FishyHub Pte. Ltd. (UEN 202107485C), a Singapore company (“FishyHub,” “we,” “us” or “our”), operates the Singapore FishyHub marketplace. This notice explains how we handle personal information when you visit our Singapore website, use our Singapore marketplace features in an app, create an account, place an order, contact us or participate in our community.

Independent merchants sell products through FishyHub. FishyHub also handles information to operate the marketplace, support orders and process refunds. FishyHub remains responsible for its own collection, use and disclosure of personal data under Singapore’s Personal Data Protection Act 2012 (PDPA).

This notice explains our practices; it does not replace separate consent or choices required by law. Contact our privacy contact through hello@fishyhub.com, with “Privacy request” in the subject line, using that email address.

The information involved depends on the features you use. We obtain information directly from you, through your use of the Platform, and from merchants and providers involved in your orders and support requests.

Payment processing. Payments are handled through Stripe. FishyHub does not store full payment-card numbers or card security codes. We retain only the payment and transaction records identified above to administer purchases and refunds. The payment provider may also handle information for its own compliance, security and payment purposes under its notice: Stripe Privacy Policy.

Sensitive information. Account credentials and certain other information may receive special protection under applicable law. We do not ask customers for precise device location, government identification or financial account numbers. Account credentials are used only to sign you in and are never used to infer anything about you. Anything you type into support messages, community posts or AI chat is collected as submitted, so please assume that anything sensitive you choose to include is retained with it. Please do not send passwords, full card details or unrelated sensitive information in support messages or community posts.

We use the relevant information described above to:

• Create and manage accounts, authenticate users and operate requested features.
• Coordinate purchases and deliveries with merchants, administer payments, issue refunds directly where authorized, and resolve claims.
• Answer questions and send necessary account, security and order communications.
• Maintain, secure, troubleshoot and improve the Platform, including investigating misuse and fraud.
• Provide community features and personalization described in this notice.
• Send promotions and measure marketing as disclosed in Section 5, subject to your choices and applicable requirements.
• Keep necessary business records, meet legal obligations and establish or defend legal claims.

We collect, use and disclose personal data for purposes notified to you, with your consent or where otherwise permitted or required by the PDPA or other applicable law. We do not treat use of the Platform as blanket consent for every purpose. Where we rely on an applicable exception, we will meet its conditions. We will provide additional notice and obtain consent where required before a new purpose or materially different use.

AI chat and photo search. FishyHub offers AI chat and photo-search features. When you use these features, we process your submitted messages, photographs and related feature data to answer questions or identify relevant products. We send inputs directly to DeepSeek through its API to support these features. DeepSeek receives the photograph itself, as you uploaded it, rather than a description extracted from it. For AI chat it receives your messages and the surrounding conversation together with the product context needed to answer. Assume it also receives whatever its API records about the request.

DeepSeek may also use the information sent to it to train or improve its AI models, and may retain it and allow human review. We have not secured an assurance to the contrary, and we do not offer a setting that turns this off, so please treat anything you submit to these features as information that may be used that way.

Please avoid entering passwords, payment-card details or unrelated sensitive information in AI chat, and avoid including people, address labels or other unnecessary personal details in uploaded fish photographs. Camera permission does not itself explain the subsequent processing of an upload. You can choose not to use these features. Contact FishyHub for requests about information submitted through them.

DeepSeek's own privacy settings and opt-outs are not available to you through FishyHub: they apply to its own apps, not to applications built on its API. Send any request about information submitted through our AI features to us instead.

Merchants and delivery providers. Merchants receive customer information associated with their orders. We disclose information reasonably necessary for the relevant order, such as recipient contact details, address, ordered products and relevant claim evidence. A merchant may separately retain records to fulfill its own transaction, legal and accounting duties. Its independent uses are governed by its own applicable notice and obligations. Merchants are permitted to use customer information received through FishyHub only to fulfil the relevant order and provide related support, delivery, returns, refunds or claims handling, subject to any legally required recordkeeping. They must not use it for unrelated marketing, add customers to their own promotional lists or sell it. This restriction is a term of our merchant agreement. Contact the merchant about order-related processing; FishyHub remains responsible for its own handling and for responding to requests concerning information it controls.

Providers supporting FishyHub. Relevant providers assist with hosting, authentication, payment/refund processing, communications, customer support, security and the other features described here. We require appropriate contractual protections where providers process information on our behalf. We do not describe every recipient as a processor acting solely on our instructions: some recipients may have independent responsibilities.

Analytics and advertising recipients. See Section 5 for the actual practices and available choices. These disclosures are distinct from disclosures necessary to fulfill an order.

Public community content. Reviews, public profiles, giveaway listings and other content you choose to publish may be viewed, copied or indexed by others. Do not place your delivery address or private contact details in public posts. Removing content from FishyHub may not remove copies independently made by others.

Legal and business events. We may disclose necessary information to comply with law or valid legal process, protect rights and security, investigate fraud, or support a merger, financing, acquisition or asset transfer with appropriate protections. We may also disclose information at your direction or with your consent.

We use Google Analytics 4 (GA4) for analytics and Google Ads for advertising, loaded through Google Tag Manager. You should assume the full range of advertising features is active, including conversion measurement, remarketing, enhanced conversions, Customer Match, Google Signals and advertising personalisation. Because these tags are managed through a tag container, additional advertising or analytics tags can be added without a change to this site.

Information sent to Google and similar recipients may include cookie, device and browser identifiers, IP address, pages and products viewed, search terms, cart and purchase events, and contact information such as a hashed email address used to match conversions and build audiences. Identifiers associated with a browser or device are not necessarily anonymous.

Cookies and similar technologies support account sessions, preferences, security, analytics and advertising. There is currently no cookie banner or in-site privacy settings page, and the site does not detect browser privacy signals automatically, so these tags load when you visit.

Your choices. You can withdraw consent to the optional analytics and advertising uses by emailing hello@fishyhub.com, and we will explain the likely consequences and stop the relevant processing. You can also manage or block cookies through your browser, but browser settings do not reach disclosures that happen server-side or customer lists already uploaded, and blocking essential cookies may affect sign-in and checkout.

You can unsubscribe from promotional emails using their unsubscribe link or contact hello@fishyhub.com. We may still send necessary transaction, security and service messages. For marketing calls or messages to Singapore telephone numbers, including applicable SMS or messaging-app campaigns, we will comply with the Do Not Call requirements, obtain clear and unambiguous consent in evidential form where relied on, or meet the conditions of an applicable exception. We will identify the sender and provide the required contact or opt-out information. Agreeing to the Terms or reading this notice is not itself blanket marketing consent. We may contact a Singapore number you give us. Before sending marketing messages to it we check the Do Not Call registry or rely on consent you have given; order, delivery and security messages are sent regardless.

You may change app permissions through device settings. To request removal of your FishyHub account, email hello@fishyhub.com, preferably from the email address associated with your account, with “Account deletion” in the subject line. You may also contact this address to request correction or deletion of personal information. We may take appropriate steps to verify a request before deleting account information. Do not send your password.

Account removal and deletion of all associated records are not necessarily the same: some records may need to be retained for lawful purposes described below. We will handle the request under applicable law and explain relevant exceptions. Deletion is handled by hand rather than by an automated process, so please assume removing your account does not erase every copy at once. Order, payment and refund records are kept for legal and accounting purposes. Community content you published may remain visible. Support and claim evidence stays with the ticket it belongs to. Anything already sent to a provider - the payment provider, the analytics and advertising recipients, the AI provider - is subject to that provider's own retention, not ours. Backups are overwritten on their own cycle rather than edited.

We retain personal information for the purposes disclosed in this notice, considering the service requested, legal recordkeeping requirements, fraud prevention, open disputes and applicable limitation periods.

We have not set fixed retention periods for any of these categories, and we do not delete them on a schedule. In practice that means account records, orders, payment and refund records, support and claim evidence, activity and security logs, published content, and AI inputs and outputs are kept for as long as the account exists and afterwards for as long as they remain relevant to a legal, accounting, fraud or dispute purpose. If you want information removed sooner, ask us as described above.

We protect information using access controls, encrypted connections and the security features of the hosting and payment providers we use. We have not undergone an independent security audit or certification, and no system is completely secure. We will assess suspected personal-data breaches and notify the PDPC and affected individuals where required by the PDPA. This statement does not waive obligations or rights concerning security incidents.

FishyHub is based in Singapore. Your information may be accessed or processed in Singapore, the United States and the other countries where our hosting, analytics, advertising, payment and AI providers operate, depending on our operations and providers. Anything you submit to the AI chat or photo search is sent to DeepSeek's API and should be assumed to be processed and stored in China. Privacy protections may differ between countries. Where we transfer personal data outside Singapore, we will comply with the PDPA’s transfer requirements, including ensuring a standard of protection comparable to the PDPA through an applicable permitted arrangement. We have not completed a review of the transfer arrangements with every provider, including the AI provider, so please do not read this as a statement that each one has been verified.

You may contact our privacy contact at hello@fishyhub.com, with “Privacy request” in the subject line, to request access to personal data in our possession or control, information about how it has been used or disclosed as provided by the PDPA, or correction of errors or omissions. These requests are subject to the PDPA's exceptions and requirements.

Provide enough information to identify the relevant account or transaction and describe your request. We may take reasonable steps to verify your identity or an authorised representative's authority. Do not email your password or full payment-card details. Where a reasonable access fee is permitted, we will advise you of the estimate before proceeding.

We will respond to access requests as soon as reasonably possible. If we cannot respond within 30 days, we will inform you in writing within that period of when we expect to respond. We will handle correction requests in accordance with applicable requirements.

You may withdraw consent for collection, use or disclosure of personal data by giving reasonable notice through the same email address. We will explain the likely consequences and stop the relevant processing unless continued processing is required or authorised by law. If the information is necessary for a requested service, withdrawal may prevent us from continuing that service. Withdrawing marketing consent does not by itself require closing your account.

You can also request account removal as explained in Section 6. Singapore's PDPA does not provide the same general erasure right as some other privacy laws; account removal does not necessarily require erasing lawful transaction or dispute records. We will cease retention or remove identifying links when the data is no longer needed for a legal or business purpose.

For privacy concerns, contact our privacy contact first so we can investigate and respond. This does not prevent you from contacting Singapore's Personal Data Protection Commission (PDPC) or exercising applicable rights.

Accounts and purchases on the Singapore marketplace are for adults aged 18 or older, and the Platform is not directed to children. We do not verify age beyond that condition, so assume an account we hold belongs to the adult who created it. Where a young user cannot provide valid consent, we will obtain consent from a parent or guardian or rely on another lawful basis before the relevant processing. We apply appropriate protections for children's personal data. If you believe a child has provided personal data without appropriate authorisation, please contact our privacy contact so we can investigate and take appropriate action.

Third-party links and external services may have separate privacy notices. This does not remove FishyHub's responsibility for disclosures it makes to them.

We will update the effective date when we change this notice. For material changes, we will provide notice and obtain consent where required before applying the changed practice. Posting a revised notice does not itself authorize every new use of information already collected.

FishyHub Pte. Ltd. — Privacy inquiries

UEN: 202107485C

Email: hello@fishyhub.com