Privacy Policy

This Privacy Policy explains information practices for the official Mr. Blindbandit website and Blindbandit Records public services. It covers public pages, authentication, community participation, contact and submission forms, newsletters, advertising, browser utilities, and Media Suite features. A separate notice applies to the invitation-only label portal.

The website is operated by Kaeleb Savon Heck, professionally known as Mr. Blindbandit, in connection with Blindbandit Records. Postal contact: Purok 6-A, Mabuhay, Barangay Capungagan, Davao del Norte 8113, Philippines. Philippine telephone: +63 962 695 4905. United States telephone: +1 540 926 9791.

Kaeleb Savon Heck serves as Data Protection Officer / Privacy Officer for the website. Privacy questions and rights requests should be sent to [email protected]. Legal notices may be sent to [email protected].

This Policy covers information processed through mrblindbandit.net public pages and features under the operator’s control. Third-party destinations, streaming platforms, payment services, identity providers, and embedded services have their own privacy practices. The private label portal has a supplemental notice because it handles additional contractual, royalty, messaging, and client records.

Depending on the feature, the service may process names, artist or organization names, email addresses, telephone numbers voluntarily included in a message, account identifiers, display names, profile details, community posts and comments, poll responses, timestamps, music metadata, project descriptions, listening links, uploaded submission files, support messages, consent choices, accessibility and browser preferences, device and browser information, IP addresses, security and authentication events, rate-limit data, referral information, advertising request information, and records needed to document a request or legal obligation.

The service does not intentionally request passwords, complete payment-card numbers, banking credentials, government identity numbers, or highly sensitive personal data in ordinary public forms. Do not place that information in a public post or an unsolicited message.

Information comes from visitors, account holders, people making submissions or inquiries, authorized label administrators, service providers performing authentication or delivery functions, ordinary browser/network requests, public professional links intentionally submitted for review, and security or moderation events generated by use of the service.

The operator does not ask a user to provide personal data obtained unlawfully or private information about another person without authorization.

Demo and project submissions may include contact details, project metadata, ownership or permission confirmations, listening links, messages, and optional audio. They are used to receive, secure, organize, evaluate, and respond to the submission; prevent fraud or abuse; document permission; and preserve records needed for an active negotiation or dispute. A submission does not enroll the sender in unrelated marketing.

Information in a professional inquiry is used to understand the proposal, verify or communicate with the sender, evaluate availability and fit, negotiate terms, prevent abuse, document decisions, and keep records reasonably needed for business and legal purposes. Sending an inquiry is not acceptance of a booking, license, partnership, endorsement, or contract.

Community display names, posts, comments, poll choices where displayed, and posting times may be public. Public contributions can be indexed or copied by others. Reports, moderator notes, account identifiers, enforcement history, and security signals are restricted to authorized processing except where disclosure is legally required.

Do not post home addresses, private phone numbers, passwords, financial credentials, government identifiers, intimate information, or another person’s personal data without authorization.

Clerk and configured identity providers may process identifiers, email addresses, profile information, device data, cookies, login events, multifactor settings, and fraud signals according to their role and configuration. Community and label-portal permissions are separate even when related authentication technology is used.

Passwords and secret authentication keys should never be sent through ordinary email or community posts.

Blindbandit Mobile is the social area of this website. When you use it we process your profile (handle, display name, photo, bio and optional details), the posts, comments, reactions and image descriptions you publish, who you follow, mute or block, your bookmarks and drafts, and notification settings.

Public content. Posts, comments and public profiles can be seen by anyone, including people who are not signed in, and may be indexed by search engines.

Direct messages. Messages are stored on our servers so you and the other person can read them on any device. They are not end-to-end encrypted. Authorized moderators can review a message only when it is reported or needed to investigate abuse, security or a legal request. Messages are never used for advertising.

Voice and video calls. Calls are connected through LiveKit, our real-time communications provider. We store call records (who called whom, when, call type and status), not call audio or video. The calling software is loaded from the jsDelivr content-delivery network. Your browser asks for microphone and camera permission before a call starts.

Notifications. If you allow push notifications, we store an encrypted device token so we can deliver alerts through your browser’s push service, Apple Push Notification service or Firebase Cloud Messaging. You can turn notifications off in your device or browser settings.

Safety tools. When you report content, we store the report, the reason you choose and any details you add. Blocking someone stops messages, calls, follows and comments between you and hides their posts from your feed. Moderation actions are logged. Read the Community Guidelines and the Mobile Trust & Safety page.

Supported Media Suite tools process the files you select locally in your browser unless the tool clearly tells you otherwise before processing starts. This includes conversion, clipping, silence trimming, waveform and loudness analysis, normalization, metadata editing, artwork resizing, audiograms, art tracks and lyric videos.

When a file is processed locally, it is not uploaded to Blindbandit Records. Your browser may still download software components, fonts, libraries or codecs from this website or from jsDelivr, which receives ordinary request information such as IP address, browser details and time of request.

No Media Suite tool currently uploads your media for cloud processing. If that ever changes, the tool will say so before any file leaves your device and this Policy will be updated first.

Accessibility preferences, planner state, checklist state, privacy choices, and certain utility settings may be stored locally on the device. Local storage remains until cleared by the user, browser, site code, or an applicable expiration rule. Clearing browser data can reset those settings.

This website may show Google AdSense advertising on a limited set of long-form public pages, such as Chronicle articles and essays. Ads never appear on account, sign-in, payment, messaging, calling, notification, community, search, policy, contact or form pages. Advertising is currently switched off; it will only run after a Google-certified consent platform is active and you allow advertising in Privacy Choices.

Ezoic is also configured as an optional advertising provider on eligible editorial pages. Its advertising code follows the same site advertising switch and verified consent-platform requirement, and loads only after you allow advertising. Optional Ezoic analytics additionally require your analytics choice. If these features are enabled, Ezoic may receive IP addresses, device and browser information, page visits and advertising interactions, and may use cookies or similar storage. Withdrawing a choice reloads a page that has started the corresponding provider. Read the Ezoic Privacy Policy. These optional Ezoic features are currently disabled.

When advertising is active, third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. Google and its partners may also receive your IP address, device and browser information, and the ad requests and interactions on the page, to deliver, limit, measure and protect advertising.

You may opt out of personalized advertising by visiting Google My Ad Center (or Ads Settings). You can opt out of some third-party vendors’ use of cookies for personalized advertising at www.aboutads.info and, in Europe, www.youronlinechoices.eu. Read How Google uses information from sites or apps that use its services. Opting out of personalization does not remove all ads; non-personalized ads still use limited data for frequency capping, reporting and fraud prevention.

We do not send private messages, uploaded demo audio, private label records, passwords or form contents to Google for ad targeting.

We use Google Analytics 4 to understand which pages are visited and how the site performs. In the United States and other regions outside the European Economic Area, the United Kingdom and Switzerland, it runs by default and you can opt out at any time by unticking “Allow Google Analytics measurement” in Privacy Choices or choosing Reject all. In the EEA, the UK and Switzerland, it only sets cookies after you opt in. We use Google Consent Mode, so until analytics is allowed Google receives only cookieless measurement signals. It is always off when your browser sends a Global Privacy Control signal, and it is not used on account, sign-in, portal, payment or Blindbandit Mobile pages.

Google Analytics sets the cookies _ga and _ga_<ID> and receives page addresses (with query strings and fragments removed), page titles, approximate location derived from IP address, and device and browser information. Learn more in How Google uses information from sites or apps that use its services and install the Google Analytics opt-out browser add-on if you want to block it everywhere.

Advertising is off by default. For visitors in the European Economic Area, the United Kingdom and Switzerland, ads will only be shown through a Google-certified consent management platform that asks for your choice first; that platform is not active yet, so no ads are shown. The site’s own Privacy Choices dialog lets you decline advertising, analytics and embedded media at any time, using the Privacy Choices button in the page footer.

Account authentication, service delivery, requested communications, submission review, and steps requested before entering a contract may be processed because they are necessary to provide a requested feature, take requested pre-contract steps, perform an agreement, or pursue legitimate operational interests where permitted.

Security logging, abuse prevention, moderation, access control, audit trails, service integrity, accessibility improvement, and fraud prevention may rely on legitimate interests, legal obligations, contract necessity, or another lawful basis appropriate to the jurisdiction.

Optional marketing generally relies on consent or another legally permitted direct-marketing basis, subject to the right to unsubscribe or object. Advertising personalization and non-essential cookies use consent where required. Legal records may be processed to comply with law, establish or defend claims, preserve evidence, or meet contractual and accounting duties.

Where consent is the applicable basis, consent can be withdrawn for future processing. Where legitimate interests are relied on, the operator considers the purpose, necessity, and impact on the individual and provides objection rights where applicable.

Relevant providers can include website and Cloudflare-backed infrastructure, databases and storage, Clerk and connected identity providers, transactional-email services such as Resend, form providers, Google for advertising, Spotify, Apple Music, YouTube and other media platforms, content-delivery networks such as jsDelivr for optional browser software, and payment providers such as PayPal and Wise for off-site transactions.

Providers receive only the information reasonably related to the function they perform, subject to provider terms, settings, legal requirements, and contractual safeguards appropriate to their role. Information may also be disclosed to professional advisers, courts, regulators, law enforcement, emergency recipients, or transaction successors when legally permitted and reasonably necessary.

The site uses a small number of cookies and browser-storage entries. Essential ones keep you signed in, protect payments and accounts, and remember choices you make, such as accessibility and privacy settings. Advertising and embedded players are only loaded after you allow them in Privacy Choices. Google Analytics runs by default outside the European Economic Area, the United Kingdom and Switzerland (for example, in the United States), and you can opt out in Privacy Choices; in those European regions it needs your opt-in. Analytics and advertising stay off when your browser sends a Global Privacy Control signal.

The Cookie and Storage Notice lists each cookie and storage entry, who sets it, why and for how long. Blocking or deleting cookies in your browser can sign you out or reset your preferences.

This site treats Global Privacy Control as a refusal of optional advertising and analytics in its first-party privacy controls. It does not claim control over independently visited third-party websites. Legacy Do Not Track does not change the site’s settings. You can also reject optional processing through Privacy Choices.

We keep personal information only as long as it is needed for the purpose it was collected for, for an active account or relationship, for security and abuse prevention, or to meet legal, contractual, accounting, tax or royalty obligations and to handle disputes.

In practice, rejected demo media and temporary technical files are kept for shorter periods, support and moderation records for moderate periods, and contracts, royalty, tax and accounting records for as long as the law requires. Backups can keep deleted information for a limited rolling period before they are overwritten.

When information is no longer needed and no legal duty requires us to keep it, we delete or anonymize it. If you ask us to delete information we are legally required to keep, we will tell you and delete the rest.

The website may use service providers or infrastructure located in countries other than the visitor's country. This can result in information being processed in the Philippines, United States, or other locations in which a configured provider operates.

Where a jurisdiction requires a transfer mechanism or additional safeguard, the operator will use an applicable lawful mechanism, contractual protection, provider arrangement, consent where valid, necessity exception where lawfully available, or another authorized method. The service will not falsely claim that a particular transfer mechanism is in place unless it has actually been implemented for the relevant vendor and data flow.

The site uses HTTPS, server-side role checks for portal data, rate limits on relevant requests, audit records for administrative changes and provider-managed Clerk authentication. Use available multifactor authentication and protect your devices. No internet service can guarantee complete security. Report suspected vulnerabilities privately to [email protected].

Depending on where you live, you may have the right to access, correct, delete, restrict or port your information, to object to processing, to withdraw consent, and to receive information about how your data is used. Some rights have legal exceptions.

Send requests to [email protected] or use the privacy request form. We will only ask for the information we need to confirm who you are or that you are authorized to act for someone else, and we keep a record of each request and how it was answered.

You will not be treated differently for exercising a privacy right.

Where the Philippine Data Privacy Act and related rules apply, data subjects may exercise applicable rights recognized under Philippine law and may contact the Data Protection Officer at [email protected].

A person who believes Philippine data-protection rights have been violated may also have the right to lodge a complaint with the National Privacy Commission of the Philippines. The operator encourages direct contact first when practical so a concern can be investigated promptly, but this does not remove a person's right to contact a competent regulator.

Where the GDPR, United Kingdom GDPR, or comparable European privacy law applies to a particular processing activity, individuals may have rights including access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a competent supervisory authority. Where processing is based on consent, withdrawal applies prospectively. Where direct marketing is based on a legally permitted basis, an objection to direct marketing will be respected as required by law.

The operator does not claim that every European privacy regime applies merely because the website can be opened from Europe. Territorial scope depends on the facts, including establishment, targeting, offering goods or services, or monitoring where relevant.

Some United States state privacy laws apply only to businesses above certain size or data thresholds. Where one of these laws applies to us, we will honor your rights to know, access, correct and delete information, to opt out of the sale or sharing of personal information or targeted advertising, and to use an authorized agent.

We do not sell personal information for money. Some state laws treat personalized advertising cookies as “sharing”. You can opt out at any time by declining advertising in Privacy Choices, and we treat a Global Privacy Control signal as an opt-out of advertising and analytics.

The website and Blindbandit Mobile are not directed to children under 13. People under 13 may not create an account, post or comment, send messages or make calls, subscribe to marketing, or submit music. If we learn that we collected personal information from a child under 13 without valid parental authorization, we delete it and close the related account.

Older minors may need a parent’s or guardian’s permission under local law. A minor cannot sign a recording, licensing, booking or release agreement without a parent or legal guardian taking part.

The Child Safety Policy explains our safety and reporting rules.

We only send newsletters or promotional email to people who signed up or where the law otherwise allows it. We keep a record of your address, how and when you signed up, and your consent or unsubscribe status.

Every marketing email includes a way to unsubscribe, and we honor unsubscribe requests promptly and within the time the law requires. We keep a minimal suppression record so an address that opted out is not added again. Account, security, payment and other transactional messages are not marketing.

We do not make decisions that have legal or similarly significant effects on you solely by automated means. Automated tools help with spam filtering, security, abuse and fraud detection, rate limiting and organizing content.

On Blindbandit Mobile, a post that several different people report is automatically hidden from public feeds until a moderator reviews it; a person, not an algorithm, decides whether it is removed or restored. You can appeal moderation decisions through Content Reports and Moderation Appeals.

If we suspect that personal information was accessed, disclosed, lost or changed without authorization, we contain the incident, preserve evidence, assess who and what was affected, and notify regulators and affected people where the law requires — including within the 72-hour framework that applies to qualifying breaches under Philippine rules. We keep records of incidents even when no public notice is required.

Report security concerns privately to [email protected]. Please do not include unnecessary personal information or run destructive tests.

Material changes will be reflected by updating the effective or last-updated date and, where required, by providing additional notice or renewed consent. A change to this Policy does not retroactively create a lawful basis that did not exist when information was collected.

Privacy and data-rights contact: [email protected]. Legal contact: [email protected]. Security contact: [email protected]. Postal contact: Purok 6-A, Mabuhay, Barangay Capungagan, Davao del Norte 8113, Philippines.