Privacy Notice

Version 2026-10-27

This notice explains how WheelAlly collects, uses and discloses personal data under Singapore's Personal Data Protection Act 2012 (PDPA).

1. Who we are

WheelAlly ("we", "us") is a motorcycle marketplace and community operated by SGTrustedBikes in Singapore, with technology provided by Blugraph Technologies Pte Ltd. We are the organisation responsible for the personal data described in this notice, except for the customer records that shops keep about their own customers (section 6), for which each shop is responsible.

2. What we collect

Your account. When you create an account, we collect:

• Your name, email address and mobile number.
• Your date of birth, which we use to confirm you are at least 18.
• Your residential or business address, where you give one.
• Your password, which is held by our identity provider (Amazon Cognito) and never stored by us in readable form.
• A profile photo and details of the bikes you own, if you choose to add them.

If you register a shop account, we also collect your shop name, shop types, business address, business phone and email, GST registration number, year established, social media links, and the shop location used for maps and nearby-shop search. If you are a member of a shop's team, we collect your name, email, role and permissions, and the work recorded against you (section 6).

As you use the platform, we collect:

• Listings you create, including the photographs you upload.
• Messages you send to other users, and messages in Rider Cove channels.
• WheelAlly Moments you share: photos, captions, places, the riders you tag, and your comments, cheers and follows.
• Reviews, ratings, replies, and items you save or like.
• Orders, bookings and quote requests: what you ordered, delivery or collection details, the amounts paid, refund requests, and the details you give when asking for a price or a service quote (for example the bike model, colour, timing, trade-in or the job you describe).
• Service jobs at a shop: your bike, plate number, mileage, the work done, and check-in photos the shop takes.
• Reports you send about a photo: the reason, your details if you give them, and an email address for our reply.
• For shops: inventory, stock movements, counter sales, service records, purchasing, accounts and the other business records you enter.
• If you use the phone app and allow notifications, a device token so we can send them to your phone.
• Basic technical records such as request logs, kept to operate and secure the service.

Payments. Card and PayNow payments are handled by Stripe (Stripe Payments Singapore Pte. Ltd. and its affiliates); payments made between 24 and 27 October 2026 may have been handled by HitPay (HitPay Payment Solutions Pte Ltd), which still handles their refunds. When you pay, your name, email address and the amount are passed to Stripe with the payment. We receive the payment's status, amount, card type and a reference, and never your full card number. WheelAlly takes the payment and then pays each shop its share through Stripe Connect: shops give their identity and bank details to Stripe directly, on Stripe's own pages, and we don't see or store them. We keep the shop's Stripe account reference and its set-up status.

Selling your bike. If you sell your own bike on WheelAlly, we collect the price, deposit, condition, mileage, photos and refund policy you set, the offers you receive and make, and, if you want to be paid online, a PayNow number for payouts (a mobile number or UEN). We use the PayNow number only to pay you for a sale; it is shown masked to you and in full only to the WheelAlly staff who make the payout. Buyers never see it.

Reports about a conversation. If you report a conversation, the most recent messages in it are saved with your report so our staff can review it, even if they are later deleted from the conversation.

Your location (optional). If you choose Use my location or sort shops or rental bikes by distance, your browser or phone asks for your permission and shares your approximate location with us. We use it only to sort results by distance and show how far away they are. It is rounded (to about 100 metres) and sent only with that search; it is not stored on our servers or linked to your account. So we don't ask every time, it is remembered on your device: in the app, and on the website in the preferences cookie if you accept preference cookies (otherwise only for your current visit). You can decline, and the site and app work without it.

Your rental profile (only if you rent a bike). Before your first motorcycle rental you give us your full name as on your licence, your licence class and expiry date, your home address, a declaration about traffic violations in the last 3 years and your current demerit points, and five documents: both sides of your driving licence, a photo of you holding the licence, a proof of address, and a copy of your NRIC or passport. We collect the NRIC or passport copy because renting out a motorcycle requires your identity to be verified to a high degree of fidelity; we never ask you to type your NRIC number. When you book, we record the rental agreement you sign (the version, the name you type and the time), and at pick-up and return the bike's photos, odometer and fuel level. If you don't rent, we don't collect any of this.

IP addresses. We do not use your IP address to work out where you are, and we do not track your location from it. Our servers record IP addresses only in technical request logs, as part of operating and securing the service. Maps on WheelAlly are loaded through our own servers, so your IP address is not sent to the map provider.

3. What other people can see

Some of what you share is public by design: anyone, signed in or not, can see listings, shop pages, reviews and replies, WheelAlly Moments (with the names and profile photos of the riders who share, comment on or are tagged in them), rider profiles, and messages in public Rider Cove channels. A shop's online or offline status is shown to riders. When you sell a bike, buyers see your first name and last initial, never your plate number or PayNow number. Direct messages, offers, quote requests, orders, bookings, rental documents, handover photos and service job photos are visible only to the people involved and, where needed, to our staff.

Please only share photos of other people, or tag them, with their agreement. Anyone can report a photo for privacy, copyright or other reasons, and we may remove it.

4. Purposes for which we use your data

Under the PDPA we may only use your personal data for purposes a reasonable person would consider appropriate, and which we have told you about. We use it to:

• Create and administer your account, and verify your email address.
• Publish your listings, Moments and reviews, and connect riders with shops.
• Deliver messaging between users, and Rider Cove chat.
• Take payments, issue receipts and invoices, handle refunds, pay shops their share and pay riders who sell a bike, and remind shops to set up payouts.
• Send quote requests to the shops you choose (or, for a new-bike price, to the shops selling that model) and deliver their replies.
• Show nearby shops and relevant search results, including sorting by distance when you share your location.
• Send you notifications about your account, messages, orders, bookings, quotes and service jobs, in the app, on the website and by email.
• Check your rental profile before you can rent a bike, and let the rental shop you book with verify who is collecting its motorcycle.
• Provide customer support, review reported content, and respond to your requests.
• Detect and prevent fraud, abuse and unauthorised access.
• Meet legal, regulatory, tax and record-keeping obligations.

We do not sell your personal data. We do not use your data for a new purpose without notifying you and, where required, obtaining your consent.

5. Consent and withdrawal

By ticking the consent box at signup, you consent to our collection, use and disclosure of your personal data for the purposes above. We record the date and version of the notice you accepted.

You may withdraw your consent at any time by contacting us, or by deleting your account in Account settings. On receiving your request we will tell you the likely consequences — in most cases we will no longer be able to keep your account open. Withdrawal does not affect anything we did lawfully before it, and does not override our obligation to retain certain records under Singapore law.

6. Records shops keep about their customers and staff

Shops can use WheelAlly to run their business. A shop may keep records of its own customers, whether or not they have a WheelAlly account: their name, phone number, email, bikes, service history, spending, notes, service reminders, loyalty stamps and vouchers. A shop may also record the work of its team members, such as the jobs assigned to them and the hours worked.

For these records, the shop decides what to collect and why, and is responsible for them under the PDPA, including getting any consent required. We store and process them on the shop's behalf, keep them private to that shop, and do not use them for our own purposes. If you want to see, correct or remove a record a shop keeps about you, please ask that shop; we will help where we can.

A shop can send offers only to customers who have agreed to receive them. These arrive as notifications in the WheelAlly app, and a shop may download the names and phone numbers of customers who agreed, to contact them itself.

7. Who we share it with

We disclose personal data only as needed to run the service:

• Other users, where you choose to share it — a listing you publish, a message you send, a Moment you share, or a review you leave is visible to its recipients, or to everyone where it is public (section 3).
• Shops you order from, book with or ask for a quote, so they can respond and supply what you asked for. For a new-bike price request, shops see your first name and your request; your phone number is shared only with the shop whose quote you accept.
• A rider you buy a bike from, or sell a bike to, sees your first name and last initial, your offer and the order, so you can arrange the handover.
• A rental shop you book a bike from sees your rental profile and documents, from your booking request until 30 days after you return the bike, so it can verify you and deal with any fines, damage or claims. It loses access after that, or straight away if the booking is declined or cancelled. Every time the shop or our staff open your documents, it is recorded.
• Our service providers, who process data on our behalf under contract: Amazon Web Services for identity (Cognito), file storage (S3) and hosting; Stripe for card and PayNow payments, refunds and shops' payout accounts (HitPay for payments made between 24 and 27 October 2026); and Resend for email delivery.
• Google Firebase Cloud Messaging, which delivers notifications to Android phones. It receives your device token and the notification text.
• Google (Gemini API), which reads the words you type to describe a service your bike needs, so we can find the shops that do that job. Only the words you typed are sent: not your name, account, location or bike details. Please don't include personal details in that box.
• Authorities or regulators, where we are required or permitted by law to do so.

8. Transfers outside Singapore

We host our infrastructure in the AWS Asia Pacific (Singapore) region. Some of our service providers (Stripe, HitPay, Resend and Google) may process personal data outside Singapore. Where personal data is transferred outside Singapore, we take reasonable steps to ensure the receiving party provides a standard of protection comparable to the PDPA, as required by the Transfer Limitation Obligation.

9. Cookies and data on your device

The website uses only its own cookies; there are no analytics, advertising or third-party cookies.

• Strictly necessary (always on): session, which keeps your sign-in secure, and wa_consent, which remembers your cookie choice.
• Preferences (only if you accept them): wa_prefs, which remembers your theme, sounds, page layouts and your last Rider Cove channel.

These cookies last up to 180 days. You can change your choice at any time from Cookie settings in the website footer; if you decline preference cookies, your choices still work for the current visit but are not saved.

10. Protection and retention

We take reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification or disposal. Passwords are handled by Amazon Cognito, connections are encrypted in transit, private files are shown only through short-lived links, and access to production data is restricted to staff who need it, with sensitive actions recorded.

Rental profile documents are stored privately. You can delete your rental profile, or your account, at any time except while a rental is in progress and for 30 days after you return a bike, when the rental shop may still need it.

When you delete your account, we delete your profile, messages, reviews, likes, Moments, Rider Cove activity and personal listings. Records of orders, bookings and payments are kept in anonymised form, because the shops involved and WheelAlly must keep them for accounting and tax purposes. Otherwise we retain personal data only for as long as it serves the purposes above or is required for legal or business purposes, and then delete or anonymise it.

11. Your rights: access and correction

You may request access to the personal data we hold about you and information about how it has been used or disclosed in the past year. You may also request correction of an error or omission. Much of your data can be viewed and corrected yourself in Account settings. We will respond to requests as soon as reasonably possible. A reasonable fee may apply to an access request, and we will tell you in advance if so. Certain limited exceptions under the PDPA may apply.

12. Emails, marketing messages and the Do Not Call Registry

Service messages you need in order to use your account — such as verification codes, password resets, receipts, order, booking and quote updates, and replies to your enquiries — are not marketing messages and are sent as needed.

We send our guides and news by email only if you sign up for them and confirm your email address, and every such email has a link to unsubscribe. We will not send you marketing messages by phone, SMS or fax unless you have given us clear and unambiguous consent in writing, or your number is not listed on Singapore's Do Not Call Registry. You may opt out of marketing at any time.

13. Children

WheelAlly is not intended for anyone under 18, and we ask for your date of birth at signup to enforce this. If we learn we have collected personal data from someone under 18, we will delete it.

14. Data Protection Officer

As required by the PDPA, we have appointed a Data Protection Officer. To make an access, correction or withdrawal request, or to raise a complaint, contact our DPO through Contact Support or at info@wheelally.com. If you are not satisfied with our response, you may refer the matter to the Personal Data Protection Commission (PDPC).

15. Changes

We may update this notice. The version date above shows when it was last changed. If a change materially affects how we handle your data, we will bring it to your attention and, where the PDPA requires it, seek fresh consent.