1. Introduction #

At Stringlab, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use the Stringlab website (stringlab.sg), iOS application, or Android application (together, the "Platform"). By using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Platform.

This policy is governed by the Personal Data Protection Act 2012 (PDPA) of Singapore.

2. Who We Are #

The entity operating the Stringlab service is the data controller responsible for your personal data. References to "Stringlab", "we", "us", or "our" refer to the entity operating the Stringlab service. Stringlab is a registered business in Singapore (UEN: 53521115E).

3. What Data We Collect #

3.1 Account Information #

When you register for an account, we collect:

Your name
Your email address
Login method (email magic link, Google, or Apple sign-in)

3.2 Order & Logistics Information #

When you place an order, we collect:

Your contact number
Pickup and delivery addresses
Brand and model of your racket(s)
String and tension preferences
Order history and status
Special instructions or notes

3.3 Payment Information #

Payment is processed securely by Stripe. We do not store your full card or banking details on our systems. We retain a record of transaction amounts, dates, payment status, payment method type (e.g. PayNow, card), and where applicable, the last four digits of your card, for accounting and dispute resolution purposes.

3.4 Device & Usage Data #

When you use the Platform, we may automatically collect:

Device type, operating system, and browser
App version
Pages visited, features used, and interaction patterns
Session duration and frequency of use

3.5 Communications Data #

We retain records of communications between you and Stringlab, including support enquiries, feedback, and any messages submitted via our contact page.

3.6 Stringing Preferences #

We retain a record of your submitted player profile and stringing preferences — including strings, tensions, racket models, and any feedback you provide — to power personalised recommendations on the Platform.

4. How We Use Your Data #

We use your personal data for the following purposes:

Service delivery: To process your orders, coordinate pickup and delivery, and communicate order status updates
Account management: To create and maintain your account, authenticate your identity, and manage your preferences
Personalised recommendations: To suggest strings and tensions based on your order history, stated preferences, and feedback, powered by Stringlab's recommendations algorithm
Payment processing: To facilitate secure payment via Stripe
Customer support: To respond to your enquiries, complaints, and feedback
Service improvement: To analyse usage patterns and improve the Platform's features and user experience
Marketing communications: To send you promotional content, where you have consented to receive it
Fraud prevention & security: To detect and prevent fraudulent activity, abuse, or unauthorised access
Legal compliance: To meet our obligations under applicable Singapore law

5. Legal Basis for Processing #

We process your personal data on the following bases under the PDPA:

Contractual necessity: Processing required to fulfil your order and deliver our services
Consent: Where you have explicitly agreed, such as for marketing communications or push notifications. You may withdraw consent at any time without affecting the lawfulness of prior processing
Deemed consent: By using the Platform, you are deemed to have consented to the collection and use of your data for purposes that a reasonable person would consider appropriate in the circumstances
Legitimate interests: For fraud prevention, service improvement, and internal analytics, where these do not override your rights and interests
Legal obligation: Where processing is required to comply with applicable law

6. Cookies & Analytics #

6.1 What We Use #

We use cookies and similar tracking technologies on the Platform to:

Maintain your session and keep you logged in
Understand how users navigate and interact with the Platform
Measure feature usage and identify areas for improvement

We use Amplitude, a third-party analytics platform, to collect and analyse usage data on our behalf. Data shared with Amplitude is used solely for the purposes of improving the Platform and is subject to Amplitude's privacy policy.

6.2 Your Choices #

You can control or disable cookies through your browser or device settings. Please note that disabling certain cookies may affect the functionality of the Platform.

7. Notifications & Marketing Communications #

We may send you the following types of communications:

Transactional notifications: Order confirmations, pickup notifications, dispatch updates, and delivery confirmations, sent via email and push notification. These are essential to the service and are sent regardless of marketing preferences.
Marketing communications: Promotional content, new string announcements, and offers, sent via email or push notification only where you have consented to receive them.

You may withdraw consent for marketing communications at any time by unsubscribing via the link in any marketing email, or by managing push notification preferences through your device settings. Withdrawal of consent does not affect transactional notifications, which remain active for the duration of your account.

We do not sell your personal data. We share your data only with trusted third-party data intermediaries who process it on our behalf, strictly for the purposes described in this policy. Our current data intermediaries include:

Stripe — Payment processing (United States) — Privacy Policy
J&T Express — Logistics and delivery (Singapore) — Privacy Policy
SPX Express — Logistics and delivery (Singapore) — Privacy Policy
Lalamove — Logistics and delivery (Singapore) — Privacy Policy
Resend — Transactional email delivery (United States) — Privacy Policy
Render — Cloud infrastructure and hosting (United States) — Privacy Policy
Cloudflare — Content delivery and platform security (United States) — Privacy Policy
Amplitude — Usage analytics (United States) — Privacy Policy
Sentry — Error monitoring and diagnostics (United States) — Privacy Policy

We require all data intermediaries to maintain appropriate security standards and to use your data only for the purposes for which it was shared.

9. International Data Transfers #

Some of our data intermediaries are based outside Singapore, including in the United States. By using the Platform, you acknowledge that your data may be transferred to, processed in, and stored in countries outside Singapore. We take reasonable steps to ensure that such transfers are subject to appropriate safeguards consistent with the PDPA.

10. Data Retention #

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following:

Account data: Retained for the duration of your account and for up to 2 years following account closure
Order data: Retained for up to 5 years for accounting, legal, and dispute resolution purposes
Communications data: Retained for up to 2 years
Usage and analytics data: Retained in aggregated or anonymised form indefinitely; identifiable usage data retained for up to 1 year
Payment records: Retained for up to 5 years in accordance with applicable accounting requirements

When data is no longer required, it will be securely deleted or anonymised. If you wish to request deletion of your account and associated data, you may do so at our delete page.

11. Data Security #

We implement reasonable technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These include secure HTTPS transmission, access controls, and encrypted data storage where appropriate.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Your Rights #

Under the PDPA, you have the following rights in relation to your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request that we correct any inaccurate or incomplete data
Withdrawal of consent: Withdraw consent for any processing based on consent, at any time
Data portability: Request that we provide your data in a portable format where applicable
Deletion: Request deletion of your personal data at our delete page, subject to our legal and contractual obligations

To exercise any of these rights, please contact us or email us at [email protected]. We will respond to your request within 10 business days.

13. Minors #

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. As we do not collect age information, we are unable to independently verify the age of our users. If you believe we have inadvertently collected data from a minor, please contact us, and we will take steps to delete it promptly.

14. Third-Party Links #

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy practices. For the privacy policies of our key data intermediaries, please refer to Data Sharing & Data Intermediaries. We encourage you to review the privacy policies of any other third-party services you use.

15. Updates to This Policy #

We may update this Privacy Policy from time to time. Material changes will be communicated to you via email or in-app notification at least 14 days before taking effect. The updated policy will be posted on the Platform with a revised effective date. Your continued use of the Platform after the effective date constitutes your acceptance of the updated policy.

16. Contact #

For questions, concerns, or complaints regarding this Privacy Policy or our handling of your personal data, please contact us or email us at [email protected]. We aim to respond to all privacy-related enquiries within 3 business days.

Privacy Policy

Updated: 23 May 2026