Privacy policy

Last updated 24 October 2026

Who we are

Pupop is run by Halfborg Software, a business registered in Singapore (UEN 53254612A) (“we”, “us”). This policy explains what personal data we handle, why, and what rights you have. Our data protection officer can be reached at privacy@pupop.io.

Two kinds of data, two roles

• Customers. If you have a Pupop account, we decide how your account data is used. We're responsible for it as a controller (an “organisation” under Singapore's PDPA).
• Visitors to our customers' websites. If you saw a Pupop popup on someone else's website, that website's owner decides what the popup collects and what happens to it. We process that data on their behalf as a processor (a “data intermediary” under the PDPA), under our Data processing agreement with them. For questions or requests about that data, contact the website owner first. If you contact us, we'll pass your request to them.

What we collect from customers

• Account details: your name, email address and password. Passwords are stored only as a secure hash. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Sign-in sessions: your IP address and browser details (user agent) for each signed-in session, to keep your account secure.
• Billing:
  • We keep your plan, subscription status, billing period, and the Stripe customer and subscription IDs.
  • Stripe collects your card, billing address and any tax ID on its own pages. We never see your full card number.
  • We send Stripe your email address and an internal workspace ID.
• What you create: your sites and domains, popups, uploaded images, webhook settings and email alert settings.
• Usage: counts of popup impressions and interactions, used to show you statistics and measure your quota.
• Correspondence: emails you send us, and the service emails we send you (verification, password reset, quota warnings, lead alerts).
• Bot checks: our sign-up form may use Cloudflare Turnstile to check you're not a bot. It processes technical details about your browser.

We don't use analytics, advertising or tracking tools on pupop.io or app.pupop.io.

What the Pupop script collects from visitors

When a website uses Pupop, the script sends us the following on the website owner's behalf:

• Popup activity: which popup was shown, closed or clicked, and which trigger showed it.
• Session ID: a random ID kept in the browser for the length of the tab session, used to count each visitor once per day and to limit spam.
• Page path: the address without the domain or query string, for example /pricing.
• Device type: “mobile” or “desktop”.
• Form submissions (leads): what the visitor types into a popup form, such as name, email address, phone number or a message. If the popup has a consent checkbox, we also keep whether it was ticked and the exact wording shown.

We don't set cookies on visitors' browsers, and we don't store visitors' IP addresses in our databases. Our edge network uses a visitor's IP address briefly to limit abusive traffic, and their browser's user agent to filter out bots. Neither is kept. We don't read the referring page, location or full URL. See Cookies and visitor storage for what the script stores in the browser.

How we use customer data

We use customer data to:

• provide the service: run your account, publish your popups, show your statistics, deliver leads to you, and send service emails (performance of our contract with you);
• take payment and keep billing records (contract, and legal obligation);
• keep Pupop secure and prevent abuse (legitimate interests);
• reply to you, and tell you about important changes to the service (contract, and legitimate interests).

We don't sell personal data, use it for advertising, or build profiles of visitors. We use visitor data only to provide the service to the website owner who collected it.

Who we share it with

• Service providers who run parts of Pupop for us, listed on our Subprocessors page. They may use the data only to provide their service to us.
• Destinations a customer chooses. If a customer turns on webhooks or lead alert emails, we send lead data to the URL or inbox they set.
• Authorities, where the law requires it, or to protect our rights, our users or the public.
• A buyer or successor, if our business is sold or reorganised, under the same protections.

Where data is stored

• Our database and dashboard are hosted in Singapore.
• The Pupop script and its endpoints run on Cloudflare's global network, so a visitor's request is first handled at a data centre near them.
• Some of our providers are based in the United States or elsewhere.
• When personal data leaves Singapore, the EEA or the UK, we rely on our providers' contractual safeguards, such as the EU Standard Contractual Clauses, to protect it to the standard those laws require.

How long we keep it

• Account data: while your account is open. When you close it, we delete it within 30 days. Copies in backups are overwritten within a further 30 days.
• Billing records: for as long as tax and accounting law requires, usually five years.
• Sign-in sessions: until they expire or you sign out.
• Leads: until the customer deletes them, or deletes the site they belong to, or closes their account.
• Statistics: stored only as hourly and daily counts, never as individual events. Kept while the account is open.
• De-duplication records (session IDs used to count each visitor once a day): deleted automatically after 2 days.
• Webhook delivery logs: the latest 50 per site. They hold no lead content.

Security

• We encrypt data in transit with HTTPS.
• Our providers encrypt it at rest.
• Passwords are stored as hashes.
• Webhooks are signed.
• We limit access to the people who need it.
• We collect as little as the service needs: no visitor IPs, cookies or full URLs.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the authorities as the law requires.

Your rights

• Under Singapore's PDPA: you can ask to see your personal data and how it has been used, ask us to correct it, and withdraw consent.
• If you're in the EEA, the UK or a similar jurisdiction: you can also ask us to erase your data, restrict or object to how we use it, or give you a copy in a portable format.
• How to ask: email privacy@pupop.io. We'll reply within 30 days and may need to confirm who you are first.
• Complaints: you can complain to Singapore's Personal Data Protection Commission, or to your local data protection authority. We'd appreciate the chance to help first.
• Visitors to a customer's website: contact the website owner, as explained above.

Children

Pupop is for businesses and isn't meant for anyone under 18. Customers must not use it to target children.

Changes to this policy

We'll post any changes here and update the date at the top. If a change is significant, we'll email customers before it takes effect.

Contact

Halfborg Software · UEN 53254612A · Singapore · privacy@pupop.io