Legal

Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains how NHB Industrial Pte Ltd (UEN 202542682D) (“ShepherdForms”, “we”, “us”) collects, uses, discloses, and protects personal data when you use shepherdforms.com and related services (the “Service”). We handle personal data in accordance with Singapore’s Personal Data Protection Act 2012 (PDPA).

ShepherdForms lets organisers build registration forms and collect sign-ups for their events. In doing so, we act in two capacities: as a data controller for the accounts of organisers who use our platform, and as a data intermediary processing event registrants’ data on behalf of those organisers.

1. Information we collect

Account information (organisers & collaborators): name, organisation name, email address, and a password (stored only as a secure hash). If you sign in with Google, we receive your name and verified email address from Google.

Event registration data: information that event registrants submit through forms created by organisers. The exact fields are chosen by each organiser and may include name, contact details, dietary preferences, workshop or timeslot selections, and, where an organiser requires it, identification details such as NRIC/FIN or passport number. This data belongs to the organiser who collected it.

Payment information: when an event collects payment, card and PayNow transactions are processed by Stripe through the organiser’s own Stripe account. We do not store full card numbers on our servers.

Technical data: IP address, browser type, and basic usage information, used for security and to operate the Service. We use a single session cookie to keep you signed in.

2. How we use personal data

• To provide and operate the Service — creating forms, accepting registrations, and managing events.
• To process event payments through the organiser’s Stripe account.
• To send transactional emails, such as registration confirmations and password resets.
• To authenticate you, including via email/password or Google sign-in.
• To maintain security, prevent abuse, and comply with legal obligations.

3. Consent and your choices

Event registrants provide consent at the point of submitting a form, in line with the PDPA. A registrant may withdraw consent at any time using the link provided after submission; withdrawing consent cancels the registration and permanently erases that registrant’s details from our systems. Organisers are responsible for the lawfulness of the data they collect through their forms.

4. How we share data

We do not sell personal data. We share data only with service providers that help us run the Service:

• Stripe — payment processing (where an event collects payments).
• MailerSend — delivery of transactional emails.
• Google — only if you choose “Sign in with Google”, to verify your email and name.
• Our hosting provider — to operate the application and store data.

We may also disclose data where required by law, or to protect the rights, safety, and property of ShepherdForms, our users, or others.

5. Data retention and deletion

Organiser account data is retained while the account is active. Event registration data is retained for as long as the organiser keeps the event, and is erased when a registrant withdraws consent or when the organiser deletes the event. You may ask us to delete your account and associated data by contacting us at the address below.

6. Data security

We apply reasonable technical and organisational measures to protect personal data, including encryption in transit (HTTPS), hashing of passwords, and encryption of sensitive credentials such as organisers’ Stripe secret keys. No method of transmission or storage is completely secure, but we work to protect your information and review our safeguards.

7. International transfers

Our application and database are hosted in Singapore. Some service providers (such as Stripe and Google) may process data outside Singapore. Where data is transferred abroad, we take steps to ensure it receives a standard of protection comparable to that under the PDPA.

8. Your rights under the PDPA

Subject to applicable law, you may:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent to our collection, use, or disclosure of your data.

If your data was collected through an organiser’s event form, please also contact that organiser, as they control that data. To exercise any right with us, contact us using the details below.

9. Children

The Service is intended for use by event organisers and adults. Where events involve minors, organisers are responsible for obtaining the appropriate parental or guardian consent in line with the PDPA.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you of material changes.

11. Contact us

For any questions about this Privacy Policy or your personal data, or to reach our Data Protection Officer, contact: