Privacy Policy

Effective 20 September 2026

1. Who We Are

BookASquare is operated by Ditra Point, a business established in Malaysia ("BookASquare", "we", "us"), the same parent company as OxyPages and Oxyforge. BookASquare starts with events in Singapore and is built for organizers and buyers across Southeast Asia. This policy explains how we collect, use, disclose and protect personal data when you use bookasquare.com and app.bookasquare.com. We follow Malaysia's Personal Data Protection Act 2010, Singapore's Personal Data Protection Act 2012, and the data protection laws of the other countries where we operate, such as Thailand's PDPA, Indonesia's Personal Data Protection Law, the Philippines' Data Privacy Act and Vietnam's personal data protection rules, where they apply to you. Questions and requests: support@bookasquare.com.

2. Our Two Roles

For organizers and our own business, we decide how personal data is used: organizer accounts, team members, billing, support, and visits to our website.

For buyers, vendors and attendees, the organizer of the event you book decides what is collected and how it is used. We process that data on the organizer's behalf to run the booking, payment and check-in for them. If you have questions about how an organizer uses your data, contact the organizer; their details are on the event page and your order page. We can help pass on requests.

Your BookASquare account (your email, name, sign-in and the list of your bookings) is ours to look after: we decide how that account data is used, while each organizer remains responsible for the booking details they collect for their event.

3. What We Collect

Organizers and team members: name, email, phone, password (stored by our authentication provider, never in readable form), organization name and public profile, payout and payment-method details you enter (such as PayNow or bank account details shown to your buyers), your Stripe account connection, billing contact and invoices, and records of actions taken in your account.

Buyers and vendors: no sign-in is needed to book; we create a free account under your email when you book, so you can see your bookings later (your password, if you set one, is held by our authentication provider and never in readable form). We hold your name, email, phone, vendor or brand name, attendee names on tickets, answers to the organizer's questions, what you booked, payment status and references, payment-proof screenshots or PDFs you upload for bank transfers or payment apps, and check-in records.

Card payments are made on Stripe's secure page to the organizer's Stripe account. We never see or store full card numbers; we receive the payment status and reference.

Technical data: IP address, browser and device information, and logs needed to run and secure the service. We store a one-way hash of your IP address to limit abuse of reservations.

4. How We Use It

• to create and hold reservations, process orders and issue tickets;
• to let organizers verify payments, review bookings, contact buyers and check attendees in;
• to send transactional emails (order confirmations, tickets, payment and booking updates);
• to calculate and invoice our platform fee to organizers;
• to provide support, prevent fraud and abuse, keep audit records and secure the service; and
• to meet legal, accounting and tax obligations.

We do not sell personal data, and we do not send marketing to buyers. We collect and use data with your consent (which you give by submitting it for the purpose shown), or on another basis the applicable law allows, such as to fulfil a contract, comply with the law, or for our legitimate interests in running a secure service.

5. Who We Share It With

• The organizer of the event you book, and their authorised team members. Payment proofs are visible only to the organizer's staff who handle payments, through short-lived links.
• Service providers who host or deliver BookASquare for us: Amazon Web Services (application servers, Singapore), Supabase (database, authentication and file storage), Resend (email delivery), Stripe (organizers' card payments, and our invoices to organizers), and Vercel (website hosting). They may use data only to provide their service to us.
• Authorities or advisers where required by law, or to protect rights, safety or the security of the service; and a buyer of our business, subject to this policy.

6. International Transfers

Your data may be stored and processed outside the country where you live. Our application servers, database and file storage are in Singapore. Email delivery, website hosting and Stripe may process data in other countries, including the United States. Where we transfer personal data across borders, we take steps, including contractual commitments from our providers, to ensure it receives a standard of protection comparable to the law of the country it came from.

7. Cookies And Analytics

BookASquare uses only the browser storage needed to work: keeping you signed in, holding your checkout session, remembering a draft of your details during checkout, and remembering your analytics choice. We do not run our own advertising trackers.

We use Google Analytics on BookASquare's own pages (the home page, feature and pricing pages, the blog, help and these legal pages) to count visits and see which pages people find useful. It is never loaded or sent on event, booking, checkout, payment, order, ticket or account pages. Google processes that usage data for us under its own terms; it does not include your name, email, orders or payment details.

An organizer may add their own Google Analytics or Meta Pixel to their public event pages. These load only on that organizer's pages, only after you allow them (unless the organizer has set them as not requiring consent), and never on order, checkout, payment or ticket pages. You can change your choice by clearing your browser storage for bookasquare.com. The organizer is responsible for those tools.

8. How Long We Keep It

• Orders, payments, refunds, platform-fee and invoice records: 5 years after the end of the financial year they relate to, or longer where the law of the relevant country requires, for accounting and tax.
• Payment-proof files (screenshots or PDFs of a transfer): deleted 90 days after the event, or the event date booked, ends. The payment record itself (amount, reference, dates and who verified it) is kept with the order records above.
• Organizer accounts: while the account is open. We may treat an account as dormant once 365 days have passed since the end of its last event (or since it was created, if it never ran one) with no new event, and may delete a dormant account and its content a further 180 days later. We will try to warn you by email before deleting. After closure or deletion we keep only what the records above require.
• Security and server logs: for a limited period needed to secure the service and investigate incidents.

When data is no longer needed for these purposes, we delete or anonymise it.

9. Security

We protect personal data with access controls by role, encryption in transit, hashed access tokens, private storage for payment proofs, and audit logs of sensitive actions. No system is completely secure. If a data breach occurs, we will notify the relevant data protection authorities and the people affected where the applicable law requires it (in Singapore, for example, where a breach is likely to cause significant harm or affects 500 or more people), and we will inform the organizers whose data is involved.

10. Your Rights

You may ask to access the personal data we hold about you and how it has been used or disclosed in the past year, ask us to correct it, or withdraw your consent. Email support@bookasquare.com. We will respond within 30 days, or within any shorter period your local law requires, or tell you within that time when we will. Withdrawing consent may mean we, or the organizer, can no longer provide a booking or account. For data held on an organizer's behalf, we will work with the organizer to respond. Depending on where you live, you may also have rights to deletion, portability or objection; ask us and we will apply them where your law provides them. If you are not satisfied with our response, you may contact the data protection authority in your country (in Malaysia, the Personal Data Protection Commissioner at pdp.gov.my; in Singapore, the Personal Data Protection Commission at pdpc.gov.sg).

11. Children

Organizer accounts are for people aged 18 and over (or the age of majority where they live, if higher). Buyers under that age should book with a parent or guardian, who may enter a child's name as an attendee. We do not knowingly collect data from children for any other purpose.

12. Organizers' Responsibilities

Organizers decide which questions to ask buyers and what to do with the answers. Organizers must ask only for data they need, tell buyers how they will use it, obtain consent for marketing, and not collect national identification numbers (such as NRIC, MyKad or KTP numbers) unless the law requires them.

13. Data Protection Officer

Our data protection officer can be reached at support@bookasquare.com (please put "Data Protection" in the subject). Every privacy question, request or complaint goes to that address.

14. Country Notes

This section adds what the law of certain places requires. Where it differs from the rest of this policy, it prevails for residents of that place.

Malaysia. This policy is the written notice required by section 7 of the Personal Data Protection Act 2010; a Bahasa Malaysia version is available on request. We respond to data access and correction requests within 21 days and do not charge a fee. We transfer personal data outside Malaysia only as section 129 of the Act permits, as described in section 6.

Singapore. Our data protection officer's business contact is in section 13. Where a data breach is notifiable under the PDPA, we notify the Personal Data Protection Commission within 3 days of assessing it, and the people affected where required.

15. Changes And Governing Law

We may update this policy. We will post the new version here with its effective date, and tell organizers about significant changes by email or in the dashboard. This policy is governed by the laws of Malaysia; nothing in it removes rights you have under mandatory data protection law in the country where you live.