Privacy Policy

This notice is from TASTEVUE LLP ("TasteVue", "we", "us", "our"), a limited liability partnership registered in Singapore at 30 Raffles Place, BNI Tower, Singapore 048622. We decide how and why your personal data is handled when you use TasteVue, which makes us the organisation responsible for it under Singapore's Personal Data Protection Act 2012 ("PDPA").

It covers your personal data when you:

• visit tastevue.com or any of our sites that link to this notice;
• download and use the TasteVue app;
• collect stamps, earn points or claim rewards at a participating restaurant;
• contact us, or deal with us at an event or through a survey.

It works alongside our Terms of Service. Where this notice mentions marketing permissions, the full terms of those permissions are in section 5 of the Terms.

What you give us

• Account details: your name and display name, email address, password, and phone number where you provide one.
• Profile details: profile photo, date of birth, gender, and the cuisines and rewards you say you prefer. Date of birth lets us check you are old enough to hold an account and send you a birthday reward; the rest is used to make recommendations more useful. These are optional, and you can leave them blank or remove them.
• Content you post: food diary entries, photos, reviews, ratings and comments.
• Messages: anything you send us by email, through the contact form, or through in-app support, including a demo request from a restaurant.

What we collect as you use TasteVue

• Activity: visits recorded at a restaurant counter, stamps and points awarded, stamp card progress, tier, quests completed, rewards, perks and vouchers claimed, logins and streaks, and the referral code you used or shared.
• Payments made through the app: in-app bill payment is being phased out and ends on 10 October 2026; after that date the App takes no payments. For payments made before then we hold the restaurant and outlet, the amount, any discount applied, and the time. Your card number is not among them — card details went straight to Stripe, and we keep the transaction record, not the card. We hold these records for as long as How long we keep it describes, because tax and accounting rules require it of us.
• Device and log data: device model and operating system, app version, language, IP address, crash reports, and the push notification token that lets us reach your device.
• Location: only if you grant the permission, and only to show you places near you and improve map results. You can withdraw it at any time in your device settings, and the rest of the app carries on working without it.
• Camera and photo library: only if you grant the permission, and only to let you attach a photo to a diary entry, review or profile. We do not access your camera or library in the background.
• Website analytics: pages viewed, referrer and broad interaction data. See Cookies and analytics.

What we receive from others

• From Apple or Google, if you choose to sign in with them: your name, email address and profile photo as that provider supplies them. We receive nothing else from your account there, and we do not post anything to it.
• From a participating restaurant, when its staff record your visit at the counter: the outlet, the bill amount keyed, the points and stamps awarded, and the time. This is how a stamp reaches your card.

What we do not collect

We do not collect data revealing your race, religion, political views, health, trade union membership, genetic or biometric data, or sexual orientation. We do not buy personal data from data brokers. We do not store your card number — card payments made in the App before 10 October 2026 are handled by Stripe, and the card details go to them, not to us.

We use your personal data to:

• create and run your account, and sign you in;
• run the loyalty programme — record visits, award and correct stamps and points, track tiers, and issue and redeem rewards and vouchers;
• show you restaurants, recommendations and curated lists;
• host the diary entries, reviews and photos you post;
• send you service messages about your account, rewards and security;
• send you marketing where you have permitted it — see Marketing and your choices;
• answer your questions and provide support;
• detect and prevent fraud and abuse of the loyalty programme, and enforce our Terms;
• understand how the Services are used, in aggregate, so we can fix and improve them;
• meet our legal, accounting and regulatory obligations.

Under the PDPA we rely on your consent for most of this — given when you create an account and accept our Terms, when you grant a device permission, and when you leave a marketing switch on. We also rely on the legitimate interests and other bases the PDPA allows where they apply, for example to prevent fraud, to secure our systems, and to keep the records the law requires us to keep.

We do not use your personal data to make decisions about you by automated means that produce legal or similarly significant effects, and we do not sell your personal data.

What you agreed to

Marketing permission rides on the Terms of Service you accept when you create an account, rather than on a separate tick box. Accepting them means TasteVue may send you rewards, member offers, promotions and news about the app. We record which version of the Terms you accepted and when.

The first time you collect a stamp with a restaurant brand, that brand may send you marketing about itself. The permission starts at that first stamp and covers that brand only — never every restaurant on TasteVue, and never a restaurant you have not stamped with. A brand with several outlets counts as one restaurant.

How marketing reaches you

By email and by push notification. We do not send marketing by SMS. Push notifications can also be turned off wholesale in your device settings.

Turning it off

• In the app: Settings → Marketing & Preferences. TasteVue has its own switch and so does each restaurant you hold a card with. They are independent: turning TasteVue off leaves the restaurants alone, and turning one restaurant off leaves the others alone.
• In any marketing email: the unsubscribe link at the bottom.
• By email: write to admin@tastevue.com, and we will action it for you.

We act on a change as soon as we receive it, and we pass a restaurant opt-out on to that restaurant, which is required to honour it. A message already on its way may still arrive, and a restaurant that already holds your details may take a short time to process the withdrawal on its own systems.

What it does not affect

Turning marketing off never affects your stamps, stamp cards, points, tier, rewards or membership. It only changes whether you hear about offers. You will still receive service messages — a reward waiting, a points correction, security and password notices, changes to our Terms, and product updates such as a new restaurant partner joining TasteVue — because those are not marketing.

The record we keep

Every marketing decision on your account is recorded: what changed, whether it was for TasteVue or for a particular restaurant, when, and whether it came from your accepting our Terms or from a switch you moved yourself. We keep that record so that both of us can check later what was actually agreed, and because the PDPA expects us to be able to evidence consent.

This is the part members ask about most, so it is set out in full. A restaurant you have collected a stamp with may receive your name, email address and age band, together with a record of your activity at that restaurant. It may use them to run its own loyalty programme and to market its own business — some of that marketing is sent by TasteVue on its behalf, and a restaurant may also contact you directly.

Our agreement with every participating restaurant limits what it may do with this. It must keep your details confidential, use them only for its own loyalty programme and marketing, never sell them or pass them to anyone else, honour an opt-out promptly, and notify us of any breach. If you think a restaurant has misused your details, tell us at admin@tastevue.com and we will act on it.

A restaurant you have never stamped with receives nothing about you at all, whether or not it is listed on TasteVue.

Some of what you do in TasteVue is public by design. Treat anything in this list as visible to other members, and where a page is openly accessible, to anyone:

• your display name and profile photo;
• diary entries, photos, reviews, ratings and comments you publish;
• your position and display name on any leaderboard you appear in;
• your follower and following counts.

Your email address, phone number, date of birth, gender, points balance, transaction history and stamp card progress are not shown to other members.

You can delete a post at any time, and it stops being served. Copies may persist for a while in caches and on devices that already loaded it — that is a property of the internet, not a decision of ours.

We share personal data only with the categories below. We do not sell personal data, and the only third parties who may market to you are the restaurants you have collected a stamp with — never anyone else, and never the platform at large.

Service providers who process data for us

These organisations handle data on our instructions and are bound by contract to protect it and to use it for nothing else:

• Google (Firebase and Google Cloud) — sign-in, database, file storage, backend functions and push notification delivery.
• Resend — sending our service and marketing emails.
• Stripe — processing card payments made through the App and paying the money on to the restaurant, until in-app payment ends on 10 October 2026. Card details go directly to Stripe and are never stored on our systems.
• Wogi — issuing and fulfilling third-party vouchers you choose to redeem.
• Vercel — hosting and serving this website.
• Google Analytics and Microsoft Clarity — website analytics. See Cookies and analytics.

Participating restaurants

A restaurant you have collected a stamp with may receive your name, email address and age band, and your activity at that restaurant, exactly as set out in What a restaurant receives about you. Unlike the providers above, a restaurant decides for itself how to use what it receives within the limits our agreement imposes, so it is responsible for that data under the PDPA alongside us.

Other situations

• Legal requirements: where we are required to disclose data by law, by a court, or by a regulator, or where disclosure is necessary to investigate or prevent fraud, to protect the safety of any person, or to enforce our Terms.
• Business transfers: if we merge, are acquired, or sell assets, your data may transfer as part of that transaction. We will tell you before it becomes subject to a different privacy notice.
• With your consent: anything else, only if you ask us to or agree to it.

Our website uses cookies and similar technologies that are needed to serve the site and to understand, in aggregate, how it is used, so we can improve it.

• Google Analytics 4 — page views, referrers and broad usage patterns. It runs only on our official domains, not on preview or staging builds.
• Microsoft Clarity — aggregated interaction data such as clicks and scrolling, which shows us where a page confuses people.
• Vercel Analytics — privacy-friendly traffic measurement.

You can block or delete cookies in your browser settings, and you can install the Google Analytics opt-out add-on. Blocking them may affect how parts of the site behave.

We do not currently respond to browser "Do Not Track" signals, because no common standard for them has been settled. If one is adopted, we will update this notice.

We keep personal data only as long as we need it for the purposes in this notice, unless the law requires us to keep it longer.

• Account and profile data: while your account is open, and for up to twelve months after it closes, so that an account closed by mistake or in dispute can be restored.
• Loyalty records — visits, stamps, points, rewards: for the life of the account and then for as long as we need them to settle accounts with the restaurants involved.
• Marketing consent records: for as long as we can be asked to evidence what you agreed to, which may outlast the account itself. This record exists to protect you as much as us.
• Financial and transaction records: for at least five years, which is what Singapore tax and accounting rules require.
• Backups: deleted data can persist in encrypted backups for a short period before those backups roll off.

When we no longer need personal data, we delete it or anonymise it so it can no longer be linked to you.

TasteVue is operated from Singapore, but the service providers listed above run infrastructure in other countries, so your personal data may be stored or processed outside Singapore — including in the United States and the European Union.

Where we transfer personal data out of Singapore, the PDPA requires us to make sure it will be protected to a standard comparable to the PDPA. We do that through our contracts with those providers, including the standard data protection terms they offer, and by choosing providers with recognised security certifications.

We use reasonable technical and organisational measures to protect your personal data: encryption in transit, access controls so that staff and restaurants reach only the data they need, server-side rules that stop an app from writing records it has no business writing, and an audit trail for consent decisions.

No system is perfectly secure, and transmitting data over the internet carries risk we cannot eliminate. Keep your password to yourself, use one you do not use elsewhere, and tell us at admin@tastevue.com if you think your account has been accessed by someone else.

If a data breach occurs that is likely to result in significant harm to you, or that meets the notification threshold in the PDPA, we will notify the Personal Data Protection Commission and affected members as the law requires.

TasteVue is not directed at children under 13, and we do not knowingly collect personal data from them. Members under 18 may use the Services only with the permission of a parent or guardian.

If you believe a child under 13 has given us personal data, write to admin@tastevue.com and we will delete the account and the data promptly.

Under the PDPA, and wherever else the law gives you these rights, you can:

• Ask what we hold about you and how it has been used or disclosed in the past year.
• Correct anything wrong. Most of it you can fix yourself in the app under Profile.
• Withdraw consent — for marketing, in Settings → Marketing & Preferences; for location, camera or notifications, in your device settings; for everything, by closing your account.
• Delete your account and the personal data we no longer need to keep.
• Ask for a copy of the data you gave us, in a commonly used format.

Write to admin@tastevue.com and we will respond within 30 days. If we need longer, we will tell you why and when to expect an answer. We may need to verify your identity first — this protects you from someone else asking for your data.

Withdrawing consent may mean we can no longer provide part of the Services, and we will tell you the likely consequences before we act on it. Withdrawal is not retrospective: it does not undo processing that was lawful when it happened.

If you are not satisfied with our response, you can complain to the Personal Data Protection Commission of Singapore. We would rather you came to us first so we can put it right.

We update this notice when our practices change or the law requires it. The "Last updated" date at the top tells you which version you are reading.

Where a change materially affects what you have permitted — particularly anything in Marketing and your choices — we will tell you in the app rather than relying on you to notice the date. Being shown a notice does not switch anything back on: a preference you have set stays set.

For any question about this notice, to exercise a right, or to reach our Data Protection Officer: