Privacy policy

Effective 1 October 2026 · Blockchain Melanesia Limited, IPA no. 1-123517164, Port Moresby, Papua New Guinea

This policy explains how Blockchain Melanesia Limited ("BM", "we", "us"), a company registered in Papua New Guinea (IPA no. 1-123517164, TIN 502388579) handles personal information across our website, store, BM ID, BM Pay and every BM app. Papua New Guinea does not yet have a general data-protection law; we follow the principles in PNG's Constitution and Cybercrime Code and widely accepted international practice.

1. What we collect everywhere

Your BM ID: phone number, name, and email if you add one; your passkey's public key and device name if you use a passkey; sign-in codes and security logs.
Payments: what you paid, when, to whom and how; your bank account (bank, branch, number, name) if you add one to receive money. We never see or store your full card number — card details go to the payment provider.
What you tell us: messages, feature suggestions, complaints, quote requests.
App-specific information: listed for each app below. Some of it is sensitive — location, identity documents, children's school records — and we say so plainly.

2. How we use it

To run the service you asked for: sign you in, take and pass on payments, deliver vouchers and tickets, connect you with hosts, drivers, bands, lenders or schools.
To keep people safe and stop fraud: identity checks, spotting vouchers that did not come through Konekt, anti-money-laundering checks, investigating complaints.
To send you messages about your account and transactions — codes, receipts, reminders. We only send marketing if you agree, and you can stop it at any time.
To meet our legal obligations, including tax and financial record-keeping.
To improve our services, using figures that do not identify you. We do not sell your personal information.

The other person in a transaction — for example the host sees your name and ID number before check-in; the vehicle owner sees your driver's licence; the organiser sees your pledge; the school sees payments for its students.
Payment providers: BSP (BSP Pay) and DOKU (card payments).
Service providers that run our systems: Supabase (databases), Railway (servers), Netlify (app hosting), Cloudflare (website security and privacy-friendly visit counts), Twilio (SMS sign-in codes and receipts), Google (web fonts), OpenStreetMap services (maps and routes), Privy (PNGx wallets) and Solana network providers such as Helius. They may only use your information to provide their service to us.
Partners: Audio Technik PNG for Singsing; Niubalus Logistics for Niubalus flights.
Authorities where the law requires it, or to protect someone's safety.

Blockchains are public. Transactions and wallet addresses on Solana — used by PNGx and for Singsing song registrations — can be seen by anyone and cannot be deleted by us or anyone else.

4. Where your information is stored

Our providers store information on servers in Australia, Singapore, the United States and elsewhere. By using our services you understand your information may be processed outside Papua New Guinea. We choose providers with strong security and contracts that restrict how they use it.

5. How long we keep it

Payment, tax and financial records: for as long as PNG law requires, generally at least 7 years.
Records needed for an open complaint or dispute: until it is resolved.
Kiosk connection logs: up to 12 months.
Everything else: while your account is open, and then deleted or made anonymous within 90 days of closing it.

6. Your choices

See and correct most of your details in each app. Ask us for a copy of the information we hold about you.
Delete your account: contact us from the phone number on your BM ID. We confirm it is you, pay out anything owed to you, and delete or anonymise your information within 30 days, except records we must keep by law (see above).
Turn off location sharing in your phone's settings. Some features — finding hotspots, rides — will not work without it.
Stop marketing messages by replying STOP or telling us. Account and transaction messages still come.

7. Security

We use encrypted connections, one-time codes and passkeys for sign-in, database rules that stop one user reading another's records, two-person approval for payouts, and audit logs of staff actions. No system is perfectly secure; if a breach affects you, we will tell you and explain what we are doing about it.

8. Children

Our services are for adults. We do not knowingly let anyone under 18 create a BM ID. SkulFi holds students' records because their school and guardians put them there (see below). If you think a child has created an account, tell us and we will remove it.

9. What each app collects

Jump to an app: Konekt · WanBung · Dinau Buk · Rentim · SkulFi · Wan PMV · Bisnis Stoa · Haus Stap · Bihain Baim · PNGx · Invest Antap · Niubalus · Singsing · Yumitu · BM Store · Kiosk purchase & hire · Refer & Earn · This website

Konekt Live

Your phone number, the vouchers you buy or are given, and who sold them.
At a hotspot: your device's network identifier (its MAC address), the hotspot you connect to, when you connect, and how much data you use. We use this to run vouchers and data allowances across hotspots, to spot vouchers that did not come through Konekt, and to keep the network working.
Location: if you allow it, your phone's location to show nearby hotspots and agents. It is not stored.
Agents: name, phone, shop name and the shop's GPS location; and the names and phone numbers of the two wantoks you name, who we send a text to so they can vouch for you. Please tell your wantoks before you give us their details.
Kiosk hire: the name and phone of the organisation's signatory and its agent.

Konekt: Terms · Cookies · Refunds · Cancellations · Delivery · all Konekt policies

WanBung Live

Your phone number and name; the organiser's email if given.
The events you organise or join, your pledges, what has been paid or delivered, and any brideprice items recorded.
Your bank account, if you add one to receive payouts or refunds.

WanBung: Terms · Cookies · Refunds · Cancellations · Delivery · all WanBung policies

Dinau Buk Live

Lenders' and borrowers' names and phone numbers, loan amounts, interest, due dates and repayments.
Whether repayments were made on time. We use this to run Dinau Buk; we do not sell it or pass it to credit bureaus.
Business details if you appear in the Dinau business directory.

Dinau Buk: Terms · Cookies · Refunds · Cancellations · Delivery · all Dinau Buk policies

Rentim Pilot

Owners' and renters' names and phones; properties, vehicles and leases, with the time each lease was e-signed.
Driver's licence details and photo for vehicle hire, shared with the vehicle owner.
Condition and trip photos, maintenance jobs, and messages between owner and renter.

Rentim: Terms · Cookies · Refunds · Cancellations · Delivery · all Rentim policies

SkulFi Pilot

Students' records: name, grade, boarder status, fee balance and attendance. These are children's records. They are entered by the school, which must have the guardian's permission, and are seen only by that school's staff and the student's guardian.
Guardians' names and phone numbers; payments and receipts; school staff accounts.

SkulFi: Terms · Cookies · Refunds · Cancellations · Delivery · all SkulFi policies

Wan PMV Pilot

Live location. Drivers' location is shared while they are online so riders can be matched. Riders' pickup and destination, and the route of each trip, are stored.
SOS: if you press SOS, your live location, phone number and the driver's details are sent to BM.
Driver identity checks: name, date of birth, ID type and number; the driver's photo is shown to riders.
Gender, only if you choose it to use women-only rides.
In-app messages and call records; recent places you have searched (kept on your phone).

Wan PMV: Terms · Cookies · Refunds · Cancellations · Delivery · all Wan PMV policies

Bisnis Stoa Pilot

Store owners' and staff details (staff sign in with a device PIN).
The store's products, sales, and its customers' names, phone numbers and book-up balances. The store decides what to record about its customers and is responsible for it; we hold it on the store's behalf.

Bisnis Stoa: Terms · Cookies · Refunds · Cancellations · Delivery · all Bisnis Stoa policies

Haus Stap Pilot

Guests' and hosts' names and phones; bookings, reviews and messages.
Full name and ID number given before check-in, shared with the host.
Guest ratings. Hosts can rate guests after a stay. Only the average is shown, and only to hosts you book with; you see your own average in Profile. Notes are seen only by BM.
Listings are public and can be seen without signing in: the name, area and map location, photos, price, reviews and the host's display name. Hosts' phone numbers are not shown.
Exact locations of private rooms, houses and village stays are shown only to guests with a confirmed booking; everyone else sees an area of about 500 m.
Photos a host sends to apply for the Security checked badge are private: only the host and BM staff can see them.

Haus Stap: Terms · Cookies · Refunds · Cancellations · Delivery · all Haus Stap policies

Bihain Baim Not yet open

When Bihain Baim opens, it will collect: identity checks, the monthly income you declare (to set an affordable limit), your instalments and payments, and the names and phone numbers of the wantoks you name as helpers. For merchants: business verification details. Please tell your wantoks before you give us their details.

Bihain Baim: Terms · Cookies · Refunds · Cancellations · Delivery · all Bihain Baim policies

PNGx In build

Your wallet address, created with your BM ID through our wallet provider, Privy. Your transactions on Solana are public.
For OTC trades, anti-money-laundering answers required by law: occupation, source of funds and wealth, purpose, and whether you are a politically exposed person.
Prices are fetched from market data providers such as Jupiter and CoinGecko.

PNGx: Terms · Cookies · Refunds · Cancellations · Delivery · all PNGx policies

Invest Antap In design

Invest Antap is not available and collects nothing. The public demo keeps its sample data only in your browser.

Invest Antap: Terms · Cookies · Refunds · Cancellations · Delivery · all Invest Antap policies

Niubalus Planned

Niubalus bookings are not yet open and collect nothing. When they open, Niubalus Logistics will receive the booking details it needs to fly.

Niubalus: Terms · Cookies · Refunds · Cancellations · Delivery · all Niubalus policies

Singsing Live test

Bookers', bands', artists' and organisers' names and phones; bookings, agreements, tickets and hires, with hand-over photos.
Klia listening: what you play and which adverts you see, to pay artists and run rewards.
Music, images and songwriter details you upload; songwriters' names, phones and shares.
Song registrations are timestamped on the Solana blockchain, which is permanent and public.
Your KLA wallet address, if you add one. Videos play through YouTube's privacy-enhanced mode.

Singsing: Terms · Cookies · Refunds · Cancellations · Delivery · all Singsing policies

Yumitu Private pilot

From BM ID: your phone number (never shown to other members).
Your profile: first name, woman or man, date of birth (others see only your age), town, home province, languages, church, what you are looking for, your answer to a question, photos, and a small blurred copy of each photo used when you hide your photos.
Selfie check: the live selfie is compared with your photos and then deleted straight away; only the result is kept.
Voice intro (if you record one): heard by BM staff before other members can play it.
ID-Verified+ (if you buy it): a photo of your ID, seen only by BM staff and deleted as soon as they decide; we keep only the result.
Messages between matches. Each message is checked before it is delivered; a message that is held back is seen by BM staff. If someone reports a chat, BM staff may read that chat to decide the report, and every such reading is recorded.
Your likes, passes, matches, blocks and reports; your matchmaker brief and introductions; your purchases (made through BM Pay); your privacy choices.
A random id for your phone, kept in the app, so that someone who has been banned cannot simply come back with a new phone number.
Safety check-ins (if you turn one on): the place and time of your date, and your wantok's name and phone. We text them only if you don't tap "I'm safe", and delete their number 7 days after the date.
Photos you send in a chat: checked like messages, then stored privately so that only the two of you can open them.
Hide me from people I know (if you use it): the phone numbers you choose are turned into keyed one-way fingerprints and only the fingerprints are kept — never the numbers. They are used only to keep you and those people out of each other's view, and are deleted when you switch it off or delete your account.
Phone alerts (if you turn them on): the address your browser gives us for sending alerts. Alerts carry no content — they only say that something new is waiting.
Who sees what. Other members see your card (first name, age, town, home province, languages, church, intent, answer, photos, voice intro, verification badges) — never your phone number or date of birth. If you hide your photos, members see a blurred picture until you like them. Members overseas see a woman living in PNG only if she chooses. A wantok you give a link to sees your matches' first name, age, town, province and first photo. BM staff see what they need to keep people safe.
Automated checks. Photos, selfies and messages are sent to Anthropic (the maker of the Claude AI) to be checked, and the result comes back to us. Yumitu's data is stored with Supabase in Sydney, Australia.
Deleting your account. You can pause your profile at any time, or delete your account yourself in the app (Me → Delete my account). Deleting removes your profile, photos, voice intro, matches, messages and sign-in. We keep only what we must: payment records, and whether you already received the women's welcome gift. An account that is banned or under a safety review cannot be deleted until the review is finished — message us.

Yumitu: Terms · Cookies · Refunds · Cancellations · Delivery · all Yumitu policies

BM Store Live

Your name, phone, email, and delivery address; what you order and how you pay.
Card payments are handled by DOKU and bank payments by BSP through BM Pay. We never see your full card number.

BM Store: Terms · Cookies · Refunds · Cancellations · Delivery · all BM Store policies

Kiosk purchase & hire Live

The signatory's name and phone, the organisation, the named agent, the hire agreement, and the kiosk's sales and repayments.

Kiosk purchase & hire: Terms · Cookies · Refunds · Cancellations · Delivery · all Kiosk purchase & hire policies

Refer & Earn Live

To run Refer & Earn we keep your BM ID, phone number and referral code, and link the quote requests and store orders that used your code to it.
On the Refer & Earn page you see only the product and status of each referral — never the other person's name or phone. The person you referred is not told who referred them unless you tell them.
Your sign-in on that page is kept only in that browser tab and expires after 15 minutes.

Refer & Earn: Terms · Cookies · Refunds · Cancellations · Delivery · all Refer & Earn policies

This website Live

Quote and contact forms: what you type (name, phone or WhatsApp, email, organisation, site, province, GPS if you choose, budget, message). It is emailed to our team and added to our enquiries list in BM Dash, our staff console, and we reply by WhatsApp or email.
Visit counts through Cloudflare Web Analytics, which uses no cookies and does not identify you.
Your web server connection address, briefly, to stop repeated form submissions.

This website: Terms · Cookies · Refunds · Cancellations · Delivery · all This website policies

10. Changes and contact

If this policy changes, the new version is published here with a new effective date, and for important changes we tell you in the app first.

Privacy questions or requests: WhatsApp +675 7947 6876 · phone +675 7627 5502 · contact@blockchainmelanesia.com · P.O Box 195, Foodworld, Gordons, Port Moresby, Papua New Guinea