Privacy Statement

Effective Date: 15 October 2026

This statement explains how HAPR collects, uses and protects personal data on www.thehapr.com and in the HAPR platform at app.thehapr.com. It also explains your rights and how to use them.

1. Who we are and our two roles

HAPR PTE. LTD. (UEN 202439380K), 12 Woodlands Square #13-79, Singapore 737715, runs the website and the platform. You can reach us about privacy at [email protected].

We act in two roles.

As controller, we decide how we use the data of our customers' staff who use the platform, visitors to our website, people who contact us, and hotel staff we contact for sourcing requests.
As processor, we handle the data of event attendees and travellers on behalf of the organisation that runs the event or books the travel (the organiser). The organiser decides why that data is collected. If you registered for an event, the organiser's privacy notice applies first, and you can ask the organiser about your data. We help them answer.

2. What we collect

Platform users. Your name, work email, organisation and role, the times you sign in, and what you do in the platform. When you create an account, we record which version of our Terms of Service you accepted, when you accepted it and how you signed up (email, Google or LinkedIn). If you buy a subscription, the billing contact's name, email and company. Card details are entered on Stripe's payment page and never reach us.

Event attendees (on behalf of the organiser). What the organiser's registration form asks for. That can include your name, email, phone, organisation, position, date of birth, nationality, gender, home address, emergency contact, visa details, travel and hotel details, answers to the organiser's own questions, and a scan of your passport or ID with an ID photo.

Special category data. A form may ask about accessibility needs or dietary requirements, which can reveal health or religious belief. These are collected only with your explicit consent on the form, and you can withdraw it.

Travellers (on behalf of the organiser). Flight, hotel and ground transport bookings and spend, received from the organiser's travel agency.

Hotel staff. For sourcing requests we hold the work contact details of hotel staff, which come from the hotel's own listings, public sources or a business contact finder. Where they did not come from you, our first email to you says so and tells you how to opt out.

Website visitors. Your IP address and the pages you visit. If you accept analytics cookies, Google Analytics also records your visit with a pseudonymous id (section 8).

People who contact us. Your name, email, company and message. We keep a copy in our records (section 7).

Help chat and issue reports. Your questions, reports, screenshots and comments.

3. Why we use it and our lawful basis

Purpose	Lawful basis
Providing the platform to our customers and their staff	Contract
Billing and keeping accounts	Contract, and our legal obligation to keep tax records
Recording that you accepted our Terms of Service	Contract, and our legitimate interest in being able to show what was agreed
Running events for organisers (attendee and traveller data)	The organiser's lawful basis. We act on their instructions.
Accessibility and dietary answers	Your explicit consent
Contacting hotel staff for sourcing requests	Our legitimate interest in sourcing hotels for our customers
Answering help chats, issue reports and enquiries	Our legitimate interest in supporting users
Keeping the service secure and working (logs, error reports)	Our legitimate interest in security
Website analytics	Your consent, given in the cookie banner

We do not sell personal data, and we do not use it for advertising.

4. AI features

Some features use an AI model provided by Anthropic.

Reading passport scans. When you upload a passport, the image is sent to the model to read the fields, so you do not have to type them. You can choose to type them yourself instead.
Assistants. The travel and shuttle assistants answer questions about bookings. Names, emails, phone numbers and passport details are replaced by placeholders before anything is sent to the model.
Help chat and issue triage. Personal details are removed from the text before it is sent.

The model does not make decisions about you that have legal or similar effects. We have assessed these features in a data protection impact assessment.

5. Who receives it

We use service providers (sub-processors) to run the platform, such as Supabase for the database and file storage, Cloudflare for hosting, Postmark for email, Stripe for payments, Anthropic for AI features and Google for maps and, with consent, analytics. The full list, with what each receives and where, is on our Sub-processors page.

Attendee data is visible to the organiser's staff who have access to that event. Rooming lists are shared with the hotel the organiser chooses.

6. International transfers

Our database and files are stored in the European Union (Frankfurt, Germany). Some providers are in the United States or elsewhere. Each transfer is covered by the provider's data processing agreement with the EU Standard Contractual Clauses.

7. How long we keep it

Data	How long
Event attendee profiles	Anonymised 90 days after the event ends, or 90 days after the last change when the event has no end date
Passport and ID scans	Deleted 30 days after the event ends. A scan no longer linked to a registration is deleted after 7 days.
Passport reading cache	30 days
Platform accounts	Until the account is deleted. A deletion takes effect 14 days after you ask, and you can cancel until then. The record of accepting our Terms is kept separately, as below.
Record of accepting our Terms of Service	While the account exists, then 2 years after it is deleted, so we can show what was agreed
Billing records	As long as tax law requires
Help chats	12 months from the last message
Your enquiries to us	Kept as business records with no end date, like the email copies of your message. You can ask us to erase yours (section 9) and we erase it by hand.
Your cookie choice record	No end date: it holds only the choice, with no identifier, so there is nothing in it to erase.
Issue reports and their screenshots	12 months after the issue is resolved
Access logs	90 days
API call logs	30 days
Cookie choice	182 days

An organiser may agree different periods with us for their events.

8. Cookies

We use only the cookies the site and platform need to work, plus Google Analytics on the website if you accept it. The Cookie Policy lists every cookie and how long it lasts.

9. Your rights

You have the right to:

get a copy of your data and receive it in a portable format
correct it
have it deleted
restrict or object to how it is used
withdraw consent at any time, without affecting what was done before

Platform users can download their data and delete their account themselves under Your data and privacy in the user menu. Event attendees should ask the organiser of their event first. If you write to us, we pass your request to the organiser and help them answer. Everyone else can write to [email protected].

We answer within one month. We will only reply to the email address we already hold for you, and we never ask for a copy of your passport to prove who you are.

10. Complaints

You can complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the problem happened. In Singapore, you can contact the Personal Data Protection Commission. We would appreciate the chance to help first.

11. Singapore

HAPR is a Singapore company and also follows Singapore's Personal Data Protection Act 2012. You can contact our Data Protection Officer at [email protected]. If you are not satisfied with our answer, you can contact the Personal Data Protection Commission at www.pdpc.gov.sg.

12. EU representative

HAPR has no establishment in the European Union and has not appointed a representative under Article 27 of the GDPR. You can contact us directly at [email protected].

13. Security

We protect personal data with encryption in transit and at rest, access limited by organisation, event and role, a log of who accessed which data, private storage for scans with short-lived links, and by keeping personal details out of logs and error reports. No system is completely secure, and if a breach affects you, we follow our breach procedure and the law on telling you and the authorities.

14. Changes

We will post any change on this page with a new effective date, and tell platform users of material changes by email.