Privacy Policy

DAMAI GEMILANG VENTURES ENT ("Company," "we," "us," or "our"), the sole operator of the Pullup social platform, is the data controller responsible for all personal data collected, processed, and stored in connection with the Pullup mobile application, waitlist portal, and all associated services (collectively, the "Services").

We recognize that your privacy is a fundamental right. This Privacy Policy is designed to be transparent, comprehensive, and fully compliant with applicable data protection laws. It describes precisely what data we collect, why we collect it, how we use it, with whom we share it, how long we retain it, and the rights you hold over your information.

By accessing or using any Service, including by submitting your details to our waitlist, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree, you must immediately cease all use of the Services.

For all data-related inquiries, contact our designated data point of contact at: team@pullup.vip. This Policy should be read together with our Terms & Conditions and Community Guidelines.

This Policy applies to all personal data processed by the Company in connection with the Services, regardless of how you access them. It covers:

• Individuals who download, access, or use the Pullup mobile application;
• Individuals who submit their contact information to the Pullup waitlist portal;
• Individuals who communicate with the Company via email or other channels;
• Individuals whose information is incidentally processed because they appear in User Content.

This Policy does not cover data practices of third-party services or platforms that you access via links or integrations within our Services. Those third parties maintain their own privacy policies.

We collect data in the following categories, depending on how you interact with the Services:

3.1 Data You Provide Directly

• Waitlist Registration: Phone number or email address, and any optional information you choose to provide.
• Login Information: To create your account and sign you in, we save the account you sign in with — your Google or Apple account (the name, email address, and account identifier that Google or Apple shares with us) or, if you sign in with one, your phone number — together with records of your sign-ins. We save your login information to keep the community safe: it lets us stop fake and duplicate accounts, block people who have been removed for abuse, and investigate reports.
• Phone Number (Optional):A phone number is not required to use Pullup. You may add one in the app's Settings and verify it with a one-time SMS code; a verified number adds an extra layer of security for you and everyone you meet, and can also be used to sign in. When you add a number we check that it is a real mobile line (not a virtual or landline number).
• Account Profile: Display name, username, photographs, date of birth (for age verification), gender, and biographical information.
• Event Content: Event titles, descriptions, dates, venue information, photographs, and associated media uploaded by Hosts.
• Communications: Messages sent through in-app group channels, reports submitted to the Company, and emails or messages you send to our support team.
• Identity Verification (Optional): Where a user elects to verify their identity, a photo of their government-issued identification (such as MyKad) and a one-time selfie are used solely to verify that the user is 18 years or older, to match real faces to profiles to prevent catfishing, and to support real-world meetup safety. See section 3.4 for exactly what happens to the photos and what information is kept. Verification is voluntary; users who choose not to verify may skip and operate an unverified profile without a verified trust badge.

3.2 Data Collected Automatically

• Precise Location Data: Real-time GPS coordinates and network-inferred location, collected when the Application is active and you have granted location permissions. This data underpins core map-based features. See section 8 for how it is used and kept.
• Check-Ins & People You've Met:When you check in at an Event (“I'm here”), we record that you attended and whether the check-in was confirmed by your phone's location or made manually — not your coordinates. From check-ins we keep a private list of the people you have attended Events with and a count of the areas you have explored.
• Device & Technical Data: Device type, operating system version, device identifiers (e.g., advertising IDs where applicable), browser type, IP address, and app version.
• Usage & Telemetry Data: Features accessed, Events viewed or joined, tap patterns, session durations, crash logs, and error reports.
• Network Data: Network type (WiFi, cellular), approximate connection quality, and related diagnostics used to optimize performance.

3.3 Data From Third Parties

• Authentication Providers: When you sign in with Google or Apple, that provider confirms your identity to us and shares your name, email address, and account identifier. If you sign in with or add a phone number, the SMS service confirms you received the one-time code.
• Firebase Infrastructure: We use Google Firebase services for authentication, database, cloud functions, and storage. Firebase's own Privacy Policy governs data processed at the infrastructure level.

3.4 Identity Verification — Photos, Face Data & What We Keep

• Your photos are never saved. Your phone reads the details on your ID card. The ID photo and your selfie are then sent over an encrypted connection to our server, which passes them once to our face-comparison provider, Amazon Web Services (Amazon Rekognition), solely to check that your selfie matches the photo on your ID. Pullup does not save either photo, and the copies on your phone are deleted as soon as they have been used.
• Your face information is destroyed. The comparison gives a yes-or-no result. The face data used for it is deleted right after the check and is never kept by Pullup — we do not create or store a face template or any other biometric identifier. The selfie is used only for this check and never to sign in.
• The information is kept. We keep, in a private record that other members cannot see: your ID number (so one ID can be linked to only one account), your name as shown on the ID, your date of birth (to confirm you are 18 or older and, if you choose, to show your age), the nationality shown on the ID, and whether you are verified. We keep this information to keep the community safe.
• Comparing faces involves biometric data. By choosing to verify, you consent to this processing. If you skip verification, none of this is collected: you enter your own name and date of birth instead.

We process your personal data only for specified, explicit, and legitimate purposes. The following table outlines each processing purpose and its corresponding legal basis:

Pullup is built on a strict data-minimization architecture. We collect only what is necessary for the purpose stated and retain it no longer than required. Specific retention periods are as follows:

Following the applicable retention period, personal data is either permanently deleted or irreversibly anonymized so that it can no longer be associated with an individual.

You can delete your account at any time in the app's Settings, or by following the steps on our Delete Account page.

The Company implements rigorous, layered technical and organizational security measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Sensitive data fields stored on our infrastructure are encrypted using AES-256 or equivalent standards.
• Access Controls: Access to production systems and personal data is restricted on a strict need-to-know basis, governed by role-based access controls and multi-factor authentication.
• Firebase Security Rules: Firestore and Firebase Storage rules enforce data isolation, ensuring users can only access data they are authorized to view.
• Security Monitoring: We employ automated monitoring tools to detect and respond to anomalous access patterns, potential breaches, and abuse signals in real-time.
• Secure Development Practices: Our engineering team follows secure software development lifecycle (SSDLC) principles, including regular code reviews and security testing.

Notwithstanding these measures, no system is perfectly impenetrable. The Company expressly disclaims liability for data breaches resulting from sophisticated cyber-attacks, zero-day exploits, or force majeure events beyond our reasonable control. In the event of a confirmed breach materially affecting your personal data, we will notify you in accordance with applicable legal requirements.

We do not sell your personal data. Period.

We do not sell, rent, or trade your personal information to third-party data brokers, advertisers, or marketing entities. We may, however, share your data in the following limited circumstances:

7.1 Service Providers

We share data with trusted third-party service providers who perform functions on our behalf, including cloud hosting (Google Firebase / Google Cloud), sign-in providers (Google and Apple), face comparison for optional identity verification (Amazon Web Services — Amazon Rekognition), push notification delivery, SMS authentication gateways, a phone-number validation service (to confirm that a number you add is a real mobile line), and crash analytics providers. These providers are contractually bound to use your data only as directed by us and in accordance with this Policy.

7.2 Other Users (By Design)

Certain information is inherently visible to other users as part of the platform's social functionality — specifically, your display name, profile photo, and Events you create or attend. You control and are responsible for what you choose to share publicly on the platform.

7.3 Law Enforcement & Legal Compliance

We may disclose your information to law enforcement agencies, regulatory authorities, courts, or governmental bodies when: (a) compelled by a valid subpoena, court order, or equivalent legal process; (b) we believe in good faith that disclosure is necessary to prevent imminent physical harm to any person; (c) disclosure is required to prevent fraud or illegal activity on the platform; or (d) disclosure is necessary to enforce our Terms of Service or protect our legal rights. We will, where legally permissible, notify you of such requests.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, asset sale, or similar corporate transaction involving the Company or its assets, your data may be transferred to the successor entity. We will provide notice if your data becomes subject to a materially different privacy policy.

7.5 With Your Consent

We may share your data in any other manner with your explicit, informed, prior consent.

Precise location data is the cornerstone of Pullup's core functionality. When you use the Application, we collect your real-time GPS coordinates to display nearby Events on the map and to verify proximity to an Event venue.

Key facts about location data:

• No location history:We do not build a persistent historical record of your location movements. We keep only your most recent location, to show what's happening near you and to tell you about Events nearby, and it is replaced as you move.
• Check-ins:When you check in at an Event, your phone's location at that moment is compared with the Event's location to confirm you're there. We record that you attended — not your coordinates. If your phone can't confirm it, you may check in manually.
• Opt-out available: You may disable location access for the Application in your device settings at any time. Doing so will disable map-dependent features.
• Not sold: Your location data is never sold or shared with advertisers.
• Visible to others by design: When you host or join an Event, your proximity to that Event may be inferred by other attendees as part of the platform's social mechanics. You consent to this visibility by participating in such Events.

Our Waitlist Portal may use cookies and similar tracking technologies (e.g., local storage, session tokens) to: (a) maintain session state; (b) analyze aggregate traffic and usage patterns; and (c) improve the user experience. These are functional and analytical in nature — not advertising-related. You may configure your browser to refuse cookies, though this may limit certain portal functionality.

We do not use third-party advertising trackers or cross-site tracking technologies.

Subject to applicable law and our ability to verify your identity, you may have the following rights with respect to your personal data:

• Right of Access: Request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no longer a lawful basis for us to retain it.
• Right to Restriction: Request that we restrict our processing of your personal data in certain circumstances.
• Right to Data Portability: Request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right Not to Be Subject to Automated Decision-Making: Request human review of any automated decision that significantly affects you.

To exercise any of these rights, contact us at team@pullup.vip. We will respond to verified requests within 30 days. We may require proof of identity before processing your request.

The Services are strictly intended for users aged 18 and older. We do not knowingly collect, solicit, or process personal data from individuals under the age of 18. If we discover that we have inadvertently collected personal data from a minor, we will immediately delete such data from our systems. If you believe we have collected data from a person under 18, please notify us immediately at team@pullup.vip.

The Services are operated primarily from Malaysia. If you access the Services from outside Malaysia, you acknowledge that your personal data will be transferred to, processed in, and stored in Malaysia, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to such transfer, processing, and storage.

Where we use third-party services that process data outside Malaysia (e.g., Google Cloud infrastructure), we ensure that appropriate safeguards are in place, including standard contractual clauses or reliance on the third party's adequacy status.

We reserve the right to modify this Privacy Policy at any time. Material changes will be communicated by updating the "Effective Date" at the top of this document and, where practicable, by notifying you via the contact information you provided. Your continued use of the Services after the effective date of any revision constitutes acceptance of the updated Policy.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

For formal privacy inquiries, data access requests, consent withdrawals, or concerns about our data practices, please contact: