Privacy Policy
What we collect, why we collect it, who else sees it and how long we keep it. Written from what this site actually does, so you can check it against your own experience of using it.
Last updated 11 September 2026 · Erben Group Pte. Ltd. · UEN 202609703M
01Who we are
WhereWeBegin ("WWB", "we", "us") is a community and content platform for founders, operated by Erben Group Pte. Ltd. (UEN 202609703M), a company incorporated in Singapore. WWB Media is our studio arm and trades under the same company.
This policy explains what personal data we collect through wwbegin.co, why we collect it, who else sees it and how long we keep it. It is written to meet Singapore's Personal Data Protection Act 2012 (PDPA).
For anything about your data, including a request to see it or have it deleted, write to enquiry@wwbegin.co and put "Data request" in the subject line. A person reads that inbox.
02What we collect, and why
We only collect data you give us, and only where you have done something that needs it. There is no account to create in order to read this site.
| What | When | Why we need it |
|---|---|---|
| Name, email, phone (optional), and your message | You send an enquiry through the contact form | To reply to you, and to keep a record of what was asked so the next person picking it up has the context |
| Name, email and your question | You submit a question to The Hub | To answer it, and to tell you when it has been answered |
| Name, email, phone, delivery address and postal code | You place a merchandise order | To take the order, post the parcel and send you a receipt |
| Your order contents, amount, and the reference for your payment | You place a merchandise order | To fulfil the order and to keep the accounting records Singapore law requires |
| A screenshot or PDF of your bank transfer | You pay by PayNow or bank transfer and upload proof | To match your payment against your order before we post it |
| Name, email, phone and membership tier | You join the WWB membership | To issue your card, run the membership and let you use partner perks |
| Where and when you used your membership card | A partner merchant scans your card | To apply the perk and show you and the merchant a record of it |
| Your device identifier and a push token | You add your membership card to Apple Wallet | To keep the pass on your phone up to date. Apple requires both; neither identifies you by name |
| A display name you choose, and any photo or drawing you add | You post to an event noteboard | To show it on the board. The name is optional and is remembered on your own device only |
Search is not linked to you. When you search The Hub we log the words searched and whether we found an answer, so we can see what people come here looking for. We do not store an account, a device identifier or an IP address alongside it, so those logs cannot be traced back to a person.
IP addresses. Our public forms use your IP address in memory to stop one machine flooding them with submissions. It is not written to our database and is discarded within minutes. The single exception is the event noteboard, which stores a one-way hash of the IP so that a board can be cleaned up if someone abuses it — a hash cannot be turned back into an address.
We do not buy personal data, sell it, run advertising or advertising trackers, build profiles for targeting, or ask for your date of birth, identity number or bank credentials.
03Young people
Some of what we do — school programmes, campus events — involves people under 18. We do not knowingly collect personal data from anyone under 13 through this website. Where a school or programme partner brings us participant details, they are responsible for obtaining the consent needed, and we use those details only to run the programme.
If you believe a child has given us data through this site, write to enquiry@wwbegin.co and we will remove it.
04Who else sees your data
We use a small number of service providers to run the site. They process data on our instructions and are not permitted to use it for their own purposes. We do not sell or rent your data to anyone.
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Our database and file storage — enquiries, orders, membership records, uploaded images | Singapore |
| Vercel | Hosting and delivery of the site, plus anonymous traffic measurement | Singapore region, on a global network |
| Google Workspace (Gmail) or Resend | Sending our emails — your reply, your order confirmation, your receipt | United States and globally |
| HitPay or Stripe | Card and PayNow payments, when a gateway is switched on. They take the payment directly; we never see or store your card number | Singapore, and globally for Stripe |
| Groq | The AI that answers Hub searches. Your search text is sent to be answered; no name, email or identifier goes with it | United States |
| YouTube (Google) | Video playback, only once you press play on a video | Globally |
| CARTO and OpenStreetMap | The map tiles on our map pages. Loading a map sends your IP address to them, as loading any image from another site does | Globally |
Some of these providers are outside Singapore. Where that is the case we rely on their contractual commitments to protect your data to a standard comparable to the PDPA, as section 26 of the Act requires.
We will also disclose data where the law requires it — a court order, a regulator, a tax authority — or to establish or defend a legal claim.
05How long we keep it
We keep personal data only while there is a reason to, then delete it. These are the periods we work to:
| What | How long | Why that long |
|---|---|---|
| Enquiries and questions | 24 months after our last exchange with you | So we have the history if you come back to us, and no longer |
| Orders, receipts and proof-of-payment files | 5 years from the end of the financial year | Singapore tax and accounting rules require business records to be kept for five years |
| Membership records | While your membership is active, then 12 months | To handle renewals, disputes and rejoining |
| Card visit history | 24 months | So you and the merchant can check a perk was applied |
| Apple Wallet device registrations | Until you remove the pass from your device | The registration is what keeps the pass updated; deleting the pass ends it |
| Noteboard posts | Until the event board is taken down, or sooner on request | They exist to be shown at the event |
| Hub search logs | 12 months | Long enough to see a trend. They contain no identifier |
If you ask us to delete something sooner we will, unless we are required to keep it — an order that has been invoiced is the usual case, and we will tell you if that applies.
06Your rights
Under the PDPA you may ask us to tell you what personal data we hold about you and how it has been used in the past year, correct anything that is wrong, or withdraw a consent you have given. Withdrawing consent may mean we can no longer do the thing it was given for — we cannot post an order without an address.
Write to enquiry@wwbegin.co with "Data request" in the subject. We will respond within 30 days, and tell you sooner if it will take longer than that.
Every marketing email we send has an unsubscribe link, and we honour it. Transactional emails — an order confirmation, a receipt, a reply to your enquiry — are not marketing and do not carry one.
If you are in the UK or the European Economic Area, you also have rights of access, rectification, erasure, restriction, portability and objection under the UK GDPR or EU GDPR. The same address reaches us, and we will treat the request under whichever regime gives you more.
If we have not dealt with something properly, you may complain to Singapore's Personal Data Protection Commission, or to your own supervisory authority if you are in the UK or EEA. We would rather you told us first.
07Keeping it safe
The site is served entirely over HTTPS. Our database is not reachable from a browser: every read and write goes through our own server, which applies its own checks first. Staff access to the studio requires a login, and access to orders and member records is limited to the people who need it.
Payments by card or PayNow through a gateway are taken by the gateway itself. Card numbers never reach our servers and we never store them.
No system is perfect, and we do not claim otherwise. If a breach happens that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the PDPA requires.
09Changes to this policy
When we change how we handle data we update this page and move the date at the top. If a change materially affects you — a new category of data, a new purpose — we will say so plainly here rather than hoping you re-read it.
This version is dated 11 September 2026.