Privacy Policy

This policy applies to everyone whose personal data bash handles: the operators and staff of the studios, gyms, and boxes that use bash to run their business, and the members who train at those venues and use bash to book and pay. It applies to the bash web app, the member apps, and joinbash.app.

Account and identity: the email address you sign in with, your name, and the basic profile Google or Apple share (your name and email) if you choose to sign in that way. A phone number where you provide one.

Operator and business data: for the people who run a venue, this covers the business name, your role, and the business and payout details needed to accept payments (such as a business registration number and the payout account identifiers held by our payment provider).

Member profile: what a venue records to run your membership. This covers your name, contact details, date of birth, emergency contact, and the status of any waiver or health acknowledgement you sign.

Activity: schedules, class bookings, cancellations, attendance and check-ins, and credit and membership balances.

Payments: the amount, date, currency, reference, and status of a transaction. Full card or bank details never reach bash. They are captured by our payment provider on its own secure systems (see the “Who we share data with” section).

Technical and device data: IP address, device and browser type, app version, diagnostic and security logs, and a device push token if you enable push notifications.

Cookies: strictly-necessary cookies to keep you signed in and your session secure (see the “Cookies” section).

To run the service: create and secure your account, show schedules, take bookings, track credits and memberships, and process payments.

To communicate with you: send the service messages you need, such as sign-in links, booking confirmations, receipts, and important notices. Your venue may email you news and offers. Your venue may use your bookings and attendance, your membership, credits and packs, how long you have been a member, and the emails it has already sent you, at that venue, including bookings made through booking partners, to choose which of its offers it sends you. Every email has an unsubscribe link, and you can opt out at any time.

To keep bash safe and working: authenticate you, prevent fraud and abuse, diagnose problems, and protect the platform and its users.

To meet our obligations: bookkeeping, tax, and legal or regulatory requirements.

We do not sell your personal data, and we do not use it for third-party advertising.

We collect, use, and disclose personal data with your consent; on the basis of consent deemed given under the PDPA when you provide data to make a booking or run your membership; or where the PDPA otherwise permits, for example to complete a transaction you asked for, for legitimate business purposes carried out in a reasonable manner, or to comply with the law. You may withdraw consent as described in the “Your rights” section.

Your venue: if you are a member, the operator and staff of the venue you train at can see the member data needed to run your membership. bash keeps every venue’s data strictly separated, so one venue can never see another venue’s members.

Our service providers process data only on our instructions and under their own security and privacy commitments. They are Supabase for hosting and database (data stored in Singapore, AWS ap-southeast-1); HitPay for payments, which captures and processes card and bank details on its own systems; Google and Apple for sign-in, if you choose them; Google Firebase Cloud Messaging for push notifications; Resend for email delivery; and OpenAI, Anthropic, and Google as AI providers, as described in the “AI features” section below.

Legal and safety: authorities, regulators, or professional advisers where the law requires it, or to protect the rights, safety, and integrity of bash and its users.

Business transfers: if bash is involved in a merger, acquisition, or sale of assets, personal data may transfer to the successor, which will remain bound by this policy.

bash uses AI to help venues with their own work, for example drafting a workout, summarising a class, or answering an operator’s question about their own venue, such as which members have not trained recently. To do this we send the relevant data to an AI provider, which processes it and returns a result.

Where a request involves member data, we send it only to providers cleared for that purpose, currently OpenAI, Anthropic, and Google. They act on our instructions, and we do not permit them to use your data to train their models. Requests that involve no member data may also use other providers.

A venue may also connect bash to its own AI assistant (for example Claude or ChatGPT) so it can ask questions about its venue in that tool. When a venue does this, the answers can include member names and attendance, and that data is sent to the provider the venue has chosen, under that venue’s own account and its agreement with that provider. A venue can only ever reach its own data this way, and the connection can be revoked at any time. The assistant can read that data and, where the venue chooses, make changes on the venue’s behalf, for example drafting or publishing a workout, or updating the venue’s own records. Changes are shown for confirmation before they are made.

We never sell your data, and we never use it to train a model of our own.

For your relationship with bash, meaning your sign-in account and your use of the platform, bash is the organisation responsible for your data.

For the member data a venue records to run its own business, the venue is responsible for that data and bash handles it on the venue’s behalf and instructions. If you are a member and want your data corrected or removed, your venue is usually the fastest route; you can also contact us and we will help.

bash stores data with our database provider in Singapore (AWS ap-southeast-1), encrypted in transit and at rest. Some service providers (for example sign-in, email, and push notifications) may process limited data outside Singapore; where they do, we rely on their contractual and security commitments to protect it to a standard comparable to the PDPA.

We protect personal data with encryption in transit and at rest, strict per-venue isolation enforced at the database level, encryption of sensitive secrets (such as a venue’s payout keys) using a dedicated key-management service, and access limited to what is needed to run the service. No system is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong.

If a data breach occurs that is likely to result in significant harm to affected individuals, or affects a significant number of individuals, we will notify the Personal Data Protection Commission and the affected individuals as the PDPA requires.

We keep personal data for as long as your account or membership is active, and afterwards only as long as we need it for the purposes described here or to meet bookkeeping, tax, and legal obligations. We then delete or anonymise it.

Under the PDPA you can ask what personal data we hold about you and how we have used or disclosed it, ask us to correct it, ask us to delete your account and the personal data we hold about you, and withdraw your consent to our use of it. Withdrawing consent or requesting deletion may mean we can no longer provide part of the service, and we may need to keep certain records where the law requires (see “How long we keep it”). For member data your venue controls, a deletion request may need to go through your venue. To make a request, contact us using the details below; we will verify your identity and respond within 30 days, telling you if we need longer.

bash uses strictly-necessary cookies to sign you in and keep your session secure. We do not use advertising or cross-site tracking cookies.

bash is not directed at children. Where a venue enrols a minor, the venue is responsible for obtaining any parental or guardian consent required and for the accuracy of that member’s data.

We may update this policy as bash evolves or the law changes. We will post the updated version here with a new “last updated” date and, where changes are material, tell you in an appropriate way.

Questions, requests, or complaints about your personal data, including any request to access, correct, or withdraw consent, can be sent to our Data Protection Officer at data@webreakdesks.com. If you are a member, you can also ask your venue. If you are not satisfied with how we have handled your request, you can raise it with Singapore’s Personal Data Protection Commission (PDPC).