Privacy Policy
Last Updated: January 1, 2026 • Compliant with Republic Act No. 10173 (Philippine Data Privacy Act of 2012) and GDPR
Executive Summary
BandaRito is committed to protecting the privacy of musicians, band managers, event clients, and music fans. We operate on a minimal data collection principle: we only collect what is strictly necessary to run the platform, we never sell your personal data, and we do not use third-party behavioral advertising trackers.
1. Data Controller
The data controller responsible for your personal information is:
BandaRito Music Technologies
Metro Manila, Republic of the Philippines
Data Protection Inquiries: privacy@bandarito.app
2. Data We Collect (Minimal Data Standard)
We only collect information you voluntarily provide to use BandaRito’s services:
- Account Credentials: Email address, hashed password, and chosen role (Manager, Client, or Fan) for authentication.
- Band EPK Information: Band name, biography, genres, city/region, media links (Spotify/YouTube), and talent fee estimates entered by authorized band managers.
- Booking Inquiries: Contact name, event date, venue city, event type, and budget offered by clients to connect with artists.
- Technical Diagnostics: Strictly necessary session tokens, IP address, and browser user-agent to ensure secure server communication.
Note: We do not store financial account numbers, credit cards, or GCash/Maya PINs. All peer-to-peer talent fee payments occur directly between client and band outside our database.
3. Parental Consent & Minors Policy (Kids Data Protection)
BandaRito respects the privacy of young musicians. Our service is not directed at children under the age of 13.
Minors (Ages 13 to 17):
Any musician or user under 18 years of age residing in the Philippines must obtain verifiable consent from a parent or legal guardian before creating an account, managing an EPK profile, or submitting booking inquiries. Parents and legal guardians can review or request deletion of their child's data at any time by contacting privacy@bandarito.app.
4. Third-Party Sub-processors & SDK Audit
We vet all third-party technical providers to ensure strict security and compliance:
Supabase (PostgreSQL & Auth)
Encrypted database storage and user authentication with strict Row Level Security (RLS).
Vercel & Cloudflare
Edge application hosting, DNS management, and DDoS protection with TLS 1.3 encryption.
Spotify Embed API
Displays official track previews inside sandboxed iframes. Governed by Spotify's privacy policy.
YouTube Embed API
Displays live band video reels with enhanced privacy controls inside sandboxed iframes.
5. Data Retention & Erasure (Right to Be Forgotten)
We retain your personal information only for as long as your account remains active. Under Republic Act No. 10173 and GDPR, you have the absolute right to:
- Request a copy of your personal data held by BandaRito.
- Correct any inaccurate or outdated information.
- Request permanent deletion of your account and EPK data.
To request immediate data erasure, visit our dedicated Data Deletion Request Page or email privacy@bandarito.app. Requests are completed within 30 days.
6. Contact & Regulatory Authority
If you have any questions, feedback, or complaints regarding our privacy practices, please contact our Data Protection Officer at:
Email: dpo@bandarito.app or support@bandarito.app
You also have the right to lodge a complaint with the Philippine National Privacy Commission (NPC) at privacy.gov.ph.
