Privacy policy

Folklory Privacy Policy

Last updated: 20 July 2026

Folklory is operated by One Shiok Thing Pte Ltd, a company incorporated in Singapore. One Shiok Thing Pte Ltd also operates the Yah Lah BUT podcast and any other brands published under the same corporate group. Folklory is a personalised podcast gift service. Our folklorists interview a loved one, produce a bespoke podcast episode about their life, and deliver it to the person you nominate. Because our product involves intimate personal stories, voice recordings, and information about people who did not personally place the order, we take our data responsibilities seriously.

This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you and your loved ones have over it. It is written to comply with the Singapore Personal Data Protection Act 2012 (PDPA) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

By using our website, placing an order, sitting for an interview, or receiving a Folklory as a gift, you acknowledge you have read this Privacy Policy.

1. Who this policy covers

We use plain language to distinguish between the different people we hold information about:

  • Customer - the person who places and pays for the order.
  • Story Subject (or "Interviewee") - the person interviewed by a Folklorist for the podcast episode. Often the Customer's parent, grandparent, spouse, or friend.
  • Gift Recipient - the person who receives the finished Folklory. Sometimes the same as the Customer, sometimes the same as the Story Subject, sometimes a third party.
  • Website Visitor - anyone browsing folklory.com without placing an order.

Different sections of this policy apply to different roles. Where a section is role-specific, we say so.

2. Personal information we collect

2.1 From Customers

  • Contact details: name, email, phone number, billing address, shipping address.
  • Payment information: processed by Shopify Payments and Stripe. We do not store your full card number.
  • Order details: what you bought, when, delivery preferences, promo codes used.
  • Account information: if you create an account, your username, password (hashed), and preferences.
  • Communications: emails, WhatsApp messages, form submissions, customer support tickets.

2.2 From Story Subjects (interviewees)

  • Contact details provided by the Customer or by the Subject during scheduling.
  • Interview audio recordings - the full audio of the interview with a Folklorist.
  • Interview content - biographical information, family history, life events, personal opinions, relationships, health experiences, religious or philosophical beliefs, and any other topic the Subject chooses to share during the interview.
  • The finished podcast episode derived from the above.

We recognise that interview content often includes categories of information treated as sensitive or "special category" data under GDPR (Article 9) - such as health, religious beliefs, or ethnic origin - and we handle it accordingly. See Section 5.

2.3 From Gift Recipients

  • Contact details provided by the Customer for delivery of the Folklory (name, shipping address, and where the gift is delivered digitally, email or phone).
  • Engagement data if the Recipient interacts with the listening page (e.g. comments and likes on the shared page).

2.4 Automatically collected

  • Device and browser data: IP address, browser type, operating system, referrer URL.
  • Usage data: pages visited, time on site, actions taken, interactions with the tracking and listening pages.
  • Cookies and similar technologies: see Section 8.

3. Where we get your information

  • Directly from you when you order, sit for an interview, contact us, or engage with our website.
  • From the Customer when they provide information about a Story Subject or Gift Recipient on your behalf. Customers warrant to us that they have the right to share this information (see Section 4).
  • From service providers including Shopify, Klaviyo, Stripe, and our Folklorists.
  • Automatically through your device and cookies when you use our website.

4. If someone else ordered a Folklory involving you

If you are a Story Subject or Gift Recipient, it is likely that the Customer provided your name and contact details to us in order to arrange the interview or delivery. When a Customer places an order, they confirm to us that they have the right to share your information with us for this purpose.

You have the same rights over your information as anyone else covered by this policy. Specifically:

  • You can ask us what information we hold about you.
  • You can ask us to correct it or delete it.
  • You can withdraw from the process at any time before the podcast is delivered, and we will stop production and delete the recordings on request.
  • After delivery, you can ask us to delete the master copy of your recording and remove your podcast from our listening page. Note: we cannot recall copies already downloaded by the Customer or Gift Recipient.

To exercise these rights, contact us using the details in Section 15.

5. Sensitive personal information

Interviews often touch on sensitive topics - health, family conflict, religious belief, sexuality, immigration history, bereavement. We treat this content with heightened care:

  • Only the assigned Folklorist, the editing team, and (where necessary) senior Folklory staff have access to raw interview recordings.
  • Interview material is not sold to any third party under any circumstances.
  • Interview material is not used to train third-party artificial intelligence systems for their own model development.
  • We may use AI tools to assist our editing team in producing your Folklory - for example, generating internal summaries, transcripts, or navigation aids. Where we do, we select vendors whose contractual terms prohibit training their models on our customer or interview data.
  • We may occasionally wish to reuse a specific interview excerpt externally (for example, in Folklory's own marketing materials or a promotional clip). This will only occur with the Story Subject's separate written consent for that specific use.

Where GDPR applies, we rely on your explicit consent (Article 9(2)(a)) as the lawful basis for processing sensitive interview content. You may withdraw that consent at any time, though this will not affect processing already carried out.

6. How we use your information

We use personal information to:

  • Deliver the Folklory. Schedule interviews, produce the podcast, host the finished episode on our listening page, and deliver the physical or digital gift.
  • Communicate with you. Send order confirmations, production updates via the tracking page, delivery notifications, and respond to your questions.
  • Take payment and prevent fraud. Process transactions and detect suspicious activity.
  • Improve our service. Understand which parts of our website work well, identify friction in the ordering flow, and refine the interview process. Aggregated and anonymised data only - never using the content of interviews.
  • Marketing (Customers only, and only with your consent). Send you newsletters, promotions, and information about new products. You can unsubscribe at any time using the link in every marketing email.
  • Legal compliance. Comply with tax, accounting, and regulatory obligations, respond to lawful requests from authorities, and enforce our terms.

Where GDPR applies, our lawful bases are: performance of a contract (order fulfilment), your consent (marketing, sensitive interview content), legitimate interests (fraud prevention, service improvement), and legal obligation (tax and regulatory reporting).

7. Who we share your information with

We share personal information only with the parties listed below, and only to the extent needed for the purpose described.

  • Folklorists - our interviewers, editors, and producers. Some are employees; some are engaged contractors. All are bound by written confidentiality obligations covering interview content and Story Subject information.
  • Shopify - our e-commerce platform. Handles orders, checkout, customer accounts, and payment routing. See the Shopify Consumer Privacy Policy.
  • Payment processors - Stripe, Shopify Payments, Apple Pay, Samsung Pay, and GrabPay process card and payment data on our behalf.
  • Klaviyo - email marketing automation and transactional emails including tracking and listening links. We may in future use Klaviyo to send WhatsApp messages related to your order.
  • Riverside.fm - the platform we use to conduct and record video and audio interviews. Interview audio and video are captured through Riverside's servers. We may in future use Riverside's transcription features to generate internal transcripts for editing purposes.
  • Cloudflare - hosts our tracking page (track.folklory.com), listening page (listen.folklory.com), and provides security and performance services. We also use Cloudflare R2 for storage of interview audio and podcast files.
  • Google Workspace - stores order records, production data, and (in some cases) interview files on our internal spreadsheets and Google Drive.
  • Meta Platforms (Facebook/Instagram) - we use the Meta Pixel on our website to measure the effectiveness of our advertising and to serve relevant ads on Meta platforms. Meta receives data about your visits to our site (pages viewed, actions taken, hashed identifiers). See Section 17 for how US state residents can opt out of this sharing.
  • Google (Google Ads, Google Analytics 4) - we use Google Ads for advertising measurement and retargeting, and GA4 to understand website traffic and user behaviour.
  • LinkedIn - we use the LinkedIn Insight Tag to measure the effectiveness of our advertising on LinkedIn and to serve relevant ads to LinkedIn members.
  • Microsoft Clarity - a session-replay and behaviour-analytics tool that records anonymised interactions with our website (mouse movement, clicks, scroll patterns) to help us improve the user experience.
  • Zapier - moves data between the systems above so orders flow through production reliably.
  • SingPost - our shipping partner for physical deliveries (Bluetooth cassette speakers) within Singapore and internationally.
  • AI service providers (as and when we adopt them) - for internal editorial assistance such as summarisation or transcription. We select vendors that contractually prohibit training their models on our data.
  • Our corporate group - personal information may be shared with affiliates operating under One Shiok Thing Pte Ltd (including the Yah Lah BUT podcast) for administration and, with your consent, for cross-brand marketing.
  • Professional advisors - lawyers, accountants, and auditors when reasonably required.
  • Authorities - when required by law, subpoena, or court order.
  • Buyers or successors - if Folklory is sold or reorganised, personal information may transfer to the acquiring party, subject to this policy.

We do not sell your personal information to advertisers or data brokers.

8. Cookies and tracking

We use cookies and similar technologies for three purposes:

  • Strictly necessary - required for the site to work (cart, checkout, login). These cannot be disabled.
  • Analytics - to understand how visitors use our site. We use Shopify's built-in analytics, Google Analytics 4, and Microsoft Clarity (session replay and behaviour analytics).
  • Marketing and advertising - to measure the effectiveness of our advertising and show relevant ads on other platforms. This includes the Meta Pixel (Facebook and Instagram), Google Ads conversion and retargeting tags, and the LinkedIn Insight Tag. Each sends information about your visits to our site to the respective platform for ad measurement and targeting. Enabled only where you have consented via our cookie banner. You can opt out at any time through the banner, your browser settings, or - for US residents - through the mechanisms described in Section 17.

You can control non-essential cookies through the banner shown on your first visit, and manage cookies through your browser settings at any time. Blocking cookies may affect site functionality.

9. How long we keep your information

We retain personal information for the periods below. If a legal obligation requires us to keep it longer, we will follow the law.

Data Retention period
Customer account information For the life of the account, plus 12 months after closure
Order and transaction records 7 years (Singapore tax and accounting requirements)
Interview audio - raw recordings Retained on Folklory's secure internal storage indefinitely, unless the Customer or Story Subject requests deletion. We do not re-edit raw recordings after final delivery; storage is for archival purposes only.
Final podcast episode files Retained indefinitely, unless the Customer, Story Subject, or Gift Recipient requests deletion.
Listening page content (comments, likes) For the life of the listening page
Marketing consent records Until consent is withdrawn, plus 3 years for evidence of consent history
Website analytics data 26 months (standard analytics retention)
Customer support communications 3 years from resolution

If a Story Subject dies, the Customer or immediate family may request preservation or deletion of the master recording. In the absence of a request, we retain the final episode.

10. Data security

We take reasonable technical and organisational measures to protect your information, including encrypted transmission (HTTPS), access controls on production systems, hashed passwords, and confidentiality obligations for all staff and contractors.

No system is perfectly secure. If we become aware of a data breach that is likely to result in significant harm to affected individuals, we will notify the Personal Data Protection Commission of Singapore within 72 hours as required by the PDPA (Data Breach Notification Obligation), and notify affected individuals as soon as practicable and where required by law.

If you believe your account has been compromised, contact us immediately.

11. Children and minors

Folklory is not marketed to or intended for children under 13. We do not knowingly collect personal information from children under 13 for our own purposes.

However, some Folklories are commissioned as stories about or for children - for example, a grandparent recording a story for a grandchild, or a parent creating a Folklory about a child's early years. In these cases:

  • The commissioning Customer must be an adult (18 or over in Singapore).
  • The Customer warrants that they have parental or guardian authority over the child whose information is included.
  • We treat information about children with additional care and do not use it for any marketing or analytics purpose.
  • A parent or guardian may contact us at any time to request access to, correction of, or deletion of a child's information.

12. Your rights

Depending on where you live, you have some or all of the following rights over your personal information:

  • Access - request a copy of the information we hold about you.
  • Correction - request that we correct inaccurate or incomplete information.
  • Deletion - request that we delete your information, subject to our legal obligations.
  • Withdraw consent - where we rely on consent (marketing, sensitive content processing), you can withdraw it at any time. Under Singapore PDPA you have a specific right to withdraw consent under Section 16.
  • Portability - request a machine-readable copy of information you provided to us.
  • Object or restrict - object to certain processing or ask us to restrict how we use your information.
  • Complain - lodge a complaint with the Personal Data Protection Commission of Singapore (www.pdpc.gov.sg) or your local data protection authority.

To exercise any of these rights, contact us using the details in Section 15. We may need to verify your identity before responding. We will respond within 30 days, or explain why we need longer.

You will not be discriminated against for exercising any of these rights.

13. International transfers

Folklory is based in Singapore. Some of our service providers (Shopify, Stripe, Klaviyo, Cloudflare, Google) process data in the United States, the European Union, and other jurisdictions.

For transfers of personal data out of Singapore, we comply with Section 26 of the PDPA by ensuring recipients are bound by legally enforceable obligations to provide a standard of protection at least comparable to the PDPA. This is typically achieved through the standard contractual terms provided by our service providers.

Where transfers involve data protected under GDPR, we rely on the European Commission's Standard Contractual Clauses or an equivalent recognised transfer mechanism.

14. Data Protection Officer

Our Data Protection Officer is:

Terence Chia Email: theteam@folklory.com Address: 140 Paya Lebar Road, Singapore 409015

You may contact the DPO directly for any privacy-related question, request, or complaint.

15. Contact us

For any question about this Privacy Policy or your personal information:

  • Email: theteam@folklory.com
  • Phone: +65 9028 6969
  • Post: Folklory, 140 Paya Lebar Road, Singapore 409015

16. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Where changes are material, we will notify you by email (if we have your email) or by prominent notice on our website before the changes take effect.

17. Additional rights for US residents

This section provides additional information and rights for individuals who reside in the United States. It supplements, and does not replace, the rest of this Privacy Policy.

17.1 California residents (CCPA / CPRA)

If you are a California resident, you have the rights set out in the California Consumer Privacy Act as amended by the California Privacy Rights Act.

Categories of personal information we collect. In the last 12 months we have collected the following categories of personal information as defined by CCPA: identifiers (name, email, phone, IP address); customer records (billing and shipping address, payment information); commercial information (purchase history); internet or network activity (browsing behaviour, interactions with our website, Meta Pixel data, Google Ads data, LinkedIn Insight Tag data, Microsoft Clarity session data); geolocation data (approximate location from IP address); audio and electronic information (interview recordings and final podcast episodes for those who sit for an interview); inferences drawn from the above; and, where you sit for an interview, information you may choose to share that qualifies as sensitive personal information under CCPA (e.g. racial or ethnic origin, religious beliefs, health information, sex life).

Sources and purposes. See Sections 3 and 6 of this policy.

Your rights. Subject to verification of your identity, you have the right to:

  • Know what personal information we collect about you and how we use and disclose it.
  • Access a copy of the personal information we hold about you.
  • Delete personal information we hold about you.
  • Correct inaccurate personal information.
  • Opt out of the "sale" or "sharing" of your personal information (see below).
  • Limit the use and disclosure of your sensitive personal information to purposes necessary to provide the goods or services you requested.
  • Not be discriminated against for exercising any of these rights.

"Sale" and "sharing" of personal information. We do not sell your personal information for money. However, our use of the Meta Pixel, Google Ads tags, and LinkedIn Insight Tag may constitute "sharing" of personal information for cross-context behavioural advertising as defined by CCPA. You have the right to opt out of this sharing.

How to opt out of sharing:

  • Click the "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" link in our website footer.
  • Enable the Global Privacy Control (GPC) signal in your browser. We recognise and honour GPC signals as a valid opt-out request from California residents.
  • Contact us using the details in Section 15.

Sensitive personal information. We do not use sensitive personal information (including interview content) for any purpose beyond providing the Folklory service, complying with law, and protecting security. We do not use it for advertising or profiling.

Authorised agents. You may designate an authorised agent to submit requests on your behalf. We will require written proof of authority and may require you to verify your identity directly.

Response time. We will confirm receipt of your request within 10 business days and respond substantively within 45 days (extendable by an additional 45 days where necessary).

17.2 Illinois residents (BIPA)

Folklory's interview recordings capture audio for the purpose of producing a podcast episode. We do not create voiceprints or use recordings as biometric identifiers to identify any individual. Recordings are not analysed by biometric identification systems, are not used to build voice recognition models, are not sold or leased to any third party, and are not used to train artificial intelligence systems.

If you are an Illinois resident and are asked to sit for a Folklory interview, we will obtain your written consent before recording. You may request deletion of your recording at any time.

17.3 Washington and Nevada residents (Consumer Health Data)

Where Folklory interviews touch on medical history, mental health, or other topics that may constitute "consumer health data" under Washington's My Health My Data Act or Nevada's Chapter 603A, we treat that information as sensitive personal information and process it only with your consent for the purpose of producing your Folklory. We do not sell consumer health data and do not use it for advertising or profiling. You may withdraw consent and request deletion at any time.

17.4 Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Rhode Island, Kentucky, Indiana, and other US states with consumer privacy laws

If you reside in a US state that provides consumer privacy rights, you have some or all of the following rights: to access, correct, and delete your personal information; to obtain a portable copy; to opt out of targeted advertising, sale, and profiling; and to appeal a denial of a rights request. To exercise these rights, contact us using the details in Section 15. We will respond within 45 days.

17.5 Notice to parents (COPPA)

Folklory is not directed to children under 13, and we do not knowingly collect personal information online from children under 13 for our own commercial purposes. Where a parent commissions a Folklory that involves information about their child under 13, we rely on the parent's warranty of authority (see Section 11). If you believe we have collected information from a child under 13 without proper authorisation, contact us immediately and we will delete it.

17.6 CAN-SPAM

Our marketing emails include an unsubscribe link, identify us as the sender, disclose their commercial nature, and include a physical mailing address as required by the CAN-SPAM Act.

17.7 Contact for US-specific rights

Use the contact details in Section 15 for any US-specific privacy request. You may also contact your state Attorney General's office to file a complaint.

This policy is drafted for compliance with Singapore PDPA, GDPR/UK GDPR, and major US state consumer privacy laws (CCPA/CPRA, BIPA, MHMDA, and comparable state statutes) where applicable. It does not constitute legal advice. Folklory should have it reviewed by qualified legal counsel in each jurisdiction of substantial customer volume before publication.