Privacy Policy and PDPA Notice

Effective 21 October 2026

Music Karkis is a music community for musicians in Singapore, operated by Shiokz Studioz (“we”, “us”). We take your privacy seriously and handle personal data in line with Singapore’s Personal Data Protection Act 2012 (the “PDPA”). This notice explains what personal data we collect, why, who sees it, how long we keep it, and how you can exercise your rights.

By creating an account or using Music Karkis, you agree to the practices described here.

1. Personal data we collect

Account data. Your email address, password (stored only in scrambled form, never in plain text) and display name.

Musician profile. Your bio, instruments and skill levels, genres, what you are looking for, commitment level, area of Singapore, nearest MRT station, availability, whether you have transport or your own gear, languages, influences and links to your playing. You choose what to fill in.

Private particulars (optional). Your full name, mobile number and date of birth. We use your date of birth to calculate your age.

Content you create. Forum threads and replies, gig posts and applications, marketplace listings and photos, match invitations, and messages you send in chats.

Technical data. Your IP address, browser and device type, and basic usage logs, collected automatically when you use the site, to keep it working and secure.

2. How we use your personal data

• To create and verify your account and keep it secure.
• To run Musician Mix/Match and Musician Search: scoring matches, showing your public profile to other members, and sending and delivering invitations.
• To let you post and reply in the forum, advertise or apply for gigs, and buy or sell on the marketplace.
• To open group chats and send you notifications about invitations, matches and messages.
• To send service emails such as verification links and password resets.
• To moderate content, investigate reports, and prevent spam, scams and abuse.
• To understand, in aggregate, how the site is used so we can improve it.
• To comply with the law and respond to lawful requests from authorities.

We do not sell your personal data. We will not send you marketing messages unless you give us separate consent to do so, and you can withdraw that consent at any time.

3. Consent

We collect, use and disclose your personal data with your consent, given when you register and when you tick the consent box on your profile. Where the PDPA allows, we may also rely on legitimate interests (for example, keeping the site secure) or legal obligations. You may withdraw your consent at any time (see section 9).

4. What other members can see

Members who are signed in can see your display name, bio, instruments and levels, genres, what you are looking for, commitment level, area, nearest MRT, availability, languages, influences and playing links. You can switch off “I am open to being matched” on your profile to hide yourself from matching and search. Content you post in the forum, on the gig board and in the marketplace can be viewed by anyone, including visitors who have not signed in.

Never shown to other members: your email address, full name, mobile number, date of birth and age. Chat messages are visible only to the people in that conversation and to us if needed to handle a report or a legal request.

5. Who we share data with

We share personal data only as needed to run the service:

• Supabase, our database, sign-in and file storage provider. Our database is hosted in Singapore.
• Vercel, which hosts the website and may process request data on servers in different countries.
• Email delivery services that send our verification and notification emails.
• Authorities and advisers where required by law, court order or to protect rights and safety.
• A successor, if the service is sold or merged, on the condition that your data stays protected under this notice.

These providers may only use your data to serve us. If personal data leaves Singapore, we make sure it receives a standard of protection comparable to the PDPA, for example through contracts with the provider.

6. How long we keep it

We keep your personal data while your account is active. You can delete your account yourself at any time under Profile → Delete my account. This immediately and permanently removes your profile, posts, listings, photos and messages, and signs you out. Copies in our encrypted backups are overwritten within 30 days. We may keep limited records for longer where the law requires it or to handle abuse reports and disputes, for no more than 12 months after deletion. Technical logs are kept for a short period, normally under 90 days.

An administrator can deactivate an account that breaks our rules or delete it on request. A deactivated account is signed out, cannot sign in and is hidden from search and matching, but nothing is deleted until the account is deleted.

7. How we protect it

• All traffic to the site is encrypted with HTTPS.
• Passwords are stored in scrambled form by our sign-in provider.
• Database access rules ensure members can read only the data meant for them. Private particulars can be read only by the account owner.
• We limit who on our side can access personal data. Only the site administrator can view member particulars, and every such access, deactivation, deletion and download of member data is recorded in an activity log kept for up to 12 months.

No online service can be completely secure. Please use a strong, unique password and do not share it. If we suffer a data breach that is likely to cause you significant harm, or that affects 500 or more people, we will notify the Personal Data Protection Commission and affected individuals as the PDPA requires.

8. Cookies

We use only strictly necessary cookies to keep you signed in and secure your session. We do not use advertising or third-party tracking cookies. If we add analytics later, we will update this notice first.

9. Your rights

• Access. Ask for a copy of the personal data we hold about you and how it has been used in the past year. We respond within 30 days.
• Correction. Edit most details yourself under Profile. For anything else, ask us and we will correct it as soon as practicable, normally within 30 days.
• Withdrawing consent. Tell us you want to stop us using your data for any purpose. We will confirm what this means for your use of the service and act on your request within 10 business days. If you withdraw consent we need to run your account, we will have to close it.
• Deletion. Delete your account yourself under Profile → Delete my account, or ask us to do it (see section 6).

To make any request, email our Data Protection Officer at the address below from the email address registered to your account. We may need to confirm your identity first.

10. Children

Music Karkis is not intended for anyone under 13, and we do not knowingly collect their data. If you are under 18, please make sure a parent or guardian is comfortable with you using the site. If we learn we have collected data from a child under 13 we will delete it.

11. Accuracy and third-party links

Please keep your details accurate and up to date. Posts and listings may link to other websites. We are not responsible for how those sites handle your data, so check their policies.

12. Changes to this notice

We may update this notice from time to time. The effective date at the top shows when it last changed. If the changes are significant, we will tell you on the site or by email before they take effect.

13. Contact us and complaints

Data Protection Officer, Shiokz Studioz
Email: shiokzstudioz@outlook.com

If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

This notice is governed by the laws of Singapore. See also our Terms of Use.