Data Declaration & Privacy Notice

Biddy uses account contact details (such as your email address), your Telegram identity (Telegram user ID, name and @username), channel information, notification preferences, seller listings and photos, bids, order records, payment status and fulfillment details. Delivery orders may require a recipient name, phone number and address. If you sign in with Google, Google shares your name and email address with us.

For sellers in Singapore, payment processing involves the seller’s connected Stripe account and transaction references. Stripe collects and processes the PayNow or card payment information needed to complete checkout. Card numbers are entered on Stripe's checkout page and are never sent to or stored by Biddy; Biddy records only which method was used. For sellers in Malaysia, the Philippines, Indonesia and Thailand, Biddy stores the payment methods the seller adds (account name, account number or ID, instructions and an optional QR image) and shows them to buyers with an order to pay. When a buyer says they have paid, Biddy records which method they used and any payment reference they enter. Biddy does not ask buyers to upload payment screenshots or enter bank credentials into Biddy forms.

If a store owner invites you to help run their store, we keep the invite (the Telegram @username invited, the store, who sent it, and when it was sent, accepted or declined) and, once you accept, your role in that store (admin or consignor). For consignors we also keep which items they consigned, their commission rate and the payouts the store owner records.

We also keep records of missed payment deadlines and of listing reports (see below).

This information supports sign-in, connecting your Telegram account, channel ownership checks, publishing listings, auction participation, order fulfillment, Stripe payment initiation and confirmation, showing sellers’ own payment details to their buyers, receipts, requested notifications, support, keeping auctions fair and abuse prevention.

Provide only information needed for the relevant listing, order or support request. Listing photos may use public file URLs, so do not put private addresses, identification documents or unrelated personal information in public images or descriptions.

Listings, photos and shop details are public and may be posted to the seller’s Telegram channel.

When you bid, anyone viewing that auction can see the bid amount, the time, a shortened version of your name (for example “Jane T.”) and your Telegram @username. Your name comes from your Telegram profile, including for website accounts once Telegram is connected. Your email address, phone number and Telegram user ID are never shown publicly.

When you win or buy an item, the seller sees the details needed to fulfill your order: your name and Telegram @username, the receive option you chose and, for deliveries, the recipient name, phone number and address you provide. If the seller has added store admins to help run their store, those admins see the same order details. If the item was consigned, the consignor who sent it to the store sees the details for that order so they can post it.

The owner and admins of a store can see each other’s name and Telegram @username in the store’s settings. The owner can also see the @usernames they have invited and whether an invite is still open or was declined.

If an item you won or claimed is not paid before its payment deadline, Biddy records a missed payment against your account. This happens automatically: after the first missed payment you receive a warning, after the second you cannot bid or use Buy now for 14 days, and after the third you can no longer bid or use Buy now. Missed payments do not count if the seller extends your deadline and you pay before the new one.

We use these records to keep auctions fair for sellers and other bidders. They are kept until they are reviewed and cleared. If you think a restriction is wrong, email support@biddybotty.com and a person will review it.

If you report a listing, we store your account ID, the listing, the reason and any details you provide, and send them to our support inbox so we can review the report. The seller is not told who reported their listing, unless the law requires us to disclose it.

When we review a report or suspected illegal or prohibited listing, we may look at the listing, its photos and Telegram post, the seller’s store and account details, and related bids and orders. We keep the report and the outcome so we can deal with repeat breaches.

Telegram handles bot interactions and notifications. Supabase provides the app’s account, database and file-storage functions. Stripe processes PayNow and card payments and connected seller-account activity for Singapore sellers. Sellers receive their buyers’ delivery details for the orders they fulfil, and buyers see the payment details their seller chose to share. Vercel hosts the website and app. Cloudflare delivers emails sent by the service, such as listing reports. Google provides sign-in if you choose to use it. These providers process information only as needed for their functions. Contact us for details about providers relevant to your information.

Biddy does not sell your personal data or share it with advertisers.

Biddy does not allow illegal goods or services. We may share relevant information, such as account and Telegram details, listings, bids, orders and payment records, with the police, regulators, courts or other authorities when the law requires it, in response to a valid legal request, or when we reasonably believe it is necessary to prevent fraud or harm, to investigate unlawful activity on the service, or to protect our users or Biddy. We share only what is needed for that purpose.

Biddy is meant for people aged 18 or over. Younger people may only use it with a parent or guardian’s consent where the law allows. If you believe a child has given us personal data without that consent, contact support@biddybotty.com and we will deal with it.

Biddy uses a sign-in cookie to keep you logged in on the website, and, if you help run more than one store, a cookie that remembers which store you are working on. Your browser also stores some information locally on your device: Telegram session details when you use the Biddy app inside Telegram, and delivery details you have started typing so they are not lost if you leave the page. To save you retyping, the delivery form may also be pre-filled with details from your previous order. Biddy does not use advertising or analytics trackers.

Store and account deletion controls are available in settings. Bid and order histories are not erased automatically; contact us to request closure or deletion and to determine whether business or legal obligations require specific records to be retained. Public Telegram posts, Stripe records and backups may follow separate retention arrangements.

Information is retained for as long as needed to provide the service, resolve transactions and meet applicable legal or business obligations. File deletion may finish after account-record deletion while queued cleanup completes. Contact us for the retention arrangements that apply to your records.

You can choose whether to start the bot for notifications (and stop them with /stop), manage your Telegram permissions, and correct seller settings in the app. Contact support@biddybotty.com to request access, correction, withdrawal of consent or deletion. Withdrawing information needed for an order or account may prevent the corresponding service from being provided. We may need to verify your identity to protect your information.

Our service providers may process information outside Singapore. Where personal data is transferred overseas, BiddyBotty is responsible for arranging protection comparable to the requirements of Singapore’s PDPA. Buyers and sellers in Malaysia, the Philippines, Indonesia and Thailand also have rights under their own data protection laws: Malaysia’s Personal Data Protection Act 2010, the Philippines’ Data Privacy Act of 2012, Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) and Thailand’s Personal Data Protection Act B.E. 2562 (2019). You can make access, correction or deletion requests under those laws to the same contact. Contact us about processing locations or transfer arrangements.

Account access, server-side ownership checks and restricted database permissions are intended to protect access to records. Report suspected unauthorised access promptly to support@biddybotty.com.