Privacy Policy

Last updated: May 17, 2026

SabaiSen ("SabaiSen", "we") values your privacy. This policy explains what information we collect through our app and at the studio, why we collect it, who has access, and how to exercise your rights.

We operate in Thailand and align our practices with the Thailand Personal Data Protection Act B.E. 2562 (2019) ("PDPA").

Who we are

SabaiSen, operated by SabaiSen Limited Partnership, located at Koh Samui, Thailand.
For data inquiries, please reach us through our Contact page (select "Data / Privacy Inquiry").

What we collect

Account holder: name, phone number, email address
Additional guests: first name(s), optional notes from you
Payment: PromptPay slip screenshot you upload, or a cash record
Membership PIN: a 4-digit code we generate for fast check-in
Visits: each check-in (date, time, which guest, who approved)
Group / event bookings: event date, guest count, deposit
Shop orders: items purchased

We do not collect government ID numbers, banking details, health, or biometric data.

How we use it

Approve registrations and process payments
Track treatment balances and check you in
Send confirmation emails for bookings and registrations
Issue tax invoices when requested
Improve the service operationally

We do not sell or rent personal data. We do not share data with third parties for marketing.

Who has access

Studio staff at the front desk, gated by a per-staff PIN with audit logging
Our database is hosted by a cloud service provider in Singapore under contractual data processing terms
An email delivery service used to send booking and registration confirmations
Payment slip images kept in private storage with restricted access

Data retention

Active member registrations: kept while you remain an active member
Payment slip images: 180 days, then automatically deleted
Tax invoices and cash sale records: 5 years, as required by the Thai Revenue Code
Attendance logs: kept while you are an active member and for a reasonable period after your last visit for service continuity, then deleted on request or in routine cleanup
Encrypted backups: 30 days

Your rights under PDPA

Access: request a copy of the data we hold about you
Correction: ask us to fix inaccurate data
Deletion: ask us to delete your account and associated data
Withdrawal: withdraw consent for photo / video use
Complaint: lodge a complaint with the Thai Personal Data Protection Committee

To exercise any of these rights, send us a message through our Contact page with subject "Data / Privacy Inquiry" and include your registration name and phone number. We respond within 30 days.

Guests' data

We collect minimal data about additional guests: first names only. The account holder registers and consents on their behalf. Guests under 18 must be registered by a parent or legal guardian. We do not market directly to minors.

Photos and video

In the studio's common areas we may take photos or video for marketing materials (website, social media, brochures); photos are never taken during treatments. By registering, you consent to this use. You may withdraw consent at any time through our Contact page; we will stop using your image going forward.

Cookies and tracking

The app uses essential session cookies only: authentication, staff PIN session, and language preference. No third-party analytics, advertising trackers, or social-media pixels.

Security

Staff access gated by per-staff PIN with full audit log
Slip images stored in private storage
Database with platform-level encryption at rest
180-day slip retention reduces long-term exposure

Changes to this policy

We may update this policy from time to time. The "Last updated" date will reflect any change. Material changes will be emailed to active members.

Contact

SabaiSen, operated by SabaiSen Limited Partnership
Koh Samui, Thailand
Send us a message