Popoto is a cashback app for shoppers in Singapore, announced during our waitlist under the name Carty. This policy covers both this website — including the waitlist sign-up — and the Popoto mobile app. It is written to meet Singapore's Personal Data Protection Act 2012 (the PDPA).
Popoto is operated by Team REmited Inc. ("Popoto", "we", "us"), a company incorporated in the Republic of Korea, business registration number 739-86-02890, with its registered office at Unit 801, 34 Sangwon 12-gil, Seongdong-gu, Seoul, Republic of Korea.
We are the organisation responsible for personal data collected through this website and the Popoto app. Our Data Protection Officer can be reached at privacy@teamremited.com.
We ask for your data at the moment we need it, in plain language, at the point of collection. Continuing after we have told you what we collect on a screen means you consent to that use. There is no single blanket consent checkbox — each purpose stands on its own, and you can withdraw consent for any of them at any time (see section 11).
Some information is optional. If you skip it the service still works; parts of it just become less useful — we cannot tailor merchant recommendations, for instance, if you do not tell us which merchants you like.
This section covers the waitlist and the pages around it.
| Data | When we get it | Why |
|---|---|---|
| Email address | You type it into the waitlist form | To email you when Popoto launches, and occasional updates before then |
| Consent record — that you ticked the box, and when | At sign-up | To show we had your permission, as the PDPA requires |
| Campaign data — UTM parameters, referring page, click ID, page URL | Automatically, on arrival | To measure which ads and messages bring people to the waitlist |
| Advertising cookies — Meta (Facebook/Instagram) pixel events | If you arrived from a Meta ad | To record that a visit and a sign-up happened. We do not send Meta your email address. |
| Order of joining | At sign-up | To honour the "first 1,000 members" offer |
We do not collect your name, phone number, address, payment details, or any shopping data on this website.
| Data | When we get it | Why |
|---|---|---|
| Account identifier — the stable ID that Google or Apple gives us for you when you sign in | When you sign in, and on every later sign-in | This is your account. It is what your cashback belongs to, and what lets you sign back in on a new phone. We never receive your password. |
| Device identifier — a random ID generated on your device | Automatically, on first launch | To reconnect you to an account you already used on that device. It is not your identity and we do not use it to track you elsewhere |
| Name, or the name you choose to go by | You tell us during onboarding | To address you in the app |
| Date of birth and gender | You tell us during onboarding | To confirm you are old enough to use the service, and to understand which shoppers the service serves well |
| Preferred merchants | You tell us during onboarding, and as you use the app | To decide what to show you first |
| Email address | From Google or Apple when you sign in, and if you ask to be notified when withdrawals open | To reach you about your account. If you use Sign in with Apple and choose Hide My Email, we only ever see the relay address Apple creates for us — we never see your real one. Offers are separate and only if you opt in |
| Chat messages — what you type in the chat with Popoto | When you send a message in the chat | To generate Popoto's reply. Messages are processed by an AI service on our instructions; it does not store them or use them to train its models (see sections 6 and 7) |
| Push notification token — a token issued by your phone for this app | Only if you allow notifications | To send you updates about your cashback |
| Click records — which merchant you tapped, when, the tracking ID we generated, and whether the redirect completed | Automatically, when you tap through to a merchant | To match a purchase back to you so cashback can be credited, and to detect fraud |
| App usage and diagnostics — screens viewed, actions taken, crash reports, device model, OS and app version | Automatically, while you use the app | To fix crashes and to understand which parts of the app work |
We do not collect your precise location, contacts, photos, camera roll, payment card numbers, bank account details, NRIC or FIN.
Popoto earns money through affiliate commissions. When you tap a merchant in Popoto, we open that merchant's site through an affiliate network (currently Involve Asia) and attach a tracking parameter containing a one-time click ID we generate for that tap, and a timestamp. If you then buy something, the merchant reports a qualifying transaction back to the network, and the network reports it to us.
What we receive is the order value, the commission earned, the time, and our own tracking ID. We do not receive your card details, your billing address, or an itemised list of what you bought. We pass a share of that commission to you as cashback.
Once you land on a merchant's site or app, that merchant's own privacy policy applies to what happens there. We do not control it.
We do not sell personal data. We share it with a small number of service providers who process it on our instructions and are not permitted to use it for their own purposes.
| Provider | What it handles |
|---|---|
| MongoDB Atlas | Database — your app profile, click records and chat messages (hosted in Singapore) |
| Railway | Hosting for our app server (Singapore) |
| Amazon Web Services | AI processing for the Popoto chat — generates replies from your chat messages. AWS does not store your messages or use them to train models |
| Amplitude | Product analytics — how the app is used |
| Sentry | Crash and error reporting |
| Involve Asia | Affiliate network — receives the tracking ID attached to your merchant clicks |
| Google (Workspace, Play, Sign-In) | Waitlist storage, app distribution, and sign-in — Google confirms to us that the sign-in is genuine and gives us your account identifier and email address |
| Apple | Sign in with Apple — Apple confirms the sign-in and gives us your account identifier, and either your email address or a relay address if you chose Hide My Email |
| Meta | Pixel event data from this website (page view, sign-up), for ad measurement |
| Netlify | Website hosting |
We may also disclose data where the law requires it, or to investigate suspected fraud or abuse of the cashback system.
We are a Korean company, and our service providers operate infrastructure in several countries. Your data may be stored or processed in Singapore (our app database and server), the Republic of Korea, the United States, and Indonesia — chat messages are processed in an Amazon Web Services region located there, solely to generate Popoto's replies. Where we transfer your personal data out of Singapore, we take reasonable steps to ensure the recipient is bound to protect it to a standard comparable to the PDPA, as required by section 26 of the Act.
Marketing messages are separate from service messages, and in the app they are off by default. We will only send promotional emails or push notifications if you turn them on. You can turn them off again in the app, or by using the unsubscribe link in any email, without affecting your cashback.
If you joined the waitlist, you asked us to email you about the launch — that is what the waitlist is. You can unsubscribe at any time using the link in any of those emails.
Messages about your own account — a cashback confirmation, a payout, a change to our terms — are not marketing, and you will keep receiving them while you use the service.
| Data | Kept for |
|---|---|
| Waitlist email and sign-up record | Until launch and up to 24 months after, or until you ask us to delete it |
| App profile and click records | While you use Popoto, then up to 12 months — long enough to settle cashback still pending merchant confirmation |
| Chat messages | 6 months |
| Diagnostic and crash data | 90 days |
If you unsubscribe, we keep only the minimum record needed to honour that request.
Popoto uses an account, so removing the app from your phone no longer removes your data. Your account stays with us until you delete it, which is deliberate — it is what lets you change phones and find your cashback waiting. You can delete it at any time, in the app or by writing to us; our account deletion page sets out exactly what is removed and the one thing we have to keep.
Your session is held in your device's secure storage, and it expires on its own. We never see or store a password — Google and Apple handle that. Data in transit is encrypted, and our providers encrypt it at rest. Access to production data is limited to the people at Team REmited who need it to run the service. No system is perfectly secure, but we will notify you and the PDPC where a data breach is likely to cause you significant harm, as the PDPA requires.
Under the PDPA you may ask us to:
To delete your account and the personal data attached to it, the fastest route is the app itself: My page → Account settings → Account → Delete account. It happens straight away. Our account deletion page lists what is removed.
For anything else — access, correction, withdrawing consent, or deletion if you no longer have the app — write to privacy@teamremited.com from the email address linked to your Google or Apple sign-in, so we can be confident we are answering the right person. We will respond within 30 days, and will tell you if we need longer.
If you withdraw consent for your account identifier or for click records, we can no longer connect a purchase to you, which means we cannot credit cashback. We will tell you this before acting on the request.
You can also opt out of ad tracking by disabling ad personalisation in your Meta account settings, or by blocking cookies in your browser.
Popoto is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
If we change this policy in a way that materially affects you, we will tell you in the app, and by email if you are on the waitlist, before the change takes effect. The date at the top always reflects the current version.
Data Protection Officer, Team REmited Inc. — privacy@teamremited.com
If you are not satisfied with our response, you may contact Singapore's Personal Data Protection Commission at pdpc.gov.sg.
Operated by Team REmited Inc. (Korea) · Business registration no. 739-86-02890
Unit 801, 34 Sangwon 12-gil, Seongdong-gu, Seoul, Republic of Korea
privacy@teamremited.com
Terms of Service · Delete your account · ← Back to Popoto