Privacy Policy — NuadNow (นวดนาว)

Last updated: 2026-06-26

NuadNow values your privacy. This policy explains how we collect, use, and protect your personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

Data We Collect

We collect the following data to provide our service:

Phone number — used as the primary authentication credential via OTP
Display name — shown on your profile and in push notification copy
Device location (GPS) — collected only when you request a branch route ETA (foreground only). Raw coordinates are transmitted through Cloudflare Workers to Google Routes API for the ETA calculation; only a rounded coordinate (~110 m) is cached for 10 minutes. Raw coordinates are never stored permanently.
Usage data (analytics) — first-party only: approved screen names, usage events, durations; no personal data in event rows. You can opt out in the Privacy settings screen.
Payment data — amount (satang) and PromptPay QR string. We do not store credit/debit card numbers.
Expo push token — collected after you grant notification permission at the OS level.
Reviews — star ratings, tag selections, and free-text comments. Authors are masked in public views.

Data we do NOT collect: email address (field shown but not saved), pressure preference, card PAN, review photos, crash/diagnostics data, advertising identifiers (IDFA/AAID).

Purposes & Legal Basis

We use your data for the following purposes under the indicated PDPA legal bases:

Account authentication and security (phone number) — basis: performance of contract
Personalization of the in-app experience (display name) — basis: performance of contract
Branch route ETA calculation (device GPS) — basis: performance of contract (feature you explicitly request)
Analytics and service improvement (usage data) — basis: legitimate interests / consent (opt-out available)
Payment processing (payment data) — basis: performance of contract
Push notification delivery (push token) — basis: consent (controlled via OS permission)
Service quality and public display (reviews) — basis: performance of contract

Third-Party Processors

We use the following service providers (data processors) to operate our platform. They act on behalf of NuadNow only. We do not sell your data or use it for advertising or cross-app tracking:

Supabase — primary database, authentication, and storage for all data types (phone, profile, bookings, payments, push tokens, reviews, analytics)
Cloudflare Workers / Queues / Cron — serverless back-end processing: forwards device GPS to Google Routes, handles analytics ingestion, payment webhooks, and notification jobs
Xendit — PromptPay payment processing (receives: amount, reference ID, description, expiry timestamp; does NOT receive: phone number, display name, device location, or card PAN)
Google Routes API — receives raw device GPS coordinates to compute driving ETA. Transmission is server-to-server via Cloudflare Worker.
Expo Push Service — routes push notifications to Apple APNs (iOS) or Google FCM (Android) using your Expo push token

We do not share data with third parties for marketing or advertising purposes and do not collect advertising identifiers (IDFA/AAID).

International Data Transfers

Some processors may process your data outside Thailand (including Supabase, Cloudflare, Google, and Expo) under appropriate safeguards such as Standard Contractual Clauses or equivalent data protection frameworks.

NuadNow will put in place appropriate Data Processing Agreements or safeguards with processors where required by law.

Transmission of device GPS coordinates to Google Routes API is governed by Google's Privacy Policy.

Retention

Raw analytics events: 180 days (purged automatically)
Analytics daily aggregates: up to 3 years
Route estimate cache: 10 minutes TTL
Other data (profile, bookings, payments, reviews): retained until account deletion or as required by law

You can delete your account in the app (Settings → Privacy → Delete account & data). A 30-day grace period applies before final deletion — sign in again within that window to cancel. Personal data is removed; financial records are retained in pseudonymized form for 5 years (Thai Revenue Code), and audit logs are retained as required for legal/security purposes (PDPA §33).

Your Rights (PDPA)

Under the PDPA you have the following rights:

Right of access — request a copy of your personal data
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion of your personal data
Right to data portability — receive your data in a machine-readable format
Right to object — object to certain types of processing
Right to withdraw consent — withdraw consent at any time without affecting prior processing

You can exercise your access/portability rights in-app via "Export my data" (JSON file) and your erasure right via "Delete account & data" (30-day grace period). Some financial records are retained in pseudonymized form as required by law.

Security

We implement the following security measures:

All data transmission is encrypted with TLS
Row-Level Security (RLS) is enforced on every database table
Secrets (API keys, service role keys) are stored as Cloudflare Worker secrets and never exposed to the client
We do not store credit/debit card numbers (card PAN) in our systems

Children

Our service is not directed at children under 20 years of age (as defined under the PDPA for minors). We do not knowingly collect personal data from children. If we become aware that such data has been collected inadvertently, we will delete it promptly.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through in-app notifications or other appropriate means. The "Last updated" date shown above indicates when the current version took effect.

Contact

Data Controller: NuadNow (นวดนาว)

For questions, PDPA rights requests, or data protection complaints, please contact us at:

[PLACEHOLDER — contact channel to be published once determined by ops: email/LINE OA TBD]

We will respond within 30 days of receiving your request.