Privacy Policy

Yumipop ("Yumi!", "we", "us") is operated by Nucleus AI Pte. Ltd., Singapore. We are committed to protecting your privacy and complying with applicable data protection laws including the EU General Data Protection Regulation (GDPR), Singapore Personal Data Protection Act (PDPA), US state privacy laws, and Saudi Arabia's Personal Data Protection Law (PDPL).

1. Data We Collect

Account data: Name, email address, password (hashed), profile photo, birthday (optional), gender (optional), country, city.

Wishlist data: Wishlist titles, descriptions, product links, images, prices, reservation status.

Usage data: Pages visited, actions taken, device type, IP-based country (via Cloudflare). We do not use fingerprinting or tracking pixels.

2. How We Use Your Data

• Provide and improve the Yumi! service
• Enable wishlist sharing and gift reservation
• Send essential service notifications
• Detect and prevent fraud or abuse
• Comply with legal obligations

We do not sell your personal data. We do not share your data with third parties for marketing purposes.

3. Legal Basis (GDPR)

We process your data based on: (a) your consent, (b) performance of our contract with you, (c) legitimate interests in operating and improving our service, and (d) compliance with legal obligations.

4. Data Storage & Security

Your data is stored on servers in the EU (database) and globally (Cloudflare edge network). Passwords are hashed with PBKDF2 (100,000 iterations). All connections use TLS encryption. We implement rate limiting, input validation, and access controls.

5. Your Rights

Depending on your jurisdiction, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and data
• Export your data (data portability)
• Object to or restrict processing
• Withdraw consent at any time

To exercise these rights, email us at privacy@yumipop.com.

6. Cookies

We use essential cookies for authentication and session management. We use optional analytics cookies only with your consent. You can manage your cookie preferences at any time. See our cookie banner for details.

7. International Transfers

Your data may be processed in Singapore, the EU, and the US through our infrastructure providers (Cloudflare, Vercel). We ensure adequate data protection through standard contractual clauses and provider certifications.

8. Children's Privacy

Yumi! is not directed at children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us data, contact us immediately.

9. Data Retention

We retain your data as long as your account is active. After account deletion, we remove your personal data within 30 days, except where required by law.

10. Contact