Udufood (“we”, “us”) helps Singapore residents find complementary meals from restaurants. This Privacy Policy explains what we collect and why. Sections below cover receivers and restaurant partners.
Receivers
What we collect
- Account: your first name and Singapore mobile number.
- Location: only when you enable GPS to find food near you.
- Activity: claims, pickup history, and no-show count.
How we use it
We use your data to show food donations near you, send SMS verification codes, and remind you about pickups you've claimed. We don't sell your data — ever.
PDPA compliance
Udufood complies with Singapore's Personal Data Protection Act (PDPA). You can request to view, correct, or delete your data at any time by emailing support@udufood.com.
Sharing
Restaurants only see your claim code and first name at pickup. They never see your phone number, location, or claim history. Donors never see any of your details.
How long we keep it
Your data is retained while your account is open. After deletion, personal data is removed within 30 days. Anonymised claim statistics may be retained for impact reporting.
Service providers
We use trusted third parties to operate the app. None receive more data than they need:
- Twilio — SMS delivery for OTP codes.
- Cloudflare — security and DDoS protection.
- Iconify — icon assets (no personal data).
Where your data lives
All personal data is stored in Singapore on AWS ap-southeast-1. It does not leave Singapore except for transient transmission to the service providers listed above.
Age requirement
Udufood is for users aged 16 and above. We do not knowingly collect data from anyone under 16. If you believe a minor has signed up, email support@udufood.com and we'll remove the account.
Restaurant partners
What we collect
- Business: restaurant name, UEN, address, opening hours.
- Contact: owner/manager name, business email, business mobile.
- Operations: donations posted, claims received, and related restaurant activity.
How we use it
We use your data to list your restaurant on the platform for receivers to find and to manage claims and donation listings. We don't sell your data — ever.
PDPA compliance
Udufood complies with Singapore's Personal Data Protection Act (PDPA). You can request to view, correct, or delete your business profile at any time by emailing support@udufood.com.
What's public vs private
- Public: your restaurant name, address, hours, and dish photos — visible to all receivers and donors.
- Private: your contact email, contact mobile, and UEN — never shown to other users.
How long we keep it
Business data is retained while your restaurant account is open. After deletion: contact details removed within 30 days; UEN and related business records may be retained where required for legal or regulatory purposes.
Service providers
We use trusted third parties to operate the platform:
- Twilio — SMS delivery for OTP codes.
- Cloudflare — security and DDoS protection.
- Iconify — icon assets (no personal data).
Where your data lives
Business data is stored on AWS. We do not collect or process payment card data in the app.
Age requirement
Restaurant accounts must be opened by an authorised representative aged 18 or above. We rely on ACRA UEN verification to confirm business authenticity.
Questions about your data? Email support@udufood.com.