HS Music Studio · Singapore

How we look after your data

HS Music Studio is a recording studio in Singapore. When you book a session, sign in to our members app, or receive a session card from us, we hold some personal data about you. This page says what, why, who else sees it, and what you can ask of us. It is written to comply with Singapore's Personal Data Protection Act 2012 (PDPA).

Effective 15 September 2026

1. Who we are

This policy covers our website (hsmusic.studio), our members app (members.hsmusic.studio), our session cards (sessions.hsmusic.studio), and the messages we send you about your bookings.

2. What we collect

• Your contact details — your name, email address and mobile number. The mobile number is required for every booking: it is how we send reminders and reach you if anything changes on the day.
• Your bookings — what you booked, when, in which room, how many people, any add-ons, and the song you told us you would like to sing.
• Payment records — what was paid, when, and by which method, so that we can issue receipts and refunds. We never see or store your card number. Card payments are handled by Stripe on Stripe's own pages.
• Your studio balance — credits you have bought or been given, and how they were used.
• Your session card — after a session, we may prepare a card describing your voice (range, voice type, an archetype, a note from the producer), the song, a photo taken in the studio, and links to your finished track and lyric sheet.
• Your birthday (optional) — only if you tell us, so we can give you a birthday credit.
• Sign-in data — if you sign in with Google, Google sends us your name, email address and profile picture. If you sign in by email link, we hold your email address. We do not use passwords.
• Practice and game progress — if you use the ear-training and voice exercises in the app, we keep your scores and streaks so the leaderboard and your progress work.

We do not collect your NRIC, passport or other government identifiers, and we do not use advertising trackers or analytics cookies on these sites.

3. Why we use it

• To take, confirm, remind you about, change and refund bookings.
• To issue receipts and keep the accounting records the law requires.
• To prepare and send you your session card and finished track.
• To run your account: sign-in, your balance, your booking history.
• To contact you about a session — for example if we are running late or a room becomes unavailable.
• Marketing only if you have ticked the box. Agreeing to a booking's terms is not agreeing to be marketed to; the two are separate choices, and you can withdraw from marketing at any time.

4. Google sign-in

If you choose "Continue with Google", we ask Google only for your basic profile — name, email address and profile picture — so that we can create or find your account. We do not ask for, receive, or access your Gmail, contacts, calendar, files, or anything else in your Google account. We use the information Google gives us solely to sign you in and identify your account, in line with the Google API Services User Data Policy, including its Limited Use requirements. We never sell it or use it for advertising.

5. Who else sees your data

We do not sell personal data. We share it only with the services that run our studio, each of which handles it on our instructions:

• Supabase — hosts our database and sign-in, on servers in Singapore.
• Stripe — processes card payments. Stripe has its own privacy policy for the payment details you enter on its pages.
• Cloudflare — serves our websites.
• An email delivery service — sends confirmations, reminders, receipts and session-card links from [email protected].
• Google Calendar — your booking (name, time, room) is written into the studio's own calendar so that our staff know who is coming.
• WhatsApp — when we message you on WhatsApp, the message goes through WhatsApp under its own terms.
• Our accountant — sees receipts and session records (amounts, dates, names) for bookkeeping and tax filing.

We may also disclose data where the law requires it.

6. Your session card is a shareable page

A session card lives at an address that cannot be guessed, and only you and the studio know it. Anyone you give the link to can open it — that is the point of a card you can share. If you would rather your card were not public, or you want the photo removed, tell us and we will take it down.

7. How long we keep it

• Booking, payment and receipt records: at least five years, as Singapore's accounting rules require.
• Your account and session cards: for as long as you have an account with us, or until you ask us to delete them.
• Sign-in and reminder messages: for the period needed to prove they were sent.

8. Your choices and rights

Under the PDPA you may ask us to:

• Show you the personal data we hold about you and how we have used it in the past year.
• Correct anything that is wrong. Your name and mobile number can be changed by you in the app; your email address is the one your sign-in provider verified and can only be changed by us on your request.
• Withdraw consent for marketing at any time — reply to any message, or write to us — and we will stop.
• Delete your account and session cards. We will keep only what the law obliges us to keep (the accounting records above).

Write to [email protected]. We respond within thirty days, usually much sooner.

9. Cookies and local storage

Our sites keep a small amount of data in your browser to remember that you are signed in, your language, and — if you started a booking before signing in — the session you chose, so that you land back on it. None of it is used to track you across other websites, and there are no advertising cookies.

10. Children

Bookings must be made by an adult. If a session is for a child, the booking, the account and the session card belong to the parent or guardian who made it, and the photo on a child's card is taken and published only with that adult's agreement.

11. Security

Data is stored encrypted, in Singapore, and access inside the studio is limited to the staff who need it for your booking. Sign-in is by a link sent to your email or through Google — we hold no passwords that could leak.

12. Changes to this policy

If we change how we use your data in a way that matters, we will update this page and change the date at the top. Continued use of our services after that date means you accept the updated policy.