k Klubo Sites

Version 1.2 · last updated 12 Nov 2026

Klubo Sites privacy policy

How we handle the details of people who make a site with us, under Singapore's Personal Data Protection Act 2012 (PDPA). For the details your own visitors send through your site, see the data processing terms.

1. Who we are

Allyvate Pte. Ltd. (UEN 201934150N), trading as Klubo Sites. Our Data Protection Officer is reached at privacy@getklubo.com.

2. What we collect

  • Contact details: your name, email or WhatsApp number.
  • Business details: business name, type, address, hours, prices, and what you tell us about your business.
  • Links and content you give us: your website or social pages, photos, logos and files, and what we read from them.
  • Your messages: your chat with your site, Help questions, change requests and screenshots.
  • Payment records: what you paid and when. Stripe handles card details; we never store your full card number.
  • Technical data: device type, browser and times, needed to run and protect the service. We don't use advertising or tracking cookies. Your browser keeps your private link so you can come back to your site.
  • One necessary cookie: when you start a preview, your browser gets a cookie called ks_dev. It holds only a random id, not your name or contact details, and lets us count previews per device to stop abuse. It lasts 1 year. We keep only a scrambled (hashed) copy of the id with your order. The websites we build for businesses set no cookies.

3. Why we use it

  • To build, change, host and support your website.
  • To take payments and keep accounts.
  • To keep the service secure and stop abuse.
  • To send service messages: your private link, your preview's clear date, go-live, and receipts.
  • To send news or offers, only if you tick to agree. You can stop them at any time. We don't send marketing to Singapore numbers on the Do Not Call Registry without your clear consent.

4. AI

We use an AI provider to read the content you give us, write and change your site, and check it. Your content is sent to it only for that. Our provider's business terms don't allow your content to be used to train its AI models.

5. Who we share it with

Only service providers that help us run Klubo Sites, under contracts that require them to protect it:

VercelHosting the websites and connecting domainsGlobal
SupabaseDatabase and file storageSingapore
AnthropicAI that reads what you give us, writes and changes your site, checks it, and writes the automatic answers to enquiries on your siteUnited States
StripePaymentsSingapore and global
ResendSending our emails to youUnited States
CloudflareChecking that the order form is used by a person, not a robot (Turnstile). It sees your browser and internet address, not what you typeGlobal
GoogleReading your public Google business listing, only once we switch this on (it isn't on yet)Global
TelegramUrgent alerts to our own team (a business name and a one-line summary), only once we switch this onGlobal

We never sell personal data.

6. Overseas transfers

Some providers store or process data outside Singapore. We only use providers bound by contract to protect it to a standard comparable to the PDPA.

7. How long we keep it

  • Unpaid previews: deleted 14 days after you start them, with their photos and details.
  • Live sites: while you are a client, then deleted within 90 days of leaving.
  • Messages your visitors send through your site: 12 months, then deleted.
  • Payment and accounting records: 5 years, as Singapore law requires.

8. Seeing, correcting or withdrawing

You may ask to see or correct your personal data, or withdraw your consent, by emailing privacy@getklubo.com. We reply within 30 days; if we need longer, we tell you when to expect it. Withdrawing consent may mean we can't keep providing the service, and we tell you what that means before acting on it.

9. Security

Encrypted connections. Your site is opened with a private link only you hold; we keep only a scrambled copy of it, and there is no password to steal. Our admin screen is password-protected and used only by our team. Each client's data is kept apart.

10. If something goes wrong

If a data breach is likely to cause you significant harm, or affects 500 or more people, we notify the Personal Data Protection Commission as soon as we can and no later than 3 calendar days after we find it must be notified. We also tell you directly if you are likely to be significantly harmed: what happened, what data, what we have done and what you should do.

11. Changes

We post updates here and email clients about important changes.