BombReel Privacy Policy
1. About this Privacy Policy
This Privacy Policy explains how BombReel ("BombReel", "we", "us" or "our") collects, uses, discloses, stores and otherwise handles personal data in connection with the BombReel mobile application, related websites and services (collectively, the "Service"). BombReel is operated in Singapore and this policy is intended to reflect the requirements of Singapore's Personal Data Protection Act 2012 ("PDPA").
This policy applies to personal data that is in our possession or under our control. It does not replace any additional notice that we may provide at a specific point of collection, for example when requesting camera, microphone, photo-library or social-sharing permissions.
2. Data Protection Officer and Contact
BombReel has designated a data protection contact for enquiries, requests and complaints relating to personal data. You may contact the Data Protection Officer ("DPO") at:
Email: bombreelhq@gmail.com
We may ask for information reasonably necessary to verify your identity before acting on an access, correction, deletion or other privacy request.
3. Personal Data We May Collect
Depending on how you use the Service, we may collect the following categories of personal data:
Account and authentication data. This may include your BombReel user identifier, authentication identifiers and, depending on the sign-in method used, an email address or other information provided through the authentication service.
User-generated media. Videos, audio, thumbnails, images and other media that you record, upload, generate, edit, save or share through BombReel. Such media may contain images, voices or other identifying information relating to you or other people.
Reel and event data. Information associated with reels and events, such as event identifiers, reel references, titles, timestamps, duration, creation details, visibility settings, consent status and other metadata needed to operate the Service.
Your reel state and activity. Information about your relationship with a reel and actions taken in the Service, such as whether a reel is saved, removed, shared or enhanced, selected enhancement labels, share attempts, tap counts, share timestamps and similar interaction information.
Technical and diagnostic data. Depending on the device, operating system and service-provider configuration, BombReel or its service providers may receive technical information needed to operate, secure and troubleshoot the Service, such as device or app information, IP address, error logs, crash information and network-related information.
Permissions and device access. With your permission, BombReel may access the camera, microphone, photo library or local storage to record, create, save, import, export or share media. We use these permissions only for the functions for which they are requested.
Social-sharing and integration data. When you choose to share a reel or use a platform-specific integration, we may process the selected destination, share status and related interaction data. If a future feature allows you to connect a social account, we may receive identifiers, authorisation tokens or other information needed to provide that connection, subject to the relevant platform's terms and your choices.
4. How We Collect Personal Data
We may collect personal data directly from you when you create or use an account, record or upload content, make selections in the app, contact us or otherwise interact with the Service.
We may also collect data automatically through the app and its supporting infrastructure, and may receive data from service providers or third-party platforms when this is necessary to provide a feature you have requested.
5. Purposes for Which We Use Personal Data
We may collect, use and disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances, including to:
provide, maintain and operate BombReel; authenticate users and manage accounts; record, upload, merge, store, play, edit and display reels and related media; provide event, save, remove, restore, sharing and enhancement features; enable sharing to social platforms at your direction; preserve user preferences and app state; troubleshoot errors and maintain reliability and security; prevent misuse, fraud or unauthorised activity; respond to support and privacy requests; measure how features are used and improve the Service; comply with applicable laws, regulatory requirements, court orders and lawful requests; and establish, exercise or defend legal rights.
If we wish to use personal data for a materially different purpose that is not reasonably related to the purposes described above, we will provide any additional notice and obtain consent where required by the PDPA.
6. Consent and Withdrawal of Consent
Where the PDPA requires consent, we will seek consent before collecting, using or disclosing personal data for the relevant purpose. Consent may also be deemed or an exception may apply where permitted by law.
You may withdraw consent for our collection, use or disclosure of personal data by contacting the DPO. We will explain the likely consequences of withdrawal where relevant. Depending on the data and purpose, withdrawing consent may mean that we cannot continue providing some or all of the Service to you.
We will process a valid withdrawal request within a reasonable period and will cease the affected collection, use or disclosure unless continued handling is permitted or required by law.
7. Disclosure of Personal Data
We may disclose personal data only where reasonably necessary for the purposes described in this policy, where you direct or consent to the disclosure, or where permitted or required by law. Recipients may include:
Cloud and technology service providers that support authentication, databases, file storage, hosting, security, diagnostics and other technical functions. BombReel currently uses Google Firebase services for parts of its backend infrastructure.
Social and content platforms, such as TikTok or other platforms selected by you, when you choose to share content or use a platform-specific feature. Once data is sent to a third-party platform at your direction, that platform's own terms and privacy policy will also apply.
Professional advisers, contractors and other service providers who need the information to provide services to BombReel and who are subject to appropriate confidentiality or data-protection obligations.
Government agencies, regulators, law-enforcement bodies, courts or other parties where disclosure is required or permitted by law, or is reasonably necessary to protect legal rights, safety or the integrity of the Service.
We do not authorise service providers to use personal data for unrelated purposes merely because they process data on our behalf.
8. Overseas Transfers
Some of BombReel's technology or social-platform providers may process or store personal data outside Singapore. Where the PDPA's Transfer Limitation Obligation applies, BombReel will take reasonable steps to ensure that transferred personal data receives a standard of protection that is comparable to the protection under the PDPA, for example through legally enforceable obligations, contractual protections or other permitted mechanisms.
9. Children and Young Users
BombReel is currently intended for users aged 13 and above. Users below 13 must not create an account or provide personal data to BombReel unless and until BombReel has implemented a process to obtain valid consent from a parent or guardian.
For users aged 13 to 17, privacy notices and consent requests should be presented in language that is readily understandable. If we have reason to believe that a young user does not sufficiently understand the nature and consequences of the relevant collection, use or disclosure, we may require consent or involvement from a parent or guardian.
Because media recorded at festivals and events may include other young people, users should avoid uploading or sharing content in a manner that unlawfully or inappropriately exposes another person's personal data.
10. Personal Data About Other People
If you upload, record or share content that includes another identifiable person, you should ensure that you are authorised to provide that content and that your use of it is lawful. BombReel may take reasonable steps to respond to privacy complaints or lawful requests concerning such content.
11. Retention and Deletion
We retain personal data only for as long as it is reasonably necessary for the business or legal purposes for which it was collected, or as otherwise permitted or required by law. Retention periods may vary depending on the type of data and how it is used.
BombReel includes a Recently Removed function under which certain user-state information may remain available for restoration for up to 30 days. Removing a reel from your personal view does not necessarily delete underlying media that has already been shared, is part of a shared event experience, or must be retained for a legitimate business or legal purpose.
You may contact the DPO to request deletion of personal data. We will assess the request and cease retaining personal data when it is no longer needed for a business or legal purpose, subject to applicable exceptions. Copies already sent by you to third-party social platforms are controlled by those platforms and may need to be deleted through the relevant platform.
12. Accuracy and Correction
We take reasonable steps to ensure that personal data used to make a decision affecting you, or disclosed to another organisation, is accurate and complete where required by the PDPA.
You may request correction of an error or omission in personal data held by BombReel by contacting the DPO. We will consider and act on valid requests as soon as reasonably practicable, subject to applicable exceptions.
13. Access Requests
Subject to the PDPA and applicable exceptions, you may request access to personal data about you that is in BombReel's possession or under its control and information about how that personal data has been used or disclosed during the period required by law.
We may charge a reasonable fee where permitted by law and will inform you in advance if a fee applies.
14. Security
We use reasonable administrative, technical and organisational safeguards designed to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. Measures may include access controls, authentication, security rules, restricted backend permissions, secure cloud services and other safeguards appropriate to the nature of the data and the Service.
No internet, mobile or cloud service can guarantee absolute security. You should protect your device, account credentials and access to any connected social-platform accounts.
15. Data Breaches
If a personal-data breach occurs, BombReel will take reasonable steps to contain and assess the incident. Where notification is required under the PDPA, we will notify the Personal Data Protection Commission and affected individuals as required by law.
16. Third-Party Services and Social Platforms
BombReel may contain links to, or integrate with, third-party services. When you leave BombReel, share content to another platform or authorise a third-party integration, the third party may collect and use information under its own privacy policy and terms. BombReel is not responsible for the independent privacy practices of third parties, although we will take reasonable steps required by the PDPA when selecting and using service providers that process personal data on our behalf.
17. Website Data and Cookies
If BombReel operates a public website, the website may use essential cookies or similar technologies needed for security, site operation and basic functionality. If we later introduce non-essential analytics, advertising or tracking technologies, we will update this policy and provide notices or choices where required.
18. Changes to This Policy
We may update this Privacy Policy as BombReel develops, as our data practices change, or when legal or regulatory requirements change. We will publish the updated policy and revise the effective date. Where a change materially affects how we use personal data, we will provide additional notice or obtain consent where required.
19. Contact and Complaints
If you have questions, requests or complaints about this Privacy Policy or BombReel's handling of personal data, contact:
Data Protection Officer
BombReel
Email: bombreelhq@gmail.com
We will review privacy complaints in good faith and aim to respond within a reasonable period. If you remain dissatisfied, you may contact Singapore's Personal Data Protection Commission through its official channels.