Privacy Policy

Effective date: 21 March 2026

1. Introduction

BandLah! ("the App") is operated by Carta Bianca Technology ("we", "us", "our"). We are committed to protecting your personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA").

2. Data We Collect

2.1 Account Data

Collected when you register:

• Email address
• Password (stored securely; we never see your plain-text password)

2.2 Profile Data

Provided by you during profile setup. This data is shown on your public profile and used for discovery and filtering:

• Display name, profile photo, bio, sample links
• Instruments, genres, experience level
• Location, availability, what you are looking for

2.3 WhatsApp Number

Your WhatsApp number is collected during profile setup. It is not publicly visible. Your number is only shared with another user when both parties have accepted a mutual connection request.

2.4 Connection and Ad Data

Connection requests (including optional intro messages) and ads you post.

2.5 Automatically Collected Data

• Analytics: Usage events (sign-up, profile completion, connections, ads, filters) with a pseudonymous identifier, plus device type, OS version, app version, and approximate location.
• Push notifications: A device token is stored to deliver notifications. Your notification preferences are also stored.
• Activity timestamps: Account creation and last active time.

3. How We Use Your Data

We use your data to operate the App, facilitate connections, send notifications, analyse usage patterns, and enforce our Terms of Service.

We do not sell your data or share it with third parties for marketing.

4. Data Processors

We use Google Firebase (Authentication, Firestore, Storage, Cloud Messaging, Analytics) to operate the App. Data is processed in accordance with Google's Firebase privacy documentation. Our primary storage is in Singapore. Some data may be processed by Google in other jurisdictions as part of their global infrastructure.

5. Data Visibility

• Public to all users: Your profile data (Section 2.2).
• Accepted connections only: WhatsApp number.
• Never shared: Email address, password, device tokens.

6. Data Retention

Your data is retained while your account is active. When you delete your account, your data is permanently deleted. Aggregated analytics data may be retained indefinitely.

7. Your Rights Under the PDPA

Under Singapore's Personal Data Protection Act, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Withdrawal of consent: Withdraw your consent for us to collect, use, or disclose your personal data. Note that withdrawing consent may affect your ability to use the App.
• Deletion: Delete your account and all associated data at any time, or by contacting us.

To exercise any of these rights, contact us at support@bandlah.app. We will respond within 30 days.

8. General

We use industry-standard security measures to protect your data, but no system is completely secure.

The App is not intended for anyone under 18. We do not knowingly collect data from children.

We may update this policy from time to time. The effective date at the top indicates the latest version. Continued use constitutes acceptance.

9. Contact

For questions or to exercise your data protection rights:

Carta Bianca Technology
support@bandlah.app