Privacy Policy

1. What Data I Collect

I collect personal data that you provide to me directly and automatically through your use of the site:

1.1 Information You Provide

• Account Information: Name, email address, username, and profile picture (via Google OAuth)
• Booth Profile Information: Business name, description, product categories, social media links, and uploaded media
• Event Applications: Application details, custom responses to event-specific questions
• Event Attendance: Your status as an attendee at specific events and your role (e.g., Cosplayer, Photographer)
• Communications: Messages sent through the site's contact forms or email

1.2 Information Collected Automatically

• Authentication Cookies: Session tokens for secure login
• Cookie Preferences: Your consent choices for cookies
• Technical Information: IP address, browser type, device information (only when necessary for security or functionality)

2. How I Use Your Data

I collect and use your personal data for the following purposes:

• Provide Services: Enable account creation, booth profile management, and event applications
• Authentication: Securely verify your identity and maintain login sessions
• Communication: Send important updates about your applications, events, and account
• Event Management: Allow event organizers to review and manage booth applications
• Creator Discovery: Display booth profiles in the public creator directory (only if you choose to make your profile public)
• Platform Improvement: Understand usage patterns to improve the site (only with your consent for analytics cookies)
• Legal Compliance: Comply with legal obligations and protect against fraud or abuse

3. Data Sharing & Disclosure

I do not sell your personal data. I may share your data in the following circumstances:

3.1 With Event Organizers

When you apply to participate in an event, your booth profile and application details are shared with the event organizer for review purposes.

3.2 Public Information

If you set your booth profile to "Public", your business information and media will be visible in the vendor directory to all visitors.

Additionally, when you indicate that you are attending an event (e.g., as a Cosplayer, Photographer, or General Attendee), your attendance status is public by default. You can choose to hide your attendance from public lists, though event organizers will always be able to see who is attending their event. Aggregate attendance numbers are always public.

3.3 Service Providers

I use trusted third-party service providers to help operate the site:

• Cloudflare: Hosting, database (D1), and file storage (R2)
• Google: OAuth authentication
• Postmark: Transactional email delivery

3.4 Legal Requirements

I may disclose your data if required by law, legal process, or government request.

4. Cookies & Tracking Technologies

I use cookies and similar technologies. For detailed information, please see the Cookie Policy.

4.1 Essential Cookies

Required for authentication and site functionality. These do not require consent.

4.2 Analytics Cookies

Help me understand how visitors use the site. Only loaded with your explicit consent.

5. Your Rights Under PDPA

Under Singapore's Personal Data Protection Act, you have the following rights:

To exercise any of these rights, please contact me as the Data Protection Officer using the details in the Contact section.

6. Data Security

I implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse:

• All data transmitted is encrypted using HTTPS/TLS
• Authentication via Google OAuth with secure session management
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Secure cloud infrastructure with Cloudflare

7. Data Retention

I retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Retained while your account is active, plus a reasonable period after deletion for legal compliance
• Application Data: Retained for the duration of the event and a reasonable period thereafter for record-keeping
• Session Cookies: Automatically deleted when you log out or after 30 days
• Consent Preferences: Retained until you clear them or for 1 year

8. Cross-Border Data Transfers

Your personal data may be processed and stored on servers located outside of Singapore (via Cloudflare's global network). I use established providers that publish recognised data protection safeguards (data processing terms, encryption in transit and at rest, and access controls), and I keep transfers to the services the site actually needs.

9. Changes to This Policy

I may update this Privacy Policy from time to time. If I make significant changes, I will notify you via email or through a prominent notice on the site. Your continued use of the site after such changes constitutes acceptance of the updated policy.

10. Contact

If you have concerns about how I handle your personal data and are not satisfied with my response, you may contact the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.