirmed or unsubscribed.
- Messages you send through our contact, correction or partner forms.
- Technical data: your IP address and browser details, used briefly to keep you signed in, prevent abuse (for example rate limits and spam checks) and keep the site secure.
- Usage measurement, which you can switch off in privacy preferences: daily totals of how features are used — visits (new or returning, from a flag kept on your device), the recommendation selector, searches and filters that return nothing (with the search words, unless they look like an email address or phone number), saves, lists, and clicks on booking, website and directions links. These are counts on our own database, not linked to you or your account, and kept for up to two years. No advertising identifiers, no cross-site tracking, and we never record what you type into forms or your email address. Account sign-ups and newsletter confirmations are counted from their own records.
- Google Analytics, which you can also switch off there: Google Analytics 4, a service from Google, counts page views and how people reach the site (for example from a search engine or a link) using its own cookies (named
_ga) on this site. Google receives your browser and device details and an approximate location; it doesn’t log or store IP addresses in Google Analytics 4. We have switched off Google signals and advertising personalisation. If you switch analytics off, Google Analytics stops and its cookies are removed from this site.
How we use it
- To run your free account, keep you signed in and let you save and share lists.
- To send emails you asked for: account confirmation and password reset emails, and the weekly edit if you subscribe.
- To reply to your messages and correct our listings.
- To protect the site and our readers from spam, fraud and misuse.
We do not sell personal data and we do not use it for third-party advertising.
Consent and withdrawing it
We collect and use personal data with your consent, or where the PDPA otherwise permits. You can withdraw consent at any time — for example by unsubscribing from emails, changing your account preferences or deleting your account. If you withdraw consent we need to provide the service, we may no longer be able to provide it.
Who we share it with
We use service providers who process data on our behalf under contract, only for the purposes above:
- Vercel (website hosting) and Neon (database, hosted in Singapore), which store the site and your account data.
- Cloudflare (image storage) and GitHub (automated content jobs and encrypted database backups, kept for 90 days).
- An email delivery provider, which sends account and newsletter emails.
- Cloudflare Turnstile, if enabled on our forms, to tell people apart from automated spam.
- OneMap (Singapore Land Authority), which supplies map images; your browser requests these directly when you view a map.
Some providers may store data outside Singapore. Where that happens we take steps to ensure the data receives protection comparable to the PDPA. The current list of providers and locations is available from our Data Protection Officer.
Cookies and similar storage
We use one essential cookie to keep you signed in, and security cookies used by our sign-in system. Your browser also remembers your last homepage selector choices and your privacy choice on your device. We don’t use advertising cookies. Usage measurement and Google Analytics run unless you switch them off in privacy preferences, and you can change your mind at any time.
How long we keep it
We keep account data while your account is open. When you delete your account, your profile, saved lists and preferences are deleted. Newsletter consent records are kept for as long as needed to show that we had your consent, and contact messages for as long as needed to deal with them. Security logs are kept for a short period.
Access and correction
You can see and update most of your data in your account. You may also ask us for access to, or correction of, personal data we hold about you by contacting [privacy contact email]. We will respond as soon as reasonably possible.
Security
Passwords are stored as one-way hashes, connections are encrypted, and access to our editorial systems is limited to the people who run the site, each with their own account.
Changes
If we change this notice we will update the effective date above, and tell account holders by email about significant changes.