Privacy Policy

The SuperCane platform is operated by SuperCane and its affiliated entities ("SuperCane", "we", "us", or "our"). This Privacy Policy explains how we collect, use, store, and share personal data when you use the SuperCane operator dashboard and associated services (the "Platform").

This Policy applies to Platform users including franchisees, operators, and internal staff. It does not cover personal data collected from end consumers at point-of-sale — that data is subject to separate processing arrangements.

We collect the following categories of personal data when you use the Platform:

• Identity data: name, email address, mobile number, and role within your organisation.
• Authentication data: one-time passwords and session tokens used to verify your identity at sign-in.
• Usage data: pages accessed, actions taken, timestamps, and feature interactions within the Platform.
• Device and network data: IP address, browser type, operating system, and device identifiers used for security and fraud prevention.
• Operational data: machine telemetry, maintenance records, sales data, and location information for vending machines you manage.

We do not collect payment card numbers or other financial credentials directly — payment processing is handled by a separate third-party provider.

We use personal data for the following purposes:

• Providing and operating the Platform, including authentication and access control.
• Sending operational notifications, alerts, and sign-in codes via email and SMS.
• Monitoring fleet performance, generating operational reports, and supporting maintenance workflows.
• Detecting and preventing fraud, abuse, and unauthorised access.
• Complying with legal obligations and responding to lawful requests from authorities.
• Improving Platform features and user experience through aggregated, de-identified analytics.

We rely on legitimate interests, contractual necessity, and legal compliance as our lawful bases for processing. Where we process data based on legitimate interests, we have assessed that our interests do not override your fundamental rights.

We do not sell your personal data. We share data only in the following circumstances:

• Service providers: infrastructure and cloud hosting providers, SMS and email delivery services, and analytics platforms — each bound by data processing agreements.
• Within the SuperCane group: data may be shared among affiliated entities for operational coordination.
• Legal obligations: where required by law, court order, or to protect the rights, property, or safety of SuperCane, its users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, in which case users will be notified of any change in data controller.

The Platform uses a secure, HTTP-only session cookie to maintain your authenticated session. This cookie is strictly necessary for Platform operation and does not track you across third-party websites.

We do not currently use advertising cookies, behavioural tracking cookies, or third-party analytics cookies that identify you personally. If this changes, we will update this Policy and notify users accordingly.

We retain personal data for as long as necessary to fulfil the purposes outlined in this Policy, or as required by applicable law. Specifically:

• Account data is retained for the duration of your active account and for a period thereafter as required for legal compliance.
• Authentication logs (sign-in events, OTP requests) are retained for a rolling 90-day period for security auditing.
• Operational telemetry data is retained in accordance with your franchise agreement.

When data is no longer required, it is securely deleted or anonymised in accordance with our data retention schedule.

Depending on your jurisdiction, you may have the right to access, correct, or delete personal data we hold about you. Under the Personal Data Protection Act 2012 (Singapore), you have the right to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent where we rely on consent as a legal basis (withdrawal does not affect prior processing).
• Lodge a complaint with the Personal Data Protection Commission (PDPC) if you believe your rights have been violated.

To exercise these rights, contact us at privacy@supercane.sg. We will respond within 30 days.

The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where the changes are material, notify users via the Platform or by email.

Your continued use of the Platform after any changes constitutes acceptance of the revised Policy.

For privacy-related enquiries, requests, or concerns, contact our data protection contact at: privacy@supercane.sg

For general legal enquiries, see our Terms of Service.