Privacy notice

1. What we collect

• From you: your name, your mobile number, and your birthday (day and month), only if you choose to add it.
• When you use Xianyu Play: the bill totals you add, the amounts of those bills (from our own sales records), your chips, the rewards and vouchers you use, the singers you follow, and when each happened, plus the last day you opened the app (one date, replaced each day).
• From your phone: a sign-in cookie that keeps you signed in, a random device code saved when you add a bill (it says nothing about your phone; it lets us notice one phone adding bills to several accounts), the language you choose, and a few small settings kept in your browser (for example, whether you have already seen a tip).
• If you keep a bottle with us: the drink, how much is left, its number, the dates, and the staff member who recorded it, under your phone number. This applies even if you are not a member yet; when you join with that number, the bottle shows in your app.
• If you turn on chip alerts: the notification address your phone's browser gives us for this app. Nothing else about your phone.
• If you send or take chips by a link: who sent them, who took them, how many and when. The friend sees your first name, and you see theirs.
• If you request a song: the song. The band and our staff see it with your first name.
• If you send us a note after your bill: the note, and whether we may reply on WhatsApp. Only the owner and managers read it; we keep it for a year.
• If you ask your group about a night, or answer a friend's plan: the night, the first name you give and your answer. Anyone with the link sees the first names of who's coming, never a phone number. We delete it a week after the night.

We do not collect your location, contacts or photos, and we never ask for bank card details or ID numbers.

2. Why we use it

• To run your membership: to recognise you, credit chips for your bills, and let you use rewards, vouchers and your birthday treat.
• To send your sign-in code by SMS.
• To text you when chips from a bill land, if you don't have app alerts on (you can say no under Me).
• To keep the programme fair: to stop the same bill being claimed twice, and to look into problems.
• To send you offers, by app alert or SMS, only if you said yes. You can change this at any time in the app (Me → Offers from Xianyu).
• To understand, in totals, how the programme is used.

3. Who sees it

• Our staff, only as far as they need to serve you. At the counter they see your name, the last four digits of your number and your chips, but never your birthday.
• Companies that run services for us: the SMS provider that sends your codes and messages, and the provider that hosts our systems in Singapore. They may only use your data to provide those services to us. Singapore has its own personal data protection law.
• Your phone's push service (Apple, Google or your browser's maker), only if you turn on chip alerts. The alert is encrypted, so they cannot read it.
• If you tip a staff member from Tip the team, you pay them straight from your own e-wallet. We never see the payment. If you then tap “Let them know it's from you”, the person you tipped and our staff see your name.
• Authorities, when the law requires it.

We do not sell your data.

4. Required or optional

Xianyu Play is for people aged 18 and over. Your name and mobile number are needed to be a member; without them we cannot run your account. Your birthday is optional; without it you simply won't get the birthday treat. Offers are optional too.

5. How long we keep it

We keep your data while you are a member. If you ask us to close your account, we delete your name, number and birthday, and keep only the anonymous records of bills and rewards that we need for our accounts. If you don't use Xianyu Play for two years, we close your account the same way. A phone number that asks for a sign-in code but never joins is deleted after a day. Records of staff actions are kept for seven years. A phone's notification address is deleted when you turn alerts off, when you sign out on that phone, when it stops working, or when you close your account. A kept bottle's record, with the phone number it was kept under, is deleted 90 days after the bottle is collected or cleared.

6. Your rights

You can ask us for a copy of the personal data we hold about you, in a common format you can take elsewhere, ask us to correct it, ask us to stop sending you offers, or ask us to close your account. Ask any manager at the bar, or contact our data protection officer at +60 12-652 2885. We reply within 21 days.

If you are not happy with our reply, you can contact the Personal Data Protection Department (JPDP).

7. Keeping it safe

Your sign-in codes are never stored in a readable form, staff actions are recorded, and only staff who need them can see member details.

If a breach of our systems puts your data at risk, we will tell the Personal Data Protection Commissioner and, where it could harm you, tell you too.

8. Changes

If we change this notice, we will update the date above and tell you in the app.