Privacy Policy

1. 1. Data we collect

When you submit a booking request through our booking page or a message through our contact page, we collect only the following:

• Contact details: your full name and phone number.
• Booking details: the service, duration, price, date and time you request, and your preferred therapist if you choose one.
• Contact messages: the text of any message you send us through the contact form.
• Technical data: if analytics is enabled, basic usage information such as pages visited, approximate location derived from your IP address, device and browser type.

2. 2. Data we do not collect

Our website does not ask for or store your email address, nationality, preferred language, the muscle areas you want to focus on, special requests or any health information.

Your health, injuries, medical conditions and any contraindications are discussed in person with your therapist during the consultation before your treatment. This information is not entered into or stored by our website. Please do not include health details in contact form messages; you can share them with your therapist at the spa instead.

3. 3. Why we use your data

We do not send confirmation emails to customers, and we do not use your name or phone number for marketing or send promotional messages unless you have separately asked to receive them.

• To receive and review your booking request, and to call or message you by phone, WhatsApp or Zalo to confirm it or discuss any changes.
• To arrange your preferred therapist where available.
• To answer the messages you send us and handle any feedback or complaints.
• To understand, in aggregate, how our website is used so we can improve it (only if analytics is enabled).
• To meet our legal and accounting obligations.

4. 4. Legal basis and consent

We process your personal data in line with Vietnam's rules on personal data protection, including Decree No. 13/2023/ND-CP and related regulations, as they apply to us.

By submitting a booking request or a contact message, you consent to us processing the data described above for the purposes set out in this policy.

You may withdraw your consent at any time by contacting us. Withdrawal does not affect processing that already took place, but we may be unable to manage a booking if we no longer have a way to contact you about it.

5. 5. How we store and protect your data

Booking requests and contact messages are stored in a managed PostgreSQL database (Supabase) hosted in Singapore. Our website is hosted on Vercel. Data travels between your browser, our website and our service providers over encrypted connections (HTTPS/TLS).

Access to these records is restricted to authorised staff who need it to manage bookings and reply to messages. We take reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. No online system can be guaranteed to be completely secure, but we work to keep risks low and to respond promptly if an issue arises.

6. 6. Service providers and other recipients

We use a small number of trusted third-party services to run our website and bookings. They process data on our behalf or, where noted, under their own privacy terms:

• Database hosting (Supabase, Singapore): stores booking requests and contact messages.
• Website hosting (Vercel): hosts our website and processes the requests your browser sends to it.
• Email delivery provider: may send an internal notification about a new booking to the spa's own mailbox. We do not use it to email customers.
• Google Analytics 4 (only if enabled): measures website usage in aggregate. It uses cookies or similar technologies.
• Google Maps: our location map is an embedded Google Maps view. When it loads, Google may collect data such as your IP address under Google's own privacy policy.
• WhatsApp and Zalo: we may use these apps, or a regular phone call, to confirm your booking. If you contact us or reply to us through WhatsApp or Zalo, your messages are also handled under that app's own terms and privacy policy.

7. 7. Cross-border data transfer

Our business operates in Vietnam, while our booking database is hosted in Singapore and our website hosting provider may process data in other countries. This means your name, phone number, booking details and messages are transferred outside Vietnam. We rely on providers that apply recognised security measures, and we handle such transfers in line with the Vietnamese rules that apply to us. By using our booking and contact forms, you understand that your data will be transferred and handled as described in this policy.

8. 8. How long we keep your data

We keep booking records and contact messages for as long as needed to manage your bookings, answer your questions, resolve any disputes and meet our legal and accounting obligations. When data is no longer needed, we delete or anonymise it.

You can ask us to delete your data earlier at any time (see "Your rights" below). We may need to keep limited records where the law requires it.

9. 9. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct your name or phone number if it is inaccurate or incomplete.
• Delete your data, or ask us to restrict how we use it.
• Withdraw consent to processing that relies on consent.
• Object to certain uses of your data and raise a complaint with the competent authority.

10. 10. Cookies and similar technologies

Our website uses cookies that are necessary for it to work, for example to remember your language choice on the site. If Google Analytics is enabled, it sets analytics cookies to help us understand how visitors use the site. The embedded Google Maps view may also set cookies when it loads.

You can block or delete cookies in your browser settings. The website will still work, although some features such as the embedded map may not display correctly.

11. 11. Children

Our booking service is intended for adults. If a booking is for a minor, it should be made by a parent or legal guardian, who is responsible for the information provided.

12. 12. Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page shows when it was last revised. Significant changes will be highlighted on our website.

13. 13. Contact us

For any privacy question or to exercise your rights, email us at our email (see the Contact page) or use our contact page. We will respond as soon as reasonably possible and within the time required by law.