Last updated June 5, 2026

1. INTRODUCTION

Nstory Pte. Ltd. (UEN 201220029K) ("Nstory", "we", "our", or "us") is committed to protecting your personal data in accordance with the Singapore Personal Data Protection Act 2012 (the "PDPA") and other applicable laws. NEON is a service name of Nstory Pte. Ltd., not a separate legal entity. Nstory Pte. Ltd. operates the NEON service and is the organisation responsible for the collection, use, disclosure, and protection of personal data described in this Policy, including any marketing and analytics activities described below. This Privacy Policy (the "Policy") describes how we collect, use, disclose, and protect personal data when you access or use any of our websites, mobile applications, point-of-sale terminals, queueing kiosks, partner restaurant ordering pages, loyalty services, and related services (collectively, the "Platforms"). By using the Platforms, you acknowledge that you have read and understood this Policy. Where required by law, we will obtain your separate consent for specific processing activities, such as direct marketing or disclosure to third parties for their own marketing purposes.

2. DATA PROTECTION OFFICER

We have appointed a Data Protection Officer ("DPO") who can be contacted at:

• Email: adm@nstory.me
• Postal Address: 60 Kaki Bukit Place, #03-13, Singapore 415979

The DPO is responsible for ensuring our compliance with the PDPA, handling data subject requests (access, correction, withdrawal of consent, and deletion), responding to enquiries and complaints, and acting as the contact point for the Personal Data Protection Commission (PDPC) and other regulators.
You may contact our DPO regarding any matter relating to this Policy, your personal data, or your rights under the PDPA.

3. PERSONAL DATA WE COLLECT

We collect the following categories of personal data, depending on the services you use:

3.1 Account & identity data — full name, gender, date of birth, email address, mobile phone number (with country code), hashed password, OAuth identifiers (Apple, Google, Facebook), and profile image where uploaded.

3.2 Order, reservation & queue data — booking and queue information (name, phone, email, party size, date/time, special requests), order history, menu items purchased, transaction amounts, delivery or pickup address, postal code, and no-show / cancellation history (linked to phone number, used for service-integrity controls).

3.3 Payment data — payment method type and last four digits of payment cards, transaction amount, currency, timestamp, and payment status. Full card numbers are not stored by Nstory; they are tokenised and processed by our payment service provider (Stripe Payments Singapore Pte. Ltd.) in accordance with PCI-DSS.

3.4 Loyalty & preferences data — cashback (point) balance and usage history, voucher and coupon purchase / issuance / redemption records, food and mood preferences where voluntarily provided, and survey responses and feedback.

3.5 Technical & device data — IP address, browser type, operating system, device identifier, User-Agent, approximate geolocation derived from IP address, precise GPS location only where you grant device permission, cookies and similar technologies, session identifiers, JWT authentication tokens, and server / application / security logs.

3.6 Marketing & communication preferences — email, SMS, and push marketing consent flags, channel-level preferences, and records of communications sent and your responses.

3.7 Verification data — One-Time Passwords (OTP) sent for phone or email verification, and identity-verification records (for example, for age-restricted purchases).

We do not knowingly collect personal data from children under the age of 13. If you are under the legal age of contract in your jurisdiction, you must obtain consent from a parent or guardian before using the Platforms.

4. HOW WE COLLECT PERSONAL DATA

We collect personal data:

• directly from you, when you register, place an order, make a reservation, join a queue, redeem points, complete a survey, or contact us;
• automatically, through cookies, server logs, and analytics tools when you use the Platforms;
• from Partner Restaurants and POS terminals, when you provide identification (such as phone number or membership) for loyalty redemption; and
• from authorised third parties, such as social-login providers (Apple, Google, Facebook), where you choose to connect those services.

5. PURPOSES OF COLLECTION, USE AND DISCLOSURE, AND APPLICABLE PDPA BASIS / EXCEPTIONS

We collect, use, and disclose personal data only for the purposes set out below. Depending on the activity, we rely on one or more of the following bases under the PDPA: (a) your express consent; (b) deemed consent (including by conduct or by contractual necessity for performance of the service you have requested); (c) the legitimate interests exception under the First Schedule, Part 3; (d) the business improvement exception under the First Schedule, Part 5; or (e) other applicable exceptions, including compliance with law. Where we rely on the legitimate interests exception, we have conducted (and will maintain) an internal assessment of the purpose, the residual adverse effect on individuals, and the overall benefit to Nstory, our Partner Restaurants, and the public.

5.1 Service provision (deemed consent / contractual necessity) — account creation, authentication, and session management; processing reservations, queues, and orders, and notifying you of their status (including reservation reminders and queue-call SMS or push); processing payments, refunds, and chargebacks via Stripe and other payment service providers; issuing, tracking, and redeeming cashback, vouchers, coupons, and loyalty rewards. When you redeem points, vouchers, or member benefits at a Partner Restaurant, we may verify your identity through phone-number lookup, OTP, membership QR code, or other reasonable means.

5.2 Service integrity, security & fraud prevention (legitimate interests exception) — detecting, investigating, and preventing fraudulent, malicious, abusive, or unlawful activity (including fraudulent orders, chargeback fraud, no-show abuse, and account takeover); limiting repeated no-shows or cancellations on a per-phone-number basis; suspending accounts, devices, IP addresses, or phone numbers reasonably suspected of misuse; and maintaining audit logs and security records.

5.3 Communications (necessary for the service) — transactional notifications (order confirmation, reservation reminder, queue-call, payment receipt, security alerts), customer support and dispute resolution, and important changes to terms, policies, or service availability.

5.4 Analytics & service improvement (business improvement exception, with anonymisation where feasible) — aggregated and statistical analysis of usage patterns, order trends, popular menu items, queue waiting times, and loyalty engagement; A/B testing, product development, and platform optimisation. Where reasonably possible, we use de-identified or aggregated data for these purposes.

5.5 Direct marketing (express opt-in consent) — with your separate, prior, opt-in consent, we may use your personal data to send promotional emails, SMS, push notifications, or postal mail about Nstory / NEON services, partner restaurants, vouchers, events, and offers; personalise marketing content based on preferences, visit history, and birthday; and run targeted campaigns based on customer segments. You may withdraw your marketing consent at any time without affecting the lawfulness of processing prior to withdrawal (see Section 9). We comply with the Singapore Do Not Call (DNC) Registry: before sending marketing telephone calls, SMS, or fax messages to a Singapore number, we will check the DNC Registry unless we have valid clear and unambiguous consent or an ongoing-relationship exception.

5.6 Marketing data sharing with Partner Restaurants and B2B partners (express opt-in consent) — with your separate, prior, opt-in consent, we may share limited personal data with (i) the Partner Restaurant fulfilling your order, for its own marketing and customer-engagement purposes, and / or (ii) selected B2B / brand / advertising partners, for their own marketing, campaign, or customer-engagement purposes. Such sharing is subject to a written Data Processing or Data Sharing Agreement with the recipient, with purpose, scope, and retention limitations, and your right to withdraw consent and opt out at any time. If you do not provide this separate consent, we will not share your data with Partner Restaurants or B2B partners for their independent marketing purposes; operationally necessary sharing (for example, delivering a reservation to the restaurant that will serve you) is covered by Section 5.1 and does not require separate consent.

5.7 Legal & regulatory compliance — complying with applicable laws, court orders, and lawful requests by government authorities; responding to lawful requests by police or regulators in connection with suspected criminal activity; and enforcing our Terms of Use and protecting our rights, property, or safety, or those of our users or partners.

6. DISCLOSURE OF PERSONAL DATA

6.1 Partner Restaurants (operational necessity). We share with the Partner Restaurant fulfilling your order, reservation, or queue request only the personal data reasonably necessary for that purpose — typically your name, phone number (where required for delivery, queue-call, or pickup notification), email (for booking confirmations), party size, booking time, and remarks. Partner Restaurants are bound by a written Merchant Agreement with Nstory which restricts their use of customer personal data. They are not permitted to use customer personal data for independent marketing, profiling, resale, contacting customers for fraud investigation, or any other purpose unless separately authorised by Nstory and (where required) by you. All disputes — including those involving suspected fraudulent orders — must be escalated through Nstory's official support channels. Nstory will assess whether disclosure of additional personal data is appropriate, and disclosure to law-enforcement authorities will follow lawful process.

6.2 Data intermediaries / processors (acting on our instructions). We engage trusted service providers under contractual obligations to protect your data and use it only for the purposes we instruct, including: Stripe Payments Singapore Pte. Ltd. (payment processing — payment tokens, transaction metadata); Mocean or successor SMS gateway (SMS delivery — phone number, message content); Pusher or similar real-time providers (real-time order / queue notifications to merchants — booking and queue metadata); cloud hosting providers such as Amazon Web Services (hosting and backups — encrypted in transit and at rest); email service providers (transactional and marketing email); analytics providers (de-identified usage data); and Apple, Google, and Facebook (social sign-in — OAuth identifiers and basic profile).

6.3 Open API and B2B partners (with consent and DPA). Where you have given separate opt-in consent under Section 5.6, Nstory may make defined personal data fields available to authorised B2B partners through our Open API. Each partner is bound by a written Data Processing or Data Sharing Agreement (DPA) that records, at a minimum: the specific data fields the partner is authorised to access; the permitted purposes of access and use; the maximum retention period for accessed data; prohibition on resale, onward transfer, or independent marketing without separate authorisation; prohibition on use for direct marketing absent the data subject's separate opt-in consent; obligation to maintain API call and access logs; obligation to notify Nstory of any data breach; and Nstory's right to suspend or terminate access for breach. Open API access is technically enforced through scoped JWT bearer tokens, per-resource permissions, rate limits, and audit logging. Where commercially reasonable, directly identifying fields are masked or replaced with opaque identifiers.

6.4 Authorities and legal proceedings. We may disclose personal data when required by law, court order, or lawful request by police, regulators, or other public authorities, or where necessary to establish, exercise, or defend legal claims.

6.5 Corporate transactions. In connection with a merger, acquisition, financing, reorganisation, or sale of assets, we may transfer personal data to the relevant counterparty subject to the same protections as in this Policy.

7. CROSS-BORDER TRANSFER

Personal data may be stored or processed outside Singapore (for example, on cloud infrastructure in another region). Where we transfer personal data outside Singapore, we will ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA, in accordance with the Personal Data Protection Regulations 2014.

8. RETENTION OF PERSONAL DATA

We retain personal data only for as long as is necessary for the purposes described in this Policy, or as required by applicable law:

• Active account data — while the account remains active.
• Closed account data — up to 12 months after account closure (longer where required by law).
• Payment, tax, and accounting records — 5 years (Singapore Income Tax Act / GST Act record-keeping requirements).
• Order item-level details (POS / online orders) — retained while operationally necessary, including for dispute resolution, customer support, and audit. Where full item-level records are no longer required, they may be anonymised or aggregated for analytics, menu performance, and trend analysis.
• Booking, queue, and order records — 12 months from the event date.
• No-show / cancellation history — 12 months from the event date.
• Marketing engagement records — while consent is active, plus 12 months after withdrawal.
• Open API audit logs — 12 months.
• Server and security logs — 12 months.
• Verification codes (OTP) — until expiry, typically minutes.

After the retention period, personal data is deleted, archived under restricted access, or anonymised so that it can no longer be used to identify an individual. Anonymised and aggregated data falls outside the scope of the PDPA and may be retained indefinitely for analytics, reporting, and service-improvement purposes.

9. YOUR RIGHTS

Under the PDPA, you have the following rights:

• Access — request a copy of personal data we hold about you and information on how it has been used or disclosed in the past 12 months.
• Correction — request that we correct inaccurate or incomplete personal data.
• Withdrawal of consent — withdraw consent for any processing based on consent (including direct marketing and B2B data sharing). Withdrawal does not affect the lawfulness of prior processing.
• Deletion — request deletion of your account and personal data, subject to retention obligations under applicable law.

To exercise these rights, contact our DPO at adm@nstory.me. We will respond within 30 calendar days, or earlier where required by law. A reasonable fee may be charged for access requests, in accordance with the PDPA. Following a valid withdrawal request, we will cease the relevant processing within a reasonable period (typically up to 30 days) and inform you of any likely consequences (for example, inability to redeem rewards or receive personalised offers). For marketing opt-out, you can also use the unsubscribe link in any marketing email, reply STOP to a marketing SMS, or adjust your preferences in your account settings.

10. PROTECTION OF PERSONAL DATA

We implement administrative, physical, and technical safeguards including TLS encryption for data in transit; AES encryption of sensitive fields (such as mobile and email in order records) at rest; hashed passwords (bcrypt or equivalent); role-based access control and audit logging; segregated production, staging, and development environments; and regular security reviews and patching. Despite these measures, no internet transmission or electronic storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials.

11. DATA BREACH NOTIFICATION

Where a data breach is assessed to be notifiable under the PDPA, including where it is likely to result in significant harm to affected individuals or is of significant scale, we will notify the Personal Data Protection Commission (PDPC) as soon as practicable, and in any event no later than 3 calendar days after the assessment, and notify affected individuals where required, in accordance with Sections 26A–26E of the PDPA and the Personal Data Protection (Notification of Data Breaches) Regulations.

12. ACCURACY OF PERSONAL DATA

We generally rely on personal data provided by you (or your authorised representative). To ensure that your personal data is current, complete, and accurate, please update us through your account settings or by contacting our DPO.

13. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies for: (a) essential session management and security; (b) remembering preferences (such as language); (c) analytics; and (d) marketing personalisation (only with your consent). Our payment provider (Stripe) also uses cookies necessary to process payments without storing your card details on our system. You can manage cookies through your browser settings. Disabling essential cookies may prevent the Platforms from functioning correctly.

14. THIRD-PARTY LINKS

The Platforms may contain links to third-party websites or services. We are not responsible for their privacy practices. Please review their privacy policies before providing personal data.

15. CHANGES TO THIS POLICY

We may update this Policy from time to time. Material changes will be notified through the Platforms or by email where appropriate. The "Last updated" date above reflects the most recent revision. Your continued use of the Platforms following an update constitutes acknowledgement of the updated Policy.

16. GOVERNING LAW

This Policy is governed by the laws of Singapore. Any dispute arising out of or in connection with this Policy is subject to the exclusive jurisdiction of the courts of Singapore.

17. CONTACT

All comments, queries, and requests relating to our use of your information are welcomed. Please contact us at:
DPO / general enquiries: adm@nstory.me
Registered office: 60 Kaki Bukit Place, #03-13, Singapore 415979 (UEN 201220029K)