Privacy Policy

1. Scope and sources

This policy covers personal data received through our website, booking forms, telephone, LINE, WhatsApp, in-store interactions, and Meta lead forms on Facebook and Instagram.

We may receive data directly from you, automatically from your device when you use the website, or from a platform or service you choose to contact us through. Those platforms may also process data under their own policies.

A booking request may also be submitted on your behalf through our public API, MCP tools or another AI agent after you explicitly approve the details. We then receive the name, phone number, service, date, time, note, language and confirmation record, and record that the request came from an API or agent.

2. Data we may collect

Please do not send sensitive personal data that is unnecessary for your service. If it is necessary, we will first obtain explicit consent or rely on another lawful basis available to us.

• Identity and contact details, such as your name, telephone number, LINE account or contact details entered in a Meta form.
• Appointment and service details, such as service, date, time, communications, preferences and notes.
• Membership, payment or transaction records where relevant to the service you use.
• Messages, reference images or other information you voluntarily send through our website or communication channels.
• Technical data, such as IP address, activity logs, device and browser type, cookies and website measurement data when those tools are enabled.

3. Purposes and lawful bases

• Answer enquiries, check availability, receive booking requests, confirm appointments and provide requested services, based on steps before a contract or performance of a contract.
• Manage customers, memberships, payments, accounts, tax and related records, based on contract and legal obligations.
• Prevent fraud, spam and misuse, maintain security, and establish or defend legal claims, based on legitimate interests or legal obligations.
• Understand and improve our website, services and customer experience, based on legitimate interests or consent where required.
• Send relevant news, offers or advertising, based on consent or another lawful basis where permitted. You may opt out at any time.

4. Facebook and Instagram lead ads

When you submit a lead form on Facebook or Instagram, we receive only the fields shown in the form and the information you choose to submit, such as your name, telephone number or service interest. We use it to respond, provide information and manage your request.

We do not sell lead data or use it in a way that conflicts with the form notice or your choices. Once the data reaches us, we are responsible for it as a data controller. Meta separately processes data on its platforms under its own terms and privacy policy.

5. How we share data

We disclose data only as needed to our staff and to hosting, database, IT, communications and notification providers such as LINE, analytics providers such as Google when enabled, and Meta when you use Meta services. They must process data according to their role, contracts and applicable law.

We may also disclose data to professional advisers, authorities, courts or others when required by law, to protect rights or safety, or during a business reorganisation with appropriate safeguards. We do not sell your personal data.

6. International transfers

Some providers, including Meta, Google or infrastructure providers, may store or process data outside Thailand. Where data is transferred, we use safeguards appropriate under applicable law, such as contractual protections, providers' data protection standards, or consent where required.

7. Retention

We keep data only as long as necessary for the stated purposes, considering the customer and service relationship, accounting, tax and legal duties, limitation periods, dispute handling, and your requests or consent. When data is no longer needed, we will delete, destroy or reasonably anonymise it.

Phone numbers and booking details submitted through AI, agent, MCP or API channels form part of the booking record and follow the same retention criteria. We do not retain them longer merely because an agent or API submitted them.

8. Security

We use appropriate organisational and technical safeguards against loss and unauthorised access, use, alteration or disclosure, limit access to people who need it, and review safeguards according to the nature and risk of the data. No online system can guarantee complete security.

9. Your rights

Subject to applicable law, you may request access and a copy, correction, deletion, restriction, portability, object to processing, withdraw consent, and complain to Thailand's Personal Data Protection Committee. Withdrawal does not affect processing that was lawful before withdrawal.

Use the contact details below to exercise a right. We may ask for additional information to verify your identity and the request, and will respond within the period required by law.

10. Cookies, analytics and external links

The website may use cookies or similar technology for operation, security, preferences and measurement. If Google Analytics is enabled, usage data may be sent to Google. You can manage cookies in your browser, although blocking some cookies may affect website features.

Our website links to LINE, WhatsApp, Facebook, Instagram, Google Maps and other external services. Your use of those services is governed by each provider's privacy policy.

11. Changes to this policy

We may update this policy as our services or the law changes. The latest version and revision date will appear here. We will provide an appropriate notice if a change is material.