Privacy Policy

When you register with a band (as a reveler), that band is responsible for your registration data: it decides what it needs and how it uses it to run its band. MasBandIQ stores and processes that data on the band's behalf, following the band's instructions and this policy. Questions about how a band uses your registration should go to the band first; you can also contact us and we will help.

For band and staff accounts, the MasBandIQ website and our own emails, MasBandIQ is responsible for your data.

Contact us at masbandiq@gmail.com or through masbandiq.com/support.

Account: your name, email address and password (stored only as a secure hash). If you use two-step verification, a secret for your authenticator app.

Reveler profile: name, email, phone, address and country, gender, profile photo, and optionally your age range, emergency contact and how you heard about the band.

Registration: the band and carnival, your section and costume, styles, sizes, upgrades and add-ons, pickup or delivery details, and optionally your social media handles, display name and crew. If a band asks for them, fit and comfort details you choose to give (for example allergies or accommodations you need) are treated as sensitive and shown only to the band staff who need them.

Payments: amounts, payment plan, payment method, references and any proof of payment you upload. Card payments are handled by Stripe; your card number goes straight to Stripe and is never stored by MasBandIQ or the band.

Bands and staff: organization and band details, staff names, emails and roles, and the carnival, costume and pricing information the band publishes.

Messages and support: what you send us through the support form or by email.

Technical: sign-in cookies that keep you logged in, and server logs (such as IP address, browser and time of request) used for security and to fix problems. We do not use advertising cookies or sell tracking data.

• To provide the service you asked for (performing a contract): creating your account, processing your registration, taking and recording payments, holding your costume and sending you confirmations and receipts.
• With your consent: optional profile details, and news and offers by email. You can withdraw consent at any time; unsubscribe links are in every marketing email.
• Legitimate interests: keeping accounts and payments secure, preventing fraud, supporting bands and improving MasBandIQ.
• Legal obligations: keeping financial records and responding to lawful requests.

We contact bands that are not yet customers about MasBandIQ by email; every such email has an unsubscribe link, and we stop when asked.

• The band you register with and its authorized staff (owners, managers, registration staff and section leaders), each seeing only what their role needs.
• Service providers that run MasBandIQ for us under contract: Supabase (database and file storage), Vercel (hosting), Stripe (card payments) and Resend (email delivery).
• Authorities where the law requires it.

We do not sell your personal data.

MasBandIQ's data is stored in the United States by the providers above. When your data is transferred outside Barbados, we rely on our providers' contractual commitments and security measures so that it receives a level of protection comparable to the Data Protection Act, 2019.

• Your account: until you ask us to delete it.
• Registrations and payment records: for as long as the band needs them for its carnival and for financial record-keeping as required by law, then deleted or anonymized.
• Proofs of payment: until the payment is verified and the carnival has passed, unless the band needs them longer for its records.
• Marketing contacts: until you unsubscribe; we keep a note that you unsubscribed so we don't contact you again.

Data is encrypted in transit, access is limited by role, every band's data is kept separate, administrators use two-step verification, and important changes are recorded in an audit log. No system is perfectly secure; if a breach affects your data, we will notify you and the Data Protection Commissioner as the law requires.

Under the Data Protection Act, 2019 you can ask to:

• be told how your data is used, and get a copy of it;
• correct data that is wrong or incomplete;
• delete your data, or restrict how it is used;
• object to its use, including for marketing;
• receive your data in a portable format; and
• withdraw any consent you gave.

Email masbandiq@gmail.com. For registration data we will work with the band concerned. We respond within the time the law allows and may need to confirm your identity first. You can also complain to the Data Protection Commissioner of Barbados.

Revelers under 18 should register with the permission and involvement of a parent or guardian. Bands may set their own age rules for their carnival.

We will post any changes here with a new date, and tell account holders by email about important changes.