The App is operated by Strategos Section 8 Technologies, a sole-trader software development business. We are the data controller responsible for your personal data collected through Little Bào's Travel Guide.
You can contact us at any time regarding your privacy at the address set out in Section 11 below.
We collect only the data necessary to provide the Bamboo service. The categories of data we collect are set out below.
| Category | Examples | How Collected |
|---|---|---|
| Account data | Email address, encrypted password, account creation date | Provided by you on sign-up |
| Profile data | Onboarding preferences, role flag (standard user vs. admin) | Generated during onboarding flow |
| Usage data | Saved places, pack purchase history, place reports submitted | Created automatically as you use the App |
| Payment data | Purchase confirmation, pack entitlement records | Processed via Stripe; we do not store raw card details |
| Device & session data | Session tokens, authentication state | Generated automatically on login |
| Voluntary submissions | Place accuracy reports, venue feedback | Provided by you when submitting a report in-app |
We use the data we collect for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Contract — necessary to provide the service |
| Delivering and personalising the travel guide experience | Contract / Legitimate interests |
| Processing pack purchases and granting content access | Contract — necessary to fulfil your purchase |
| Maintaining saved places and onboarding preferences | Contract / Legitimate interests |
| Responding to place reports and improving data accuracy | Legitimate interests |
| Detecting and preventing fraud or abuse | Legitimate interests / Legal obligation |
| Complying with legal obligations | Legal obligation |
We do not use your data for advertising, profiling, or sale to third parties.
Bamboo uses the following third-party services to operate. Each processes a limited subset of your data solely for the purpose described.
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Supabase | Database, authentication, and backend infrastructure | Account data, profile data, usage data, session tokens | supabase.com/privacy |
| Stripe | Payment processing for travel pack purchases | Payment intent data; card details handled directly by Stripe and never pass through our servers | stripe.com/privacy |
| Open-Meteo | Weather data displayed on the Discover screen | No personal data — requests use city-level coordinates only | open-meteo.com/terms |
| Apple App Store / Google Play | App distribution and platform-level analytics | Subject to Apple and Google's own privacy policies | Apple: apple.com/legal/privacy · Google: policies.google.com/privacy |
We do not sell, rent, or trade your personal data to any third party.
We may share your data only in the following limited circumstances:
We retain your personal data for as long as your account is active or as needed to provide the service.
On deletion of your account, all personally identifiable data will be removed from our active database within 30 days. Payment records required for legal compliance will be retained in anonymised or legally required form only.
Depending on your country of residence, you may have the following rights regarding your personal data. We honour these rights for all users regardless of jurisdiction.
| Right | What It Means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure | Request deletion of your personal data (subject to legal retention obligations) |
| Restriction | Ask us to limit how we process your data in certain circumstances |
| Portability | Receive your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Where processing is based on consent, withdraw it at any time |
To exercise any of these rights, contact us at the address in Section 11. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — in the UK, this is the Information Commissioner's Office (ICO).
Little Bào's Travel Guide is not directed at children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.
We take the security of your data seriously. Little Bào's Travel Guide is built with a security-first architecture that includes:
While we take all reasonable measures, no method of electronic transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and any applicable supervisory authority as required by law.
We may update this Privacy Policy from time to time to reflect changes in the App, applicable law, or our practices. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via the App or by email.
Your continued use of the App after changes are posted constitutes acceptance of the updated policy. If you do not agree to the updated policy, you should stop using the App and may request deletion of your account.
For any privacy-related questions, requests to exercise your rights, or concerns about how we handle your data, please contact us: