BanditBandit
Get Bandit ↓
Effective 28 July 2026

Bandit Privacy Notice

This Privacy Notice explains how Bandit handles account, collaboration, media, billing, and device information.

1. Controller and contact

ZUMA-LAND S.R.L., a Romanian limited liability company registered under CUI 28880630 and trade register number J21/307/2011 is the controller of personal data processed to provide Bandit. Contact us at office@zuma-land.com.

A band owner or organisation may separately be a controller for personal data they choose to upload or manage in Bandit. Questions about another user’s use of your information should also be directed to that user or band owner where appropriate.

2. Information we process

We process the following categories where applicable:

  • Account and profile information: Firebase user identifier, email address, display name, avatar reference, account status, and authentication/security events.
  • Band and collaboration information: band names, membership, roles, invitations, rooms, messages, private-chat participation, setlists, song metadata, read state, and activity timestamps.
  • User content and media: recordings, images, documents, filenames, file type, size, upload state, and the content and metadata you choose to share.
  • Billing information: Firebase user identifier used as the RevenueCat customer identifier, purchased product, band capacity, billing cadence, entitlement state, renewal state, paid-through date, trial dates, and reconciliation events. We do not receive or store full payment-card details handled by the store or payment provider.
  • Device and service information: app platform and version, notification token, request identifier, IP address and basic network metadata, security events, error details, rate-limit events, and operational logs needed to run and protect the Service.
  • Support and legal communications: information you send when requesting help, reporting abuse, exercising rights, or corresponding with us.

3. How information is collected

We receive information directly from you when you create an account, use Bandit, upload content, communicate, subscribe, or contact us. We receive membership and invitation information from other users who invite or collaborate with you.

We receive billing status and transaction metadata from RevenueCat and the applicable app store or checkout provider. We receive authentication, database, function, notification, and security information from the service providers used to operate Bandit.

4. Purposes and legal bases

We process personal data for the following purposes:

We do not use Bandit content for third-party advertising. We do not sell personal data.

  • Performing our contract: creating accounts, providing band collaboration, storing and delivering authorised content, synchronising devices, administering trials and subscriptions, exporting data, and providing support.
  • Legitimate interests: securing Bandit, preventing fraud and abuse, enforcing quotas and permissions, troubleshooting, maintaining reliable operations, improving usability, and establishing or defending legal claims. We balance these interests against your rights.
  • Legal obligations: tax, accounting, consumer, law-enforcement, sanctions, data-protection, and other obligations that apply to us.
  • Consent: sending optional notifications or using device permissions where consent is required. You may withdraw consent through device or app settings without affecting earlier lawful processing.

5. Visibility inside bands

Profile, membership, role, room, message, setlist, and shared-media information is visible to authorised band members according to Bandit permissions. Content posted in a room is visible to people authorised for that room.

Private-chat content and associated media is limited to the chat participants. A band owner does not receive private-chat content in an owner export unless that owner is also a participant.

Band owners and administrators can manage membership and may see invitation and band-level operational information. Choose what you upload and where you post it with this visibility in mind.

6. Processors and recipients

We disclose personal data only as needed to operate Bandit, complete transactions, comply with law, protect rights and security, or carry out a business reorganisation with appropriate safeguards. Current categories include:

Processors act under contractual or legal obligations. Third-party stores also process some transaction information as independent controllers under their own privacy notices.

  • Google Firebase for authentication, Firestore database, Cloud Functions, and notification delivery;
  • RevenueCat, Apple, and Google for subscriptions and entitlement reconciliation;
  • Hetzner infrastructure for the self-hosted service and local-disk media storage;
  • Apple Push Notification service and Firebase Cloud Messaging for notifications;
  • email-delivery and operational-support providers configured by Zuma-Land; and
  • professional advisers, authorities, courts, or transaction counterparties where legally necessary.

7. International transfers

Some providers may process information outside Romania or the European Economic Area. Where required, we use an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism and appropriate supplementary safeguards. You may contact us for information about the applicable safeguards.

8. Retention

We retain active account and collaboration information while needed to provide Bandit. Trial bands are scheduled for permanent deletion 30 days after trial lock; bands locked after paid expiration are scheduled for permanent deletion 90 days after lock. Reactivation before the deadline may cancel scheduled deletion.

Owner-requested permanent deletion is intended to remove active band records, invitations, and original media promptly. Restricted backup copies may persist until normal backup rotation. Billing, transaction, security, consent, and legal records may be kept longer where required for tax, accounting, fraud prevention, dispute handling, or legal compliance.

Retention may be extended where needed to preserve evidence, comply with a legal hold, protect users, or establish, exercise, or defend legal claims. We delete or anonymise personal data when it is no longer required.

9. Security

We use measures designed to protect personal data, including encrypted transport, Firebase authentication, band and conversation access checks, protected media routes, quota controls, restricted service credentials, and operational logging that avoids raw file content and authentication tokens.

No internet service or storage system is completely secure. Keep independent backups of important files, protect your credentials, and notify us promptly if you suspect unauthorised access. The Terms explain Bandit’s role as a collaboration workspace rather than a backup or archival service.

10. Your data-protection rights

Depending on applicable law, you may request access, correction, erasure, restriction, or portability of your personal data; object to processing based on legitimate interests; and withdraw consent. You also have the right not to be subject to certain solely automated decisions with significant effects. Bandit does not use user content for such automated decision-making.

Send a request to office@zuma-land.com. We may ask for information needed to verify identity, authority, band membership, or ownership. We will respond within the period required by law, normally one month under the GDPR. Some rights are limited where retention or processing is legally required or where a request would affect another person’s rights, including another private-chat participant.

You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or the supervisory authority where you live or work. We encourage you to contact us first so we can address the concern.

11. Account and content choices

You can update profile information, manage notification permissions, leave eligible bands, cancel subscriptions through the applicable billing provider, and use available owner export or deletion controls. Store cancellation, app deletion, account deletion, and band deletion are separate actions.

You can permanently delete your account in Bandit under Settings → Delete account. Owners must transfer ownership or permanently delete owned bands first. Step-by-step instructions are available at https://bandit.zuma-land.com/account-deletion.

A band owner may need to remove a member or transfer ownership. A privacy request does not automatically erase content that must remain visible to other participants as part of their conversation or legal record; where appropriate, we may restrict, dissociate, or anonymise the requesting account instead.

12. Children

Bandit is not directed to children under 16, and we do not knowingly offer them accounts without legally valid parental authorisation. Contact us if you believe a child has provided personal data contrary to this notice.

13. Public legal pages

The public Bandit legal pages do not use advertising cookies or tracking pixels. Basic web-server security and access logs may be processed to deliver and protect the pages.

14. Changes to this Notice

We may update this Notice when Bandit, our providers, or legal requirements change. We will publish the updated version at this URL and change the effective date. We will provide additional notice when required by law.

15. Contact

Privacy questions and rights requests may be sent to office@zuma-land.com or by post to ZUMA-LAND S.R.L., B-dul Matei Basarab, Bl. U21, Sc. A, Et. 5, Ap. 23, 920004 Slobozia, Ialomița, Romania.