privacy
Privacy.
Last updated 2026-09-20. Singapore operator, international audience.
1. Who is responsible
DUOPORE VENTURES PTE. LTD., 68 Circular Road, #02-01, Singapore 049422, UEN 202628284M, operates ExpatWhy and is responsible for its personal-data processing. Christoph Kaesler is its director. Send privacy enquiries, complaints and rights requests to contact@bangkokgotme.com, mentioning ExpatWhy. This is the company's shared contact address.
Singapore's Personal Data Protection Act (PDPA) is part of the applicable framework. EU/EEA or UK data-protection rules may also apply to relevant activities, including offering services to people there or monitoring their behaviour. An international audience or Singapore incorporation does not remove those obligations. GDPR bases and rights below apply where that law governs the processing.
2. Visiting the site and contacting us
Vercel hosts the website and processes the IP address, requested URL, time, browser information and other connection/security information needed to deliver and protect it. Public city images are delivered through Cloudflare R2, which receives connection data when your browser requests them. These essential requests occur without optional analytics. Security and delivery logs can contain personal information.
If you email us, we and our email service providers process your address, message and attachments to respond, handle corrections and keep necessary correspondence. Please do not send passport scans, medical records, bank details or other unnecessary sensitive documents. Depending on the request, the GDPR basis is steps you ask us to take for a service (Art. 6(1)(b)), a legal duty (Art. 6(1)(c)), or our legitimate interest in operating securely and responding to enquiries (Art. 6(1)(f)). Under the PDPA we process information for the notified purpose with consent or an applicable legal basis or exception.
4. Your saved preferences, tools and maps
Your shortlist, compare selection, theme, decision profile, budget preferences and tax-tool trip dates are saved in your browser where the feature uses local storage. They persist until you clear them or the site's browser data. Essential preference storage supports the feature you request; it is separate from optional analytics consent.
When you request results or a decision-sheet PDF, the profile needed for that request (such as passport category, budget, persona, stay length and preferences) is sent to our application to compute the result. Our hosting provider processes it on our behalf. The application does not intentionally persist that profile in a database or send it to an external AI model. Current requests use the request body; old shared links may still contain an encoded profile in the address and can reach hosting logs before the browser removes it. Do not share such links. Results are general suggestions, not decisions about your legal rights or eligibility.
Displaying maps requests tiles from the OpenStreetMap Foundation's tile service. It receives your IP address, browser information and requested map area; see its privacy policy. The currency comparison tool requests exchange rates from the European Central Bank when used. The request identifies currencies, not your entered monetary amount. These providers receive connection data. We send no browser referrer with outgoing requests. Requested tools and map delivery rely on performance of the requested service or legitimate interests where GDPR applies.
5. Arrival Club
Submitting an Arrival Club request provides your first name, email, chosen city and planned arrival date. We use them to assess possible cohorts and contact you about the requested activity. It does not subscribe you to the newsletter or authorise marketing. Participation is intended for adults aged 18 or over. There is no guaranteed event or seat merely because you submitted the form.
We store these details in Neon's managed Postgres database. The documented database region is US West (us-west-2). We publish cohort counts, not names or email addresses. Our authenticated company reporting uses daily aggregate submission counts. It does not export individual signup details. You can ask us to correct or remove your request at the contact address above. To prevent someone else overwriting your details, submitting the same email/city again does not update an existing request.
The purpose is responding to the activity you requested; where GDPR applies, the basis is Art. 6(1)(b). Under the PDPA, the form explains the purpose for which you provide the details. We do not share your contact details with other participants or add you to a messaging group merely from this signup. Any later group invitation or separate paid activity must explain its additional data use first.
Bangkok discussions store your messages, replies, profile name and posting time. These are shown to signed-in members and authorized operators even when your matching profile is paused. Delete individual messages from Discussions; deleting a discussion removes its replies. Account deletion removes your authored messages and replies to your discussions. Reports retain a message snapshot under the report retention policy below. Discussions are provided as part of the membership you request.
Find your people: accounts and introductions
This optional Bangkok pilot stores your email, password hash, recovery-code hash, profile, introduction requests, blocks and reports in Neon, together with the terms version and acceptance time for new registrations. A necessary HttpOnly session cookie, expatwhy_people, keeps you signed in for up to 30 days. Recovery codes reset your password and revoke existing sessions; password-reset emails are not sent. Profile and account pages are excluded from optional analytics and heatmaps.
Visible profiles can be read by signed-in members. Authorized operators can also review visible profiles and suggested pairs to support the pilot. Suggestions do not send introductions or share contact details automatically. Profiles and email addresses are self-reported, not identity-verified. Your account email is shown to another member only after one person requests an introduction and the other accepts. Pausing your profile stops new introductions but keeps existing connections. Ending a connection or blocking hides the contact details in the app; copies already made by a recipient cannot be recalled.
You can edit or pause your profile and delete your account from My profile. Deletion removes your account, profile, sessions, blocks and connections. Reports may remain for moderation without your account identifier; avoid putting unnecessary personal information in report text. Expired sessions and rate-limit records are cleared by scheduled maintenance. Contact the operator using the address above for assistance or privacy requests. Existing Arrival Club signups are never automatically published as member profiles.
We use account and profile information to provide the membership and introductions you request (GDPR Art. 6(1)(b), where applicable). Security, rate limiting, reporting and moderation support our legitimate interest in keeping the community safe (Art. 6(1)(f)); legal obligations may require processing under Art. 6(1)(c). Under the PDPA, the purposes are account operation, requested introductions and community safety, with consent or an applicable legal basis or exception. Optional marketing is separate and is not enabled by joining.
Matching compares the city, goal, arrival/stay dates, housing budget and stated preferences such as languages and routines. It suggests introductions; it does not make a decision about eligibility for housing or any legal right. No automated introduction is sent on your behalf.
7. Commercial links and purchases
Paid links are labelled at the placement. Following one takes you to a separate provider, sometimes through our redirect. We do not keep a separate record of individual clicks, but our host can log the request. We do not embed an affiliate tracking pixel before you click. On the destination, the provider may process connection/referral data and use cookies under its own policy and consent choices. We do not control whether or when it sets a cookie. Partners may provide reports about referrals or commissions, subject to their programme terms and privacy notices. See our affiliate disclosure.
8. Providers and international processing
Relevant recipients include Vercel (hosting and optional analytics), Cloudflare (image delivery), Neon (Arrival Club and member database), our correspondence provider, a configured newsletter provider, Microsoft if you opt into Clarity, and map/rate providers for requested features. Some process as service providers; Microsoft, destination partners and public-data services may have their own controller obligations. We may also disclose data where legally required or necessary to establish or defend legal claims.
Processing can take place in Singapore, the USA and other countries used by these providers. A hosting region does not mean all support and operational access stays there. Singapore transfers must meet the PDPA's comparable-protection requirements unless an applicable exception applies. Where GDPR transfer rules apply, an appropriate mechanism is required, such as applicable adequacy coverage or standard contractual clauses with any necessary supplementary measures. Contact us for information about the safeguards applicable to your data.
9. Retention
- Community: account and profile records, including registration acceptance evidence, currently remain until account deletion. Paused or expired-stay profiles are excluded from discovery but are not automatically deleted. Account deletion removes associated sessions, blocks and introductions; report text can remain without the deleted account identifier. Avoid personal details in report text. Scheduled maintenance removes expired sessions and rate-limit records, and resolved reports more than 90 days after report creation. Unresolved reports remain for review.
- Arrival Club: only while needed to coordinate the requested activity, with a retention limit of six months after the planned arrival date unless a specific legal duty or dispute requires restricted retention. You may request earlier removal.
- Correspondence: while needed to resolve the enquiry and for applicable legal recordkeeping or claims periods.
- Newsletter: while subscribed; after withdrawal, only suppression and consent evidence needed to respect your choice or meet legal obligations. Provider backups follow their deletion cycles.
- Hosting/security logs and analytics: according to the configured service retention and security needs. Periods vary by service and the information involved; contact us for details relevant to your request.
- Browser storage: until removed or replaced in your browser. Clarity retention is described above.
Deletion from an active system may precede expiry of restricted backups. We do not keep identifiable information merely because storage is available.
10. Your rights and complaints
Contact us to request access or correction, withdraw consent, or raise a concern. Under Singapore's PDPA, rights and exceptions include access and correction and withdrawal with reasonable notice. We explain any necessary identity check, permitted fee or limit rather than asking you to send sensitive identity documents without a reason. You can contact Singapore's Personal Data Protection Commission.
Where GDPR applies, rights include access, rectification, erasure, restriction, portability where applicable, objection to legitimate-interest processing and withdrawal of consent, as well as a complaint to a competent supervisory authority. Objection to direct marketing is available at any time. GDPR requests are normally answered within one month; lawful extensions and their reasons must be communicated within that period. Other requests follow the applicable local deadlines. Withdrawal does not affect processing already lawfully performed.
11. Changes
We date updates here and provide any additional notice or renewed choice required for a material change. You do not need a newsletter subscription to receive a legally required notice.