Privacy Policy

1. Scope

This policy explains how Auxtion collects, uses, discloses, and protects your personal data, in line with Singapore's Personal Data Protection Act 2012 ("PDPA").

It applies to the Auxtion website and web app, and to data we receive from Venues and payment providers in connection with your account.

2. Data Protection Officer

Our Data Protection Officer can be reached through the Help section of your account page, or at the email address published on the Service. Contact them with any question, access request, or complaint about your personal data.

3. What we collect

Account data: email address, display name, password (stored only as a one-way hash by our authentication provider), and the date you signed up.

Usage data: the Venue you select, songs you request and when, tokens purchased and spent, cash codes redeemed, and support tickets you open.

Payment data: the amount, time, and a reference ID from the payment provider. We never receive or store your full card number, CVV, or bank login. Payment providers (Stripe, HitPay) process your payment details under their own privacy policies.

Location: only if you tap "Use my location" to find nearby Venues. Your position is used on your device to sort the list and is not sent to our servers or stored.

Technical data: IP address, browser type, device type, and error diagnostics needed to keep the Service working and secure.

4. Why we collect it (purposes)

To provide the Service: creating your account, holding your token balance, placing your requests in a Venue's queue, and showing Venue staff who requested a song.

To take payment and prevent fraud.

To respond to support requests.

To keep the Service secure, detect abuse, and fix errors.

To send you service emails (sign-up confirmation, password reset, receipts). We don't send marketing email unless you opt in.

To produce anonymised, aggregated statistics (for example, most-requested songs at a Venue). These don't identify you.

5. Who sees your data

Venue staff see your display name next to your requests, so they know who queued what. They don't see your email, balance, or payment details.

Service providers who process data for us, under contract: Supabase (database and authentication, hosted in Singapore), Vercel (hosting), Stripe and HitPay (payments), Spotify (song catalogue lookups — we send search terms, not your identity), and an error-monitoring service (technical diagnostics only).

We do not sell your personal data, and we don't share it with advertisers.

We may disclose data if required by law, or to protect the rights and safety of users, Venues, or the public.

6. Overseas transfers

Your account and wallet data are stored in Singapore. Some providers (payments, hosting edge, error monitoring) may process data outside Singapore. Where that happens we ensure a standard of protection comparable to the PDPA, through contractual commitments with those providers.

7. How long we keep it

Account, wallet, and request history: for as long as your account exists, plus up to 7 years for payment records where tax or accounting law requires it.

Support tickets: 2 years after they're resolved.

Technical logs and diagnostics: up to 90 days.

When you delete your account, personal data is removed from live systems promptly. Payment records that we must keep by law are retained in anonymised or restricted form.

8. Your rights

Access and correction: you can view and edit your name and email in the app. For anything else, ask the DPO and we'll respond within 30 days as the PDPA requires.

Withdrawal of consent: you can delete your account at any time from your account page. Some processing (payment records) continues where the law requires it.

Complaints: contact the DPO first. If you're not satisfied, you can complain to the Personal Data Protection Commission of Singapore.

9. Security

Data is encrypted in transit (TLS) and at rest. Access to production data is limited to the people who need it to run the Service. Passwords are never stored in readable form.

No system is perfectly secure. If a breach affecting you occurs, we'll notify you and the PDPC as the PDPA requires.

10. Cookies and local storage

We use a session cookie to keep you signed in, a cookie remembering the Venue you chose, and browser storage for preferences (reduced motion, explicit-content filter, last bundle). No third-party advertising or tracking cookies.

11. Children

The Service is for adults in licensed venues. We don't knowingly collect data from anyone under 18. If you believe we have, contact the DPO and we'll remove it.

12. Changes

We may update this policy. The date at the top tells you when. Material changes will be announced in the app or by email.