Privacy Policy

Effective date: 29 July 2026

1. About this policy

This Privacy Policy explains how AdvoGrow ("AdvoGrow", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you visit our website, join our waitlist, or use the AdvoGrow advocate portal.

We are committed to handling your personal data responsibly. Our home data-protection framework is Singapore's Personal Data Protection Act 2012 (PDPA), because AdvoGrow is based in Singapore and has opened there first. Our waitlist is open to anyone, anywhere in the world. Because we collect data from people outside Singapore, we also aim to honour the core rights granted by other major privacy laws that may apply to you, including the EU/UK General Data Protection Regulation (GDPR) and California's CCPA/CPRA. See Section 12A ("International users & your rights").

What you can do on AdvoGrow today, and therefore what this policy has to cover:

• Join the waitlist, from anywhere, as an advocate or as a brand.
• Create an AdvoGrow account and sign in, by email sign-in link or with Google.
• Create and share tracking links as an advocate. When someone follows one of your links, we record a click event and pass them on to the merchant through our affiliate network partner. This is how attribution works, and Section 3.4 sets out exactly what that click record contains.

Advocate accounts and tracking links are currently open in Singapore only. Advocate earnings and payouts are not open yet; Section 3.5 describes what we expect to collect when they are, and we will update this policy before we collect any of it.

2. Who is responsible for your data

The person or organisation responsible for your personal data (the data controller / business) is:

Simplify Labs Pte. Ltd., a company incorporated in Singapore (UEN 202629232D). AdvoGrow is one of its brands.

• Privacy contact / Data Protection Officer: dpo@advogrow.app

If you have any questions about this policy or how we handle your data, contact us at dpo@advogrow.app.

3. What personal data we collect

We keep this deliberately minimal, and we collect different things depending on which part of AdvoGrow you use.

3.1 If you are an advocate joining the waitlist

• Your email address.

That is it. We do not ask waitlist advocates for a name, phone number, address, or anything else.

3.2 If you are a brand (using "Partner with us" to register interest)

• Your name
• Your work email address
• Your company name

3.3 If you create an AdvoGrow advocate account

• Your email address. This is your identity on AdvoGrow and how you sign in.
• If you sign in with Google: the email address, name, profile picture and Google account identifier that Google returns to us when you approve the sign-in. We never receive your Google password, and we get no other access to your Google account.
• An optional display name you choose.
• Your country. We prefill it from the country Cloudflare reports for your connection, and you confirm it. Your country decides whether you can create tracking links.
• Your confirmation that you are 18 or older, and when you gave it. We ask for the confirmation, not your date of birth.
• The brands you pick during onboarding, if you pick any.
• If you are outside our launch market, a record that you asked us to tell you when we open in yours.
• Your tracking links: the products you chose to recommend, the link codes we generated for you, and when you created and shared them.

We do not ask advocates for a phone number, home address, date of birth, or identity document.

3.4 When someone follows one of your tracking links (the click event)

When a visitor follows an AdvoGrow tracking link, we record one click event so the click can be attributed to the right advocate, and so we can tell genuine clicks from automated ones. For each click we store:

• a salted hash of the visitor's IP address, and a salted hash of their browser's user agent. The IP address and the user agent are stored hashed, never raw. The hash is one-way and is computed with a secret salt that we never publish, which is what stops it being reversed back into an IP address. If that salt is unavailable, we record nothing at all rather than store a weaker hash.
• a two-letter country code for the visitor's country, as reported by Cloudflare. Country only. No city, no coordinates.
• the address of the page they came from (the referrer), truncated, kept only so we can debug attribution.
• a de-duplication key, itself a hash, so that repeat taps within the same hour can be recognised as one unique click.
• the link code, whether the request looked automated, and the time.

We do not set a cookie on a visitor's device when they follow a tracking link, and we do not build a profile of them or track them across other sites. Once they arrive at the merchant, the merchant and our affiliate network partner run their own tracking under their own privacy policies, which we do not control.

3.5 If you request a payout (not open yet)

Advocate payouts are not open yet. When they open, we will ask for the payout details we need in order to pay you (for example a PayNow identifier or bank account details), and we will ask for them at the moment you request a payout, not at signup. They will be stored under restricted access and kept out of our logs. We will update this policy before any of this starts.

3.6 Information collected automatically

When you submit a form, our bot-protection provider (Cloudflare Turnstile) may process limited technical information from your browser to confirm you are not an automated bot, and sets a short-lived challenge cookie (see Section 9). We do not use analytics or advertising cookies, and we do not build a profile of you.

If you arrived at our site through one of our own links (for example, a link we shared in an online community), the link may carry a short channel tag (such as `ref=reddit`). If you then join the waitlist, we save that tag with your signup so we know which channels people find us through. The tag identifies the channel, not you, and we do not use it to track you across other sites.

We also use Cloudflare Web Analytics to understand, in aggregate, how many people visit our site and which pages they view. It is a privacy-first measurement tool: it sets no cookies, does not fingerprint your device, and does not identify or track individual visitors.

We do not knowingly collect any sensitive personal data, payment card information, or government identifiers.

4. How we collect your data

• Directly from you, when you fill in a waitlist form, create an account, set your country, or paste a product link.
• From Google, if you choose to sign in with Google, and only what you approve at that moment.
• Automatically from a browser, when you use our site, and when someone follows a tracking link (Section 3.4).

We do not buy lists, and we do not collect waitlist or advocate data from data brokers.

5. Why we use your data (purposes)

1. To add you to our waitlist and keep an accurate record of who has expressed interest.
2. To notify you about early access to AdvoGrow when it becomes available, and about related launch updates.
3. To understand interest in AdvoGrow, gauging demand from advocates and from brands, so we can decide what to build.
4. To protect our forms from spam and abuse (via bot protection).
5. To run your advocate account: authenticate you, keep you signed in, and show you your own links and activity.
6. To attribute clicks, and later sales, to the right advocate. The click event is the record that says a link worked and whose it was.
7. To screen for fraud and self-referral. We look at clicks and, later, sales for patterns suggesting they are not genuine recommendations. We are answerable to our affiliate network partner and to the marketplace for what happens on our links, so this is a compliance duty as well as a fairness one.
8. To pay advocates, once payouts open.
9. To meet obligations to our network partners. Our network partner and the marketplace can require us to hold and produce a list of the advocates promoting through us, for quality and checking purposes.

We do not currently send marketing emails. If, in future, we want to send you marketing or promotional messages beyond service messages and early-access notifications, we will rely on appropriate consent and always give you a clear way to opt out.

6. Your consent, and how to withdraw it

Under the PDPA, we rely on your consent to collect, use, and disclose your personal data for the purposes in Section 5. You give that consent when you knowingly submit a waitlist form or create an account, having been pointed to this policy.

You can withdraw your consent at any time. Email us at dpo@advogrow.app and ask to be removed from the waitlist, or to have your advocate account closed. We will:

• stop using your personal data for the purposes above,
• delete your waitlist entry, and
• close your account and disable your tracking links,

within a reasonable time, unless we are required by law to retain something. If you have used tracking links, we may need to keep a minimal record of the resulting clicks and any transactions, because our accounts and our network partner's reconciliation depend on them. We will tell you what has been kept and why. Withdrawing consent means we can no longer run an advocate account for you.

7. Who we share your data with

We do not sell your personal data, and we do not share it with advertisers.

We rely on a small number of third parties to run the service. Most process data only on our instructions; Involve Asia is different, and is called out below.

When a visitor follows your tracking link they end up on the merchant's own site (today, Shopee). That site is outside AdvoGrow and is governed by the merchant's own privacy policy, not this one.

We may also disclose your personal data where we are required or permitted to do so by law, or to protect our rights, safety, or property (for example, responding to a lawful request from authorities).

8. International transfers (data stored outside your country)

AdvoGrow is operated from Singapore, but our waitlist is global and our infrastructure is global. Whatever country you are in, your personal data is likely to be stored in another country whose data-protection laws differ from your own.

There are two different situations here, and we keep them apart because the protections are not the same.

8.1 Providers that process data on our instructions

Supabase, Cloudflare and Google hold and process personal data for us, on our instructions, on servers that may be outside Singapore and outside the European Economic Area (EEA)/UK, depending on the provider's chosen data centre. For these transfers we rely on the providers' contractual data-protection commitments, which are intended to give the transferred data a standard of protection comparable to Singapore's PDPA, and, for transfers out of the EEA/UK, on mechanisms such as Standard Contractual Clauses.

8.2 Involve Asia, which is a recipient in its own right

Involve Asia Technologies Sdn Bhd is in Malaysia, and as Section 7 says, it handles data for its own purposes under its own privacy policy rather than simply processing on our instructions.

What we send it is the per-advocate sub-ID attached to your tracking link. We send it because the transfer is necessary in order to perform our agreement with you: without the sub-ID there is no attribution, no confirmed sale, and nothing to pay you. That necessity is the basis we rely on under Singapore's PDPA for this transfer. The sub-ID carries no name and no email address, and it identifies the advocate to us, not to Involve Asia.

One thing worth stating precisely, because it is easy to assume otherwise: when someone follows your tracking link, their browser goes to Involve Asia directly. We do not pass Involve Asia the click record described in Section 3.4. Involve Asia makes its own record of that visit, for its own purposes, under its own privacy policy. The same is true of the merchant.

8.3 Your acknowledgement

By joining the waitlist or creating an account, you acknowledge that your data may be processed outside your own country as described here. If you are in the EEA, the UK, or another region with transfer-restriction rules, see Section 12A.

9. Cookies and similar technologies

We keep cookies to a minimum, and we use none for advertising.

• Sign-in session cookie. Set when you sign in to your AdvoGrow account, by our authentication provider (Supabase). It is what keeps you signed in as you move between pages. It is strictly necessary: the portal cannot work without it. It is cleared when you sign out, and it expires on its own.
• Bot-protection (Turnstile) challenge cookie. Set by Cloudflare Turnstile when you interact with a form, to confirm you are a genuine human and to prevent spam and abuse. This is necessary for our forms to work safely.
• Channel tag. If you arrive through one of our own tagged links, the tag is held in your browser's session storage (not a cookie) until you submit a form, or until you close the tab.
• The email address you are signing in with. When you ask us for an email sign-in link, we keep the address you typed in your browser's session storage (not a cookie), so the "check your email" screen can tell you where we sent it and offer to resend. It stays in your browser, it is cleared when you finish signing in or close the tab, and we deliberately keep it out of the page address for exactly that reason.
• No analytics cookies. No advertising or tracking cookies. Our visitor measurement (Cloudflare Web Analytics, see Section 3.6) is cookieless and does not identify individual visitors. We do not use Google Analytics, advertising pixels, or similar tracking.
• No cookie is set on someone who follows a tracking link. Our redirect stores the hashed click record described in Section 3.4 and sets nothing on their device.

If we introduce analytics or other non-essential cookies in future, we will update this policy and, where required, ask for your consent first.

10. How long we keep your data (retention)

We keep personal data only for as long as it serves the purposes in Section 5.

• Waitlist entries. Broadly, until we have contacted you about early access, or until you ask us to remove you, whichever comes first.
• Advocate account data. For as long as your account is open. If you close it, we delete or anonymise your account, profile and links within a reasonable time.
• Click events. Up to 24 months. The merchant's own validation window is measured in weeks, and the rest is margin so that we can still investigate suspected fraud and answer a question or a dispute about earnings. After that we delete them or reduce them to aggregate counts.
• Transaction and payout records, once those exist, for 5 years from the end of the financial year they relate to. That is the period Singapore company law and the tax authority require business and accounting records to be kept for, so it is not ours to shorten.

If AdvoGrow does not proceed, or we otherwise no longer need your data, we will delete or anonymise it within a reasonable time.

11. How we protect your data (security)

We take reasonable steps to protect your personal data, including:

• Storing waitlist, account and click data in our database with Row-Level Security, so it is not publicly readable and is reachable only through our protected server-side paths and authorised administrators.
• Hashing click PII with a secret salt before it is stored, and failing closed (recording nothing) if that salt is unavailable, so we cannot end up holding a reversible hash of someone's IP address.
• Encrypting data in transit using HTTPS.
• Minimising what we collect, and collecting payout details late rather than at signup.
• Not logging your personal data in plain text in our systems.

No method of transmission or storage is completely secure, but we work to protect your data using measures appropriate to the sensitivity of what we hold.

12. Your rights under the PDPA

These are the baseline rights that apply to everyone. If you are outside Singapore, your local law may give you further rights, see Section 12A. Subject to the PDPA, you have the right to:

• Access, ask what personal data of yours we hold and how we have used or disclosed it.
• Correction, ask us to correct an error or omission in your personal data.
• Withdraw consent, ask us to stop using your data, remove you from the waitlist, and close your account (see Section 6).

To exercise any of these rights, email us at dpo@advogrow.app. We will respond within a reasonable time, as required by the PDPA. We may need to verify your identity before acting on a request. We may charge a reasonable fee for an access request, as permitted by the PDPA, and will tell you in advance if so.

12A. International users & your rights

Because our waitlist is open globally, the law of your own country may give you additional or different rights. We aim to honour these, regardless of where you live.

12A.1 If you are in the EU, the EEA, or the UK (GDPR)

Our lawful basis for processing your personal data is your consent (Article 6(1)(a) GDPR), which you give when you knowingly submit a waitlist form or create an account having been pointed to this policy. In addition to the access and correction rights described above, you have the right to:

• Access the personal data we hold about you and obtain a copy of it.
• Rectification, have inaccurate or incomplete data corrected.
• Erasure ("right to be forgotten"), have your personal data deleted.
• Restriction of processing in certain circumstances.
• Data portability, receive the data you gave us in a structured, commonly used, machine-readable format.
• Object to processing in certain circumstances.
• Withdraw your consent at any time, without affecting the lawfulness of processing done before you withdrew it (see Section 6).

Because we rely on consent and collect only minimal data, exercising these rights is usually as simple as emailing dpo@advogrow.app. You also have the right to lodge a complaint with your local data protection authority / supervisory authority (for example, in the UK, the Information Commissioner's Office). For transfers of your data outside the EEA/UK, see Section 8.

12A.2 If you are in California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we have collected about you and how we use and disclose it.
• Delete the personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information.

AdvoGrow does not sell or share your personal information, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising any of your rights. To make a request, email dpo@advogrow.app.

12A.3 Other countries

If you are elsewhere and your local law grants you privacy rights, contact dpo@advogrow.app and we will do our best to honour them consistently with this policy.

13. Children

AdvoGrow is not directed at children. Our minimum age depends on what you are doing, and it is set out in full in Section 2 of our Terms of Service.

• For the waitlist, we do not knowingly collect personal data from anyone under 16.
• For an advocate account and tracking links, the minimum age is 18. That is the age of full contractual capacity in Singapore, and the minimum age our affiliate network partner requires of everyone promoting through it. We do not knowingly open an advocate account for anyone under 18.

The minimum age may be higher in some countries, and some jurisdictions require parental consent up to 18. Please do not use AdvoGrow if you are below the minimum age that applies to you. If you believe a child has submitted personal data to us, please contact dpo@advogrow.app and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time, for example as AdvoGrow opens earnings and payouts, or adds merchants beyond the first. When we make material changes, we will update the effective date at the top and, where appropriate, take additional steps to notify you. Your continued use of AdvoGrow after an update means you accept the revised policy.

15. How to contact us

For any privacy question, request, or complaint, contact us at:

• AdvoGrow, a service of Simplify Labs Pte. Ltd. (UEN 202629232D), Singapore
• Email: dpo@advogrow.app

If you are not satisfied with our response, you may contact Singapore's Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg. If you are in the EU, the EEA, or the UK, you may instead lodge a complaint with your local data protection / supervisory authority (see Section 12A).