Privacy policy
bookbay.io is operated by บริษัท แอคคอนซ์ คอเปอร์เรชั่น จำกัด ("bookbay", "we"), 197 Muban Preecha 1, Soi Phatthanakan 39, Phatthanakan Road, Phatthanakan Sub-district, Suan Luang District, Bangkok 10250, Thailand. This policy explains how we handle personal data when businesses use bookbay to take bookings, and when their customers book through bookbay.
1. Who is responsible
- For a business's own account (the owner's name and email address, shop settings), we are the controller.
- For the data a business collects from its customers through bookbay (names, phone numbers, bookings, transfer reports, and chat messages when the business connects a chat channel), the business is the controller and we process that data on its behalf. Customers should contact the business first; we will help.
2. What we collect
- Business accounts: email address, and the one-time sign-in codes we send to it (stored only as hashes and valid for minutes); the shop's name, link, contact details, opening hours, services, prices, staff names and nicknames, and its deposit, cancellation and reschedule rules; records of important actions taken in the account.
- Customers of a business: name and phone number; a phone verification carried out by our SMS provider; booking details such as service, time, staff, status and changes; for deposits, the amount due and, when you report a transfer, the amount you report, an optional bank reference and whether you have a slip; refund details you give so the business can return money; and notes the business keeps about you, such as tags or a deposit exemption.
- Chat messages, only when a business connects a channel: when a business connects its Facebook Page, Instagram professional account or WhatsApp Business number, we receive the messages people send to that business and the replies, the sender's name or username and the identifiers Meta provides (for WhatsApp this is normally the phone number), and delivery and read receipts. For health-related businesses we keep only structured choices, not the text or media of messages.
- Technical data: cookies that keep you signed in and keep a chosen time while you book (we use no advertising or analytics cookies), and IP addresses and request records used for security and to limit abuse.
We do not collect card numbers. Deposits are paid by the customer directly to the business's own account.
3. Why we use it
- To provide the booking service a business signs up for and the bookings its customers make.
- To verify email addresses and phone numbers and to prevent fraud and abuse.
- To send service messages: sign-in codes, booking status, and, when a business has connected a chat channel and you have agreed, booking updates in that chat.
- To publish a shop's public information (services, prices, opening hours, booking links and connected public profiles) so that people, search engines and AI assistants can find and book the shop. Customer data is never published.
- To meet our legal obligations.
Our legal bases are performing the service contract, legitimate interests in running and securing the service, consent where we ask for it, and legal obligations. We do not sell personal data or use it for advertising.
4. Who receives it
- The business you book with sees your booking details.
- Providers that process data for us: Microsoft Azure (hosting and database), Brevo (email delivery), Twilio (SMS phone verification), and Meta Platforms (Facebook, Instagram and WhatsApp messaging, only when a business connects a channel). Our pages also load fonts from Google Fonts and scripts from a content delivery network, which receive your IP address.
- Search engines and AI assistants receive public shop information only.
- Authorities, when the law requires it.
5. International transfers
Our main systems run in Microsoft Azure's Southeast Asia region in Singapore. Some providers process data in other countries, for example the United States or the European Union. We use providers that commit to appropriate safeguards for these transfers.
6. How long we keep it
- Sign-in and verification codes stop working within minutes.
- Booking records and customer details are kept while the business's account is active, and afterwards for as long as the law requires.
- Chat messages are kept for up to 90 days after the last message in a conversation. Raw data received from Meta is kept for up to 7 days.
- Access tokens for a connected account are deleted when the business disconnects it, or when Meta tells us that access was removed or deletion was requested.
7. Your rights
Under Thailand's Personal Data Protection Act and other laws that apply to you, you can ask to access or receive a copy of your personal data, correct it, delete it, restrict or object to some uses, and withdraw consent you gave. Write to hello@kaojao.com. If your request concerns a booking, the business you booked with may need to act on it; we will pass it on and help. You can also complain to the Personal Data Protection Committee (PDPC) in Thailand.
8. Security
Connections are encrypted (HTTPS), access is limited by role, the database is encrypted at rest, and access tokens for connected accounts are additionally encrypted.
9. Children
bookbay is not directed at children. A business that serves minors is responsible for obtaining a parent's or guardian's consent where the law requires it.
10. Changes
When this policy changes we update this page and its version date. We tell businesses about material changes in the app or by email.
11. Contact
บริษัท แอคคอนซ์ คอเปอร์เรชั่น จำกัด, 197 Muban Preecha 1, Soi Phatthanakan 39, Phatthanakan Road, Phatthanakan Sub-district, Suan Luang District, Bangkok 10250, Thailand. Email hello@kaojao.com, phone +66 2 026 6588.