# Privacy Policy

**Last updated:** 30 August 2026

This policy explains what personal data Lagi collects, why, and what happens to it. It is written to comply with the Singapore Personal Data Protection Act 2012 (PDPA). Short version: we collect what the marketplace needs to function, we don't run ad tracking, and we don't sell data.

## 1. What we collect

**Account data.** Your email address (used to sign you in and to send notifications), a display name if you set one, and a general location if you provide one (a neighbourhood, never a precise address — we never ask for one). We generate a pseudonymous handle for you; that handle, not your email, is what other users see.

**Listing content.** Titles, descriptions, condition details, prices, and photos you upload. Photos are stored on our own object storage; we strip embedded metadata, including GPS location, from photos before they are published.

**Marketplace activity.** Offers, counters, questions and answers, watches, reservations, reports, and the saved policies you set (such as budgets and price floors). Price floors and budgets are private to your account and are never disclosed to other users or their assistants.

**Web chat messages.** If you use the web chat, the messages you exchange with it are stored to keep the conversation working, and deleted after 30 days.

**Notification preferences.** Which channel you want (currently email; WhatsApp when available) and, if you opt in to WhatsApp later, the phone number you verify for it.

**Technical and security data.** IP addresses are used for rate limiting and abuse prevention. Every marketplace action (by you or an assistant connected to your account) is recorded in an audit log — what was done, when, by which connected client. The audit log exists for security, dispute resolution, and integrity of the marketplace.

**Connected assistants.** When you connect an AI assistant via OAuth, we record which client you authorised and the grants you gave it. We do not receive your conversation with your assistant — only the tool calls it makes to Lagi.

## 2. What we do not do

- No advertising trackers, no third-party analytics scripts, no cross-site tracking. The only cookie we set is the session cookie that keeps you signed in.
- We do not sell or rent personal data. Ever.
- We do not display your email address or phone number to other users, and our systems do not include them in anything an assistant can fetch.

## 3. Why we collect it (purposes)

We collect and use personal data to: operate the marketplace (accounts, listings, offers, Q&A, reservations); send the transactional notifications you'd expect (offer received, watch matched, and so on); keep the platform secure and rate-limited; maintain the audit trail that underpins trust and dispute resolution; compute the public track-record signals described on our [trust page](/trust); and comply with legal obligations. We rely on your consent, given when you create an account and use features, and on legitimate purposes recognised by the PDPA (such as security and fraud prevention).

## 4. Who can see what

- **Public listing pages** show your handle, display name, listing content, and general area. They never show your email, phone number, or exact address.
- **Counterparties** (buyers or sellers you interact with) see your handle, display name, and computed track record — not your contact details. You share contact details yourself if and when you choose to.
- **Service providers.** We use infrastructure providers to host the service and deliver email. They process data on our instructions and for no other purpose. If you opt in to WhatsApp notifications when available, messages are delivered through the WhatsApp Business network, which involves Meta's processing per their terms.
- **Legal.** We may disclose data where required by law or to protect users from fraud or harm, and we record such disclosures.

Where data is stored or processed outside Singapore, we ensure a standard of protection comparable to the PDPA as required by section 26 of the Act.

## 5. How long we keep it

| Data | Retention |
|---|---|
| Login codes (OTPs) | Deleted on use or expiry (minutes) |
| Sign-in sessions | 30 days |
| Web chat messages | 30 days |
| Notification queue records | 90 days |
| Listings, offers, Q&A | While your account is active; withdrawn drafts are yours to delete |
| Audit log and offer history | Retained as an append-only record for marketplace integrity and dispute resolution |
| Photos | While the listing exists; removed photos are deleted from storage |

When you ask us to delete your account, we delete or anonymise your personal data, except records we are required to keep (such as audit entries needed for security or legal purposes), which are retained with access restricted.

## 6. Your rights

Under the PDPA you may:

- **Access** the personal data we hold about you and how it has been used or disclosed in the past year;
- **Correct** inaccurate or incomplete data;
- **Withdraw consent** to collection or use (which may mean closing your account, since most of our processing is necessary to provide the service).

Send requests to lagi@huper.technology. We respond within 30 days as required by the PDPA. If we cannot meet a request, we will tell you why.

## 7. Security

Personal data is protected by encryption in transit, hashed session and login credentials, scoped and audience-bound access tokens for connected assistants, least-privilege access inside our systems, and an append-only audit log. No system is perfectly secure; if a data breach notifiable under the PDPA occurs, we will notify the PDPC and affected users as required.

## 8. Children

Lagi is for users 18 and over. We do not knowingly collect data from children.

## 9. Changes

We will post updates to this policy here, with the date above, and give notice of material changes on the website before they take effect.

## 10. Contact

Our data protection contact: lagi@huper.technology. If you are unsatisfied with our response, you may contact the Singapore Personal Data Protection Commission (pdpc.gov.sg).