Privacy Policy

1. Who We Are

Gold Evolution ("we", "us", "our") is the data controller for personal data collected through our gold trading platform. We are committed to protecting your privacy and complying with the Personal Data Protection Act 2012 (PDPA) of Singapore.

2. Data We Collect

We collect and process the following categories of personal data:

Identity & KYC Data

• Full legal name
• NRIC / FIN number (hashed — we store only the last 4 digits in plain text), or your passport number if you use a passport
• Date of birth
• Images of your identity document (NRIC front and back, or your passport photo page) that you upload for verification
• If you choose to register with Singpass (optional): your name, date of birth and NRIC / FIN number as held by Singpass (Myinfo), retrieved with your consent, and — where you let it — your email address, mobile number, nationality and occupation, which fill in the registration form for you and which you can change. The NRIC / FIN number is handled as above (we keep only a hash and the last 4 digits). We also keep a Singpass reference number linked to your account and a record that these details came from Singpass
• Mobile phone number
• Email address
• The purpose of your purchase and your source of income, as you select them when you register
• Your nationality, your occupation, and whether you are (or are connected to) a Politically Exposed Person — answers you give when you register
• Your next of kin's name, relationship to you and contact number
• The referral code of the person who introduced you

Compliance & AML Data

• Results of our identity and anti-money-laundering checks, including whether you are a politically exposed person
• Records and reports we are required to keep or file for larger transactions

Family Savings Records

• If you use Family Savings, the name, date of birth and relationship of any child or parent you record, and any notes you add. You give us this information about someone else, so please only enter it if you are entitled to

Referral Agents

• If you are an Agent: your payout details (PayNow or bank account), your commission records and withdrawals, and your acceptance of the Agent Agreement
• If you are an Agent: your recognition level and certificate numbers, and a random agent verification code. Anyone who has your code can check on our website that you are an active agent; the check shows only your first name, the first letter of your surname and the month and year you became an agent

Financial Data

• Gold holdings balance (grams)
• Bank account name, number, and bank name (for payouts)
• Transaction history (purchases and sales)
• Price alerts you set up in the app (which price, the amount you chose, and whether and when it was reached)
• Payment proof images uploaded by you (these can show your name, your bank, the amount and a bank reference)
• Card payments: you enter your card details in secure fields provided by Stripe, and we do not store your card number. We keep a Stripe customer reference, the payment status and the order it relates to
• Invoices generated by the platform

Photos of Gold You Offer to Sell Us

• If you use Sell Your Physical Gold: a description of each item, its weight, and the photos you attach (up to 8 per item) of the item and, if you have one, its certificate
• Please photograph only the item. Anything else in the picture, such as the background, a document, a name or a serial number, reaches us too

Account & Technical Data

• Username and referral code
• Account creation date and login timestamps
• IP address (collected by Cloudflare for DDoS protection)
• Browser and device type (collected by Netlify/Cloudflare)
• If you turn on fingerprint or face login, your device creates a passkey. We store only the passkey's public credential, never your fingerprint or face

Support Chat Data

• Messages you send to our in-app assistant, and our replies (whether from the automated assistant or a member of our team who takes over the chat)
• If you are logged in, the chat is linked to your account (name and GE number) so our team can help you; chats from logged-out visitors are kept anonymous
• If you message our WhatsApp number, we receive and keep your number, the name shown on your WhatsApp profile and your messages, and our team's replies are sent through WhatsApp

Please avoid typing sensitive details (such as your full NRIC, passwords, or full bank numbers) into the chat. For anything account-specific, our team may ask you to verify your identity in the app.

3. How We Use Your Data

• Account creation and authentication — to create and secure your account
• KYC / identity verification — to comply with our obligations under applicable financial regulations. Our team reviews your identity document by hand and compares the name, ID number and date of birth with what you entered. Your identity document is not sent to any AI service
• Registering with Singpass (optional) — to fill in your registration details from Myinfo with your consent, so that you type less and your details are accurate. Our team still reviews and approves your identity verification by hand
• Anti-money-laundering checks and reporting — to monitor activity, assess risk and make any reports the law requires
• Transaction processing — to record gold purchases and sales
• Buying physical gold from you — our team looks at the photos you send with a sell request by hand, to check the item and decide the payout. The photos are not sent to any AI service
• Listing an item we bought from you — if we buy an item from you and later offer it for sale in our online shop, we may use one or more of your photos of that item as the product photo. We look at each photo and choose it by hand, and we do not show your name or account details with it
• Payment processing — to verify payment proof and credit your account. An AI service reads payment screenshots (recipient, amount, date and bank reference); clear matches may be approved automatically and others are checked by our team. Our team may also use AI to read screenshots of our own bank payment notifications to match incoming payments to orders
• Payout disbursement — to transfer funds to your registered bank account
• Fraud detection and security — to detect suspicious activity and protect your account
• Customer support — to respond to your queries, including via our in-app chat (a team member may take over the chat from the automated assistant)
• Legal compliance — to retain records as required by law (7-year financial record-keeping)
• Platform communications — transactional emails and messages (including WhatsApp) about your account, orders and payouts, such as account verification, password reset and the price alerts you set up
• Referral programme — to link you to the agent who introduced you, to calculate their referral bonus, and to let them see the limited information described in Section 5
• Birthday vouchers — we use your date of birth to offer you a voucher in your birthday month

4. Legal Basis for Processing

Under the PDPA, we rely on the following bases to process your personal data:

• Consent — you explicitly consent at account creation and, if you register with Singpass, when you approve at Singpass the details to be shared with us
• Contract — processing is necessary to provide our gold trading services to you
• Legal obligation — we are required to retain financial records for 7 years under Singapore law
• Legitimate interests — fraud prevention and security monitoring

5. Third-Party Processors

We use the following trusted third-party services. All have signed Data Processing Agreements (DPAs) where applicable. We remain responsible for ensuring they handle your data appropriately.

Several of these providers (Netlify, Cloudflare, Resend, Anthropic, Stripe, Meta, Google and jsDelivr) are located outside Singapore, so your personal data may be sent to or processed in other countries. Where personal data is transferred internationally, we ensure adequate protections are in place through contractual safeguards.

If you were introduced by a referral agent

The Agent who introduced you can see, in their account, your name, email address, mobile number, GE number, sign-up date and account status, and for each purchase you make, its reference, type, amount, grams and date. They cannot see your identity documents, bank details or password. Agents are bound by our Agent Agreement to use customer information only for the referral programme, to handle it in line with the PDPA, and not to misuse it. We keep records of which customers each agent introduced and may review referral activity to meet our legal obligations.

6. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Active accounts — data is retained for the lifetime of your account
• Financial records (transactions, invoices, payment proofs) — retained for 7 years from the date of the transaction, in compliance with Singapore's financial record-keeping requirements
• Deleted accounts — upon a verified account deletion request, we will anonymise or delete your personal data within 30 days, except where we are legally required to retain certain records (e.g., financial records subject to the 7-year rule)
• Security logs — IP address and access logs are retained for up to 90 days
• Photos of gold you offer to sell us — kept with the record of that sell request, which we keep for 7 years like our other financial records; we do not delete them automatically before then. A photo we use in a shop listing stays for as long as the item is listed

7. Your Rights Under PDPA

As a data subject under Singapore's PDPA, you have the following rights:

Right to Access

You may request a copy of the personal data we hold about you. Contact our DPO at hello@goldevolutionsg.com. We will respond within 30 days.

Right to Correction

If your data is inaccurate or incomplete, you may request corrections through your profile settings in the app, or by contacting our DPO.

Right to Withdraw Consent

You may withdraw your consent to data processing at any time. Please note that withdrawing consent may prevent us from providing our services to you.

Right to Erasure (Account Deletion)

You may request deletion of your account and personal data. Submit a request through your profile page in the app or by emailing hello@goldevolutionsg.com. We will process your request within 30 days, subject to our legal retention obligations.

Right to Data Portability

You may request an export of your personal data in a machine-readable format.

If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

8. Security Measures

We implement appropriate technical and organisational measures to protect your data:

• All data transmitted over HTTPS with HSTS enforcement
• NRIC/FIN hashed with SHA-256 before storage
• Row-level security on all database tables (users can only access their own data)
• Authentication managed by Supabase with brute-force protection and leaked-password detection
• Cloudflare Turnstile bot protection on sign-up, sign-in, and password reset
• Strict Content Security Policy (CSP) headers on all pages
• Service-role database credentials are never exposed to the browser
• Payment proof image analysis performed server-side via Supabase Edge Functions
• Access to admin functions protected by JWT role claims

9. Data Breach Procedure

In the event of a data breach, we follow this 5-step procedure in accordance with PDPA mandatory breach notification requirements:

1. Contain (0–2 hours) — Immediately isolate affected systems, revoke exposed credentials, and suspend relevant services to prevent further data exfiltration.
2. Assess (2–24 hours) — Identify the scope of the breach, determine what categories of personal data were affected, and estimate the number of individuals impacted.
3. Notify PDPC (within 3 days) — If the breach is likely to result in significant harm, notify the Personal Data Protection Commission (PDPC) within 3 calendar days of discovery, as required under the PDPA.
4. Notify Affected Individuals (within 3 days) — Contact affected users directly via email with a clear description of: (a) what data was compromised, (b) what we have done to address it, and (c) what steps they should take to protect themselves.
5. Review & Document (within 30 days) — Conduct a full post-incident review, document the breach in our internal data breach register, implement corrective measures, and update policies as needed.

10. Cookies & Tracking

Our platform uses minimal tracking technologies:

• Session storage — used to maintain your login session within the browser. This is cleared when you close the browser tab.
• Cloudflare cookies — set by Cloudflare for security and bot detection purposes. These are strictly necessary and cannot be opted out of while using our platform.

We do not use advertising cookies, analytics tracking, or any third-party marketing pixels.

11. Children's Privacy

Our platform is intended for individuals aged 18 and above, and we do not open accounts for, or communicate with, minors. An adult account holder may, however, record a child's name, date of birth and relationship in Family Savings to organise their own savings; this is information about the child supplied by the account holder, and the gold stays under the account holder's account. If you believe a minor has registered an account, please contact us immediately at hello@goldevolutionsg.com and we will delete the account.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and display a notice in the app at least 14 days before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Your continued use of our services after the effective date constitutes acceptance of the updated policy.

13. Contact & DPO

For any privacy-related queries, requests, or complaints, please contact our Data Protection Officer:

You may also lodge a complaint with the Personal Data Protection Commission (PDPC):
www.pdpc.gov.sg