BruPages Privacy Policy

Effective date: 25 September 2026
Last updated: 25 September 2026

1. Introduction

BruPages is an online business and government agency directory operated by Trex Enterprise in Brunei Darussalam.

This Privacy Policy explains how BruPages (“BruPages”, “we”, “our”, or “us”) collects, uses, stores, discloses, and protects personal data when you visit or use our website, create or manage an account or listing, purchase a service, connect an Instagram or TikTok account, contact our support team, or otherwise interact with our services.

We process personal data in accordance with applicable laws of Brunei Darussalam, including the Personal Data Protection Order, 2025.

2. Information We Collect

2.1 Account and profile information

When you register or manage an account, we may collect:

• First and last name;
• Email address;
• Mobile telephone number and verification status;
• Password in securely hashed form;
• Profile photograph;
• Contact email, address, and website;
• Social media usernames or profile links;
• Account type, role, and permissions;
• Email and mobile verification records; and
• Authentication and account security information.

If you register or sign in using a supported third-party login provider, such as Google or Facebook, we may receive an account identifier and basic profile information authorised by you. We do not receive or store your password for Google, Facebook, Instagram, or TikTok.

2.2 Business and government agency listing information

When a listing is created, claimed, verified, or managed, we may collect:

• Business or agency name and description;
• Category and business information;
• Address and geographic location;
• Telephone number, email address, website, and WhatsApp contact;
• Business hours and branch details;
• Logos, photographs, galleries, and promotional content;
• Verification or claim information;
• Documents submitted to establish ownership or authority;
• Team member roles and invitations; and
• Subscription, advertising, and listing-management information.

Some listing information is intentionally made public as part of the BruPages directory. BruPages may also create listings using publicly available information. Such a listing may remain in the directory as an unclaimed listing unless it is corrected, removed, or claimed in accordance with our procedures.

2.3 Instagram information

When you choose to connect an Instagram account, BruPages may receive and process information authorised through Meta’s Instagram API, including:

• Instagram user or account identifiers, username, account type, and profile image;
• Media count and access permissions granted to BruPages;
• Access token and token expiry information;
• Post and media identifiers, captions, and hashtags;
• Media type, images, video thumbnails, carousel images, and media URLs;
• Permalinks; and
• Publication date and time.

BruPages uses the instagram_business_basic permission to retrieve profile and media information required for the connected-listing feature. Copies of selected Instagram images may be stored on BruPages infrastructure because URLs supplied by Instagram may expire. BruPages does not use this connection to publish, edit, or delete content from your Instagram account.

2.4 TikTok information

When you choose to connect a TikTok account, BruPages may receive and process information authorised through TikTok Login Kit and the TikTok Display API, including:

• TikTok Open ID and, when supplied, Union ID;
• Username, display name, avatar, profile link, biography, and verification status;
• Permissions granted to BruPages;
• Access and refresh tokens and their expiry dates;
• Video identifiers, titles, and descriptions;
• Cover-image URLs, share links, and embed links;
• Video duration and dimensions; and
• Video publication date and time.

Depending on the permissions approved for the BruPages TikTok application, BruPages may request scopes such as user.info.basic, user.info.profile, and video.list.

BruPages uses this information to connect a TikTok account, import video information, and allow the account owner to select videos for display on a BruPages listing. BruPages does not use this integration to publish, edit, or delete videos from your TikTok account.

2.5 Payments and subscriptions

When you purchase a subscription, advertisement, or other paid service, we may collect billing name and email address, transaction amount and currency, subscription plan, payment method, transaction and payment references, payment status, invoice number, bank transfer receipt or payment evidence, and refund or reconciliation information.

Card payments may be processed by third-party payment gateways such as CyberSource or PayPal. BruPages does not store full payment card numbers or card security codes. Where saved-card functionality is enabled, BruPages may store a payment token together with limited card information such as card brand, last four digits, expiry month and year, and cardholder name.

2.6 Communications and support

We may collect information that you provide through contact forms, support requests, emails, feedback, claims and disputes, reviews and review replies, account or listing verification requests, and other communications with BruPages.

2.7 Usage, analytics, device, and security information

When you access BruPages, we may automatically collect:

• IP address, browser and device information, and user-agent information;
• Pages viewed and search activity;
• Listing and advertisement impressions, clicks, and interactions;
• Referral or page-source information;
• Session and authentication records;
• Security and fraud-prevention events; and
• Approximate location derived from an IP address, where enabled.

BruPages uses a randomly generated visitor identifier to distinguish visits, prevent duplicate analytics events, measure listing and advertisement performance, and reduce abuse.

2.8 AI-generated business recommendations

Where the business analytics recommendation feature is enabled, aggregated listing and performance information may be sent to a configured artificial intelligence service, such as Google Gemini or OpenAI, to generate business insights and recommendations. Passwords, payment card details, and social media access tokens are not intentionally included in these requests. AI-generated recommendations may be inaccurate and should be reviewed by the business owner before being relied upon.

3. How We Use Information

We may use personal data to:

• Register, authenticate, and secure user accounts;
• Verify email addresses and mobile numbers;
• Create, claim, verify, publish, and manage listings;
• Display public business and government agency information;
• Connect and synchronise authorised Instagram and TikTok content;
• Allow listing owners to select social media posts or videos for public display;
• Moderate content and enforce our platform rules;
• Process subscriptions, advertisements, payments, and refunds;
• Provide invoices and transaction records;
• Measure listing and advertisement performance;
• Generate business analytics and recommendations;
• Respond to support requests, claims, and disputes;
• Send account, security, subscription, payment, moderation, and service notifications;
• Detect fraud, abuse, automated activity, and security incidents;
• Maintain, troubleshoot, and improve BruPages; and
• Comply with legal, regulatory, accounting, and platform obligations.

We do not sell or rent personal data.

4. Public Information

BruPages is a public directory. Information submitted for publication may be visible to anyone, including people who do not have a BruPages account and search engines.

Public information may include listing name and description, category, address and location, contact details, business hours, website and social media links, logos and photographs, reviews and listing-owner replies, and Instagram posts or TikTok videos selected for display.

Do not submit personal or confidential information that you do not want to be publicly accessible.

5. Instagram and TikTok Connections

Connecting Instagram or TikTok is optional, except where a particular online-only listing requires a supported social account as part of its listing setup. By connecting an account, you direct BruPages to obtain and process the information covered by the permissions displayed during the platform’s authorisation process.

You can stop future access by disconnecting the social account through BruPages, revoking BruPages access from the relevant Instagram or TikTok account settings, or contacting BruPages using the details below.

Disconnecting or revoking access removes the BruPages social connection and associated synced content from BruPages. It does not delete or modify the original content on Instagram or TikTok.

Meta data-deletion and deauthorisation requests are processed through BruPages’ registered Meta callback. TikTok authorisation-removal notifications are processed through BruPages’ registered TikTok webhook.

BruPages is an independent service and is not endorsed by, sponsored by, or affiliated with Meta or TikTok.

6. Cookies and Similar Technologies

BruPages uses cookies and similar technologies for session management, authentication, security, remembered or trusted-device functionality, visitor identification, analytics and performance measurement, advertisement impression and interaction control, and fraud and abuse prevention.

The brupages_visitor_id cookie contains a randomly generated identifier and may remain on your device for up to 12 months. Session cookies generally expire after the configured session period or when otherwise invalidated.

You can block or delete cookies through your browser settings. Some BruPages features may not work correctly if essential cookies are disabled. If BruPages introduces additional advertising or third-party analytics cookies, this Policy and any applicable cookie controls will be updated.

7. How We Share Information

We may disclose information where reasonably necessary to:

• Hosting, database, storage, and infrastructure providers;
• Email and notification providers;
• Mobile verification providers such as Twilio;
• Payment processors such as CyberSource or PayPal;
• Meta, when you connect Instagram;
• TikTok, when you connect TikTok;
• Google or Facebook, when third-party login is enabled and selected;
• Security providers such as Cloudflare, where enabled;
• AI providers such as Google Gemini or OpenAI, where the AI recommendation feature is enabled;
• Professional advisers, auditors, insurers, or contractors;
• Government authorities, regulators, courts, or law-enforcement bodies where required by law; and
• A successor organisation in connection with a merger, restructuring, financing, or sale of the business.

Service providers may process information only for services they provide to BruPages and are expected to apply appropriate confidentiality and security safeguards.

8. International Data Transfers

Some service providers, including social media platforms, payment processors, email providers, hosting providers, and AI providers, may process data outside Brunei Darussalam. Where personal data is transferred outside Brunei Darussalam, BruPages will take reasonable steps to ensure that the transfer is permitted and that the information receives an appropriate standard of protection.

9. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy.

• Account information is retained while the account remains active.
• A deactivated BruPages account normally has a 30-day recovery period before permanent deletion.
• Connected social data is retained while the social account remains connected or until it is deleted or revoked.
• Selected Instagram images stored by BruPages are removed when the relevant social connection or account is permanently deleted.
• TikTok cover images are generally referenced using temporary TikTok-provided URLs rather than permanently stored copies.
• Support, security, and activity records may be retained for operational, fraud-prevention, or legal purposes.
• Transaction and accounting records may be retained where required for financial, tax, audit, dispute, or legal purposes.
• A minimal non-reversible hash and confirmation record may be retained to demonstrate that a Meta data-deletion request was completed.

When a BruPages account is permanently deleted, the associated public business listing may remain as an unclaimed directory entry. Personal ownership links are removed. Certain transaction records may also be retained in a de-linked form.

10. Access, Correction, and Control

Subject to applicable law, you may access personal data associated with your account, correct inaccurate or incomplete information, update your profile or listing, control which imported social posts or videos are publicly displayed, disconnect Instagram or TikTok, withdraw consent where processing is based on consent, ask questions about particular processing, request deletion of personal data, and deactivate your BruPages account.

We may need to verify your identity before completing a request. Certain information may be retained where required by law or necessary for fraud prevention, accounting, disputes, or legal claims.

11. Data Deletion Instructions

Delete or deactivate your BruPages account

Sign in to BruPages, open your account profile, and select the account-deactivation option. After confirmation, the account enters a 30-day recovery period. If it is not restored during that period, it is scheduled for permanent deletion.

Delete Instagram data from BruPages

You may disconnect Instagram from the listing’s social media management page, remove BruPages through your Instagram authorisation settings, submit a Meta data-deletion request, or email us at brupages.bn@gmail.com.

Deleting Instagram data removes the stored access token, synced posts, captions, hashtags, and locally stored Instagram media associated with that connection.

Delete TikTok data from BruPages

You may disconnect TikTok from the listing’s social media management page, revoke BruPages access through TikTok, delete or revoke the connection from your TikTok account, or email us at brupages.bn@gmail.com.

Deleting TikTok data removes the stored tokens, connected profile information, and synced TikTok video records associated with that connection.

Email deletion requests

Send your request to brupages.bn@gmail.com with the subject Personal Data Deletion Request. Please include sufficient information for us to identify the relevant account or listing. Do not send passwords, payment card numbers, or social media access tokens by email.

12. Data Security

BruPages applies reasonable administrative, technical, and organisational safeguards, including encryption of Instagram and TikTok tokens at rest, password hashing, HTTPS transmission, access controls and role-based permissions, request throttling and validation, signed callback and webhook verification, fraud and abuse monitoring, secure payment tokenisation, and monitoring of important security events.

No internet service is completely secure. We cannot guarantee that unauthorised access, loss, misuse, or disclosure will never occur.

13. Children’s Privacy

BruPages is intended primarily for businesses, organisations, government agencies, and individuals with legal authority to manage them. It is not directed at children. If you believe a child has submitted personal data without appropriate authorisation, contact us so that we can investigate and take appropriate action.

14. Third-Party Websites and Platforms

BruPages may link to websites, businesses, payment services, Instagram, TikTok, Google, Facebook, and other third-party services. Their collection and use of information are governed by their own privacy policies and terms. BruPages is not responsible for third-party privacy or security practices.

15. Changes to This Policy

We may update this Privacy Policy when our services, integrations, or legal obligations change. The revised Policy will be published on this page with a new effective date. Where required, we may also provide notice through the website, account dashboard, or email.

16. Contact Us

For privacy questions, access or correction requests, social media data requests, or deletion requests, contact:

BruPages / Trex Enterprise
Email: brupages.bn@gmail.com
Country: Brunei Darussalam