Privacy Policy

This Privacy Policy describes how Toosabai (“Company,” “we,” “us,” or “our”) collects, uses, stores, discloses, and protects personal data when you use our booking and scheduling platform (“Platform”), accessible at toosabai.com and its subdomains.

Toosabai is a service operated by RoomFlow AB, a limited company registered in Sweden under organisationsnummer 559597-0087 (VAT number SE559597008701), with its registered address at Solrosgatan 18, 722 45 Västerås, Sweden. RoomFlow AB is the data controller for personal data collected through the Platform.

Because we are established in the European Union, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies to all of our processing of personal data, wherever in the world the individual concerned is located. Because we also offer our services to individuals in Thailand, Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) applies to that processing in addition. Where the two differ, we apply whichever gives you the stronger protection.

Each business Owner who accesses Guest personal data through the Platform also acts as an independent data controller with respect to that Guest data and is independently responsible for their own compliance with the GDPR, the PDPA and any other data protection law applicable to them.

We collect personal data in the following categories, depending on how you interact with the Platform:

2.1 From business Owners (at registration and during use)

• Account information: full name, email address, password (stored only as a cryptographic hash — we never store or have access to your plaintext password).
• Business information: business name, booking site address (slug), business type, about/description text, Google Maps URL, LINE URL, WhatsApp URL.
• Service and staff information: service names, descriptions, durations, prices; staff member names, commission rates, calculated commission amounts, and the dates and amounts the Owner records as paid. A recorded payment is an internal business record; Toosabai does not transfer money to staff.
• Operational information: business hours, break schedules, weekly closure days, one-off closure dates, booking horizon preferences.
• Photographs: hero images and gallery images uploaded through the Platform.
• Payment information: collected and processed by Stripe when you choose automatic card payment. We store your Stripe customer ID, a reference to your saved payment method, Monthly Statements, and whether each statement was paid automatically or manually. We never access, see, or store full card numbers or other card credentials.
• Agreement records: the version of the Terms and pricing you accepted, the account that accepted them, and the date and time of acceptance.
• Referral information: how you came to sign up — the business whose referral link you used or named at signup, or the referral code of an Issara link (see Section 5.4) — and, for businesses you referred, whether they completed more than 100 eligible bookings in a closed month, together with your referral rate reductions and any legacy referral credit balance and how it was earned and spent.
• Login email history: each email address previously used to sign in to your account, recorded whenever the address is changed. We keep this so that we can identify your account if you contact us unable to sign in and no longer remember which address you used. No password material of any kind is recorded — see Section 6.
• Support requests: if you send us a message through the support form on our website, we store the name, email address and message you provide, together with the IP address the message was sent from. The IP address is used solely to limit how many messages a single sender can submit in an hour, which is what stops the form being used to send mail in our name.

2.2 From Guests (at the time of booking)

• Contact information: full name and email address, which are required when you book online so that your confirmation, appointment reminder and (where applicable) review-request email can reach you. A phone number is optional. Where a booking is entered by the business on your behalf — a walk-in or a booking taken over the phone — only a name is required, and a booking recorded without an email address receives no email from us at all.
• Booking details: selected service, selected staff member, appointment date and time, booking status (confirmed, cancelled, rescheduled), and any notes you provide.
• Technical identifiers: a unique management token (an unguessable link for self-service booking management) and a short confirmation code.

2.3 From Staff members

• Account information: name, email address, and password (created by the Owner on the Staff member’s behalf; stored only as a cryptographic hash).

2.4 Automatically collected data

• Log data: our hosting provider (Vercel) automatically collects standard server logs, which may include IP address, browser type, operating system, referring URL, pages visited, and timestamps. This data is collected and retained by Vercel in accordance with their privacy policy.
• Cookies: see Section 7 below.

2.5 Data we do NOT collect

We do not collect: government-issued identification numbers, biometric data, health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, trade union membership, criminal records, genetic data, or any other categories of sensitive personal data (as defined under Section 26 of the PDPA). Do not submit such information through the Platform. If you inadvertently provide sensitive personal data, contact us immediately for its deletion.

Under the PDPA, we process your personal data on one or more of the following lawful bases. Where the GDPR applies to you (see Section 14), the same bases apply under Article 6(1) of the GDPR: contractual necessity (Article 6(1)(b)), legitimate interest (Article 6(1)(f)), legal obligation (Article 6(1)(c)) and consent (Article 6(1)(a)).

• Contractual necessity (PDPA Section 24(3)): Processing is necessary to perform our contract with you — for example, creating and managing your account, billing you in the months your usage exceeds the included allowance, facilitating bookings, and sending transactional emails (confirmations, reminders, and management links).
• Legitimate interest (PDPA Section 24(5)): Processing is necessary for our legitimate interests, provided those interests are not overridden by your fundamental rights. This includes: preventing fraud and abuse (such as the referral fraud gate and booking-code lookup rate limiting), maintaining the security of the Platform, improving Platform performance, and enforcing our Terms of Service. Where we rely on legitimate interest, we conduct a balancing test to ensure our interests do not override your rights.
• Legal obligation (PDPA Section 24(6)): Processing is necessary to comply with a legal obligation to which we are subject, such as tax record-keeping requirements, responding to lawful requests from public authorities, or complying with court orders.
• Consent (PDPA Section 19): Where none of the above bases apply, we ask for your consent before processing your personal data. Today that is one thing: storing a referral cookie when you arrive through a referral link (see Section 7.2). You may withdraw consent at any time (see Sections 7.2 and 9). Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

We use personal data for the following purposes:

• Account management: to create, maintain, secure, and authenticate Owner and Staff accounts.
• Booking operations: to create, manage, confirm, reschedule, and cancel bookings; to prevent double-booking; and to enforce business hours, closures, and booking horizons.
• Transactional communications: to send booking confirmations (containing the management link and confirmation code), appointment reminders (approximately two hours before the appointment), and review-request emails (after the appointment, at a timing configured by the business). These are service-related communications necessary for the performance of the booking, not marketing.
• Owner notification: to notify Owners by email when a new booking is made at their business.
• Billing: to determine eligible completed bookings, calculate and issue Monthly Statements, collect finalized amounts automatically or record manual payment, follow up overdue amounts, and apply referral rate reductions and legacy credit you have earned.
• Referral programs: to attribute a new signup to the referral link it came through (only where you allowed the referral cookie, or named a referrer at signup), credit the business that referred it, tell Issara about signups, billed months and refunds that came through an Issara link (Section 5.4), and prevent referral fraud.
• Security and fraud prevention: to prevent unauthorized access, detect and prevent fraudulent activity, enforce rate limits on booking-code lookups, and maintain the integrity of the Platform.
• Legal compliance: to comply with applicable laws, regulations, and legal processes.
• Platform operation: to host, maintain, and improve the Platform, resolve technical issues, and ensure the Platform functions as intended.

We do not sell, rent, or trade your personal data to any third party, for any reason, under any circumstances.

We do not use your personal data for profiling, automated decision-making, targeted advertising, or any purpose beyond what is described in this Privacy Policy.

We share personal data with the third-party service providers (“processors”) below, which operate the Platform on our behalf, and only to the extent each needs to perform its function. The other recipients — the authorities where the law requires it, a business you book with, and a business whose referral link you used — and our Issara referral service are described in Sections 5.1 to 5.4.

• Supabase, Inc. (United States) — hosts our database (data physically stored in the AWS Singapore region) and provides user authentication services. Supabase receives and stores: Owner account data, Staff account data, Guest booking data, business information, and all other data described in Section 2 above.
• Stripe, Inc. (United States) — processes payments for Owners. Stripe receives: Owner email address, payment method details (entered directly into Stripe’s PCI-DSS-compliant interface — we never handle these), the amount charged for a given month, and transaction records. Referral credit is applied by reducing the amount charged, so Stripe receives the reduced amount rather than a separate credit.
• Resend, Inc. (United States) — delivers transactional emails. Resend receives: the recipient’s email address, name, and the content of booking-related emails (confirmations, reminders, review requests, and new-booking owner notifications).
• Vercel, Inc. (United States) — hosts the application and serves web pages. Vercel may receive and process standard server log data (see Section 2.4).

Each of these providers acts as a data processor on our behalf and is contractually obligated to process personal data only as instructed and to maintain appropriate security measures. We do not share personal data with any other third party except as described in Sections 5.1 to 5.4 below.

5.1 Disclosure required by law

We may disclose personal data if required to do so by law, regulation, legal process, or enforceable governmental request, including but not limited to: court orders, subpoenas, requests from regulatory authorities, or in connection with legal proceedings. We may also disclose personal data where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a law enforcement request.

5.2 Business transfers

In the event of a merger, acquisition, corporate reorganization, bankruptcy, or sale of all or substantially all of our assets, personal data may be transferred to the acquiring entity or successor. We will notify affected Users of any such transfer and any changes to this Privacy Policy resulting from it.

5.3 Data shared with business Owners

When a Guest books an appointment, the contact details they provided (name, and email address and phone number where given) and their booking details are shared with the business where the appointment was made. The Owner of that business can view this information through their dashboard and receives a notification email. As noted in Section 1, each Owner is an independent data controller for the Guest data they access and is responsible for their own compliance with applicable data protection law. We are not responsible for how an Owner uses, stores, or discloses Guest personal data outside of the Platform.

5.4 Referral partners

Another business’s link. If you create a business account through another business’s referral link, or name that business at signup, it sees your business name in its list of referrals, and whether you completed more than 100 eligible bookings in a closed month and qualified its rate reduction. It sees nothing else about your account.

An Issara link. Issara (issara.work) is a referral service that RoomFlow AB also operates. Its members introduce businesses to Toosabai and are paid a commission when those businesses pay us. If you arrive through an Issara link, allow the referral cookie, and then create a business account, we record the following in Issara:

• when you sign up: the referral code from the link, an internal identifier for your account, your business name, and the email address you signed up with;
• for each month your account is billed: the same referral code and account identifier, your business name and the email address on your account at that time, the month, and a fixed figure used to calculate the commission;
• if a month’s payment is refunded: the account identifier and that month.

Nothing about your Guests, your bookings, or your payment details is ever recorded there. Issara uses this information only to credit and pay the member who referred you. Because it is operated by the same company, this Privacy Policy covers that information in Issara too, and your rights in Section 9 apply to it in the same way. We rely on our legitimate interest in running the referral program you chose to use (Article 6(1)(f) GDPR). You may object at any time using the contact details in Section 16, and we then stop recording your billed months there. If you delete your account or ask us to erase your data, we erase your email address and business name from Issara as well as from Toosabai.

We are established in the European Union, so personal data leaving the European Economic Area is a cross-border transfer requiring safeguards. Our primary database is physically hosted in the AWS Singapore region (via Supabase), and our other service providers — Stripe, Resend, and Vercel — are incorporated in the United States and may process personal data there or in other countries outside the EEA.

We do not rely on your consent for these transfers. Each transfer is covered by a written data processing agreement with the provider concerned, and where personal data leaves the European Economic Area or the United Kingdom, that agreement incorporates the Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum where applicable), as required by Articles 44 to 46 of the GDPR. These clauses oblige the provider to protect your personal data to the standard the GDPR requires, wherever it is processed.

The same agreements provide the appropriate safeguards required by Section 28 of the PDPA for personal data that originates in Thailand: each recipient is contractually bound to data protection standards no less protective than those the PDPA requires.

You may ask us for a copy of the safeguards that apply to a particular transfer using the contact details in Section 16.

8.1 Owner and business data

We retain Owner account data, business information, service and staff records, uploaded photographs, agreement records, and related data for as long as the business account exists — including periods when online booking is restricted because a Monthly Statement is overdue or an automatic payment failed. We do not delete data merely because an account is not currently being billed.

8.2 Guest booking data

Guest booking records (including name, email, phone number, and booking details) are retained for as long as the associated business account exists. This is necessary because: (a) the business may need to reference past bookings for operational purposes; (b) the Guest may need to look up their booking using their confirmation code or management link; and (c) we may need to retain records for legal compliance.

8.3 Deleted accounts

If an Owner requests account deletion (see Section 9), we will permanently delete all personal data associated with the account within thirty (30) days of verifying the request, except where retention is required by law (for example, accounting and contract records, which may need to be retained for applicable statutory periods). We will also delete or anonymize all associated Guest booking records, unless those records are independently required by law.

8.4 Backup retention

Deleted data may persist in encrypted backups for a limited additional period (typically up to 30 days) consistent with our backup retention schedule. Backup data is not actively used or accessed and is overwritten in the normal course of backup rotation.

8.5 Rate-limiting data

Booking-code lookup attempt records (used for rate limiting) are retained for a sliding window of fifteen (15) minutes and automatically expire. No personal data is stored in these records.

Under the PDPA, you have the following rights with respect to your personal data. These rights apply to Owners, Staff members, and Guests:

• Right of access (Section 30): You have the right to request access to the personal data we hold about you and to obtain a copy of that data in a commonly used electronic format.
• Right to rectification (Section 35): You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Owners can update most of their own information directly through the dashboard.
• Right to deletion (Section 33(5)): You have the right to request deletion of your personal data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw your consent and no other lawful basis for processing exists; (c) you object to processing and there are no overriding legitimate grounds; or (d) we have processed it unlawfully. We may decline deletion where retention is required by law or necessary for the exercise or defense of legal claims.
• Right to restriction (Section 34): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of your data following a rectification request.
• Right to data portability (Section 31): You have the right to receive your personal data in a structured, commonly used, machine-readable format and, where technically feasible, to have it transmitted directly to another controller.
• Right to object (Section 32): You have the right to object to the processing of your personal data where we rely on legitimate interest as the legal basis, unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent (Section 19): Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before the withdrawal.
• Right to lodge a complaint: Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, “IMY”). If you are in the European Economic Area or the United Kingdom you may also complain to the supervisory authority of the country where you live or work, or where you believe the infringement took place. If you are in Thailand you may complain to the Personal Data Protection Committee (PDPC). You may do any of this at any time, whether or not you have contacted us first.

9.1 How to exercise your rights

To exercise any of the rights listed above, contact us at support@toosabai.com. We will verify your identity before processing your request and respond within thirty (30) days. If we need additional time, we will notify you of the delay and the reason.

Guests may also exercise certain rights directly without contacting us:

• View your booking details using your confirmation code on the business’s page or via the unique management link sent to you by email.
• Cancel your booking using the management link — this removes your appointment from the business’s active calendar.
• Reschedule your booking using the management link.

We will not charge a fee for processing your request unless the request is manifestly unfounded or excessive. We do not discriminate against you for exercising your rights.

9.4 If you are in the European Economic Area or the United Kingdom

You have the equivalent rights under Articles 15 to 22 of the GDPR: access, rectification, erasure, restriction of processing, data portability, objection (including to processing based on legitimate interest), and the right not to be subject to a decision based solely on automated processing. We do not make automated decisions that produce legal or similarly significant effects about you. You may exercise these rights using the contact details in Section 16; we respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extra time. You also have the right to lodge a complaint with your local data protection supervisory authority.

We implement technical and organizational security measures designed to protect your personal data against unauthorized access, alteration, disclosure, destruction, or accidental loss. These measures include:

• Encryption in transit: all data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: our database is hosted on Supabase (AWS Singapore) with encryption at rest enabled.
• Password security: passwords are stored as cryptographic hashes using industry-standard algorithms — we never store or access plaintext passwords.
• Access controls: Row Level Security (RLS) policies at the database level ensure that each Owner can only access their own business data, and each Staff member can only view their own bookings. Guest bookings are written through a server-side route with the service role key — Guests never interact with the database directly.
• Key management: API keys and secrets are stored as environment variables on our hosting provider, not in source code. Keys are rotated periodically.
• Double-booking prevention: a database-level exclusion constraint prevents overlapping bookings even under concurrent requests — this is a data integrity measure, not just an application-level check.
• Tenant isolation: composite foreign keys ensure that booking records cannot reference staff or services from a different business, even if a valid UUID from another business is submitted.
• Rate limiting: booking-code lookups are rate-limited to prevent brute-force enumeration of confirmation codes.
• Constant-time comparison: security-sensitive comparisons (such as cron authentication) use constant-time algorithms to prevent timing attacks.

While we take commercially reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security and are not responsible for the acts of parties who gain unauthorized access to our systems despite our reasonable security measures.

The Platform is not directed at individuals under the age of 20 (or the age of majority in the relevant jurisdiction). We do not knowingly collect personal data from minors. If a Guest booking is made by or on behalf of a minor, the parent or legal guardian who provides the booking information is responsible for ensuring they have the authority to do so.

If we become aware that we have collected personal data from a minor without proper parental or guardian consent, we will take steps to delete that data as soon as practicable. If you believe we have inadvertently collected personal data from a minor, contact us at support@toosabai.com.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will:

• Notify the Swedish Authority for Privacy Protection (IMY), our lead supervisory authority, within seventy-two (72) hours of becoming aware of the breach, as required by Article 33 of the GDPR — and, where the breach affects personal data subject to the PDPA, the Personal Data Protection Committee (PDPC) within the same period — unless the breach is unlikely to result in a risk to your rights and freedoms.
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 of the GDPR), informing them of: the nature of the breach, the data affected, the measures taken to address it, and steps they can take to protect themselves.
• Document the breach, including the facts, its effects, and the remedial actions taken, regardless of whether the breach is notifiable.

A business’s page on the Platform may contain links to external websites or services, such as Google Maps, LINE, and WhatsApp. These links are provided by the business Owner for the convenience of Guests. We do not control and are not responsible for the content, privacy practices, or security of any external website. We encourage you to review the privacy policies of any external website you visit.

We are established in Sweden and most of the businesses using the Platform are in Thailand, but the Platform may be used from anywhere. Wherever you are, your personal data is processed in the countries described in Section 6 under the safeguards described there.

Because we are established in the European Union, the GDPR applies to our processing of your personal data wherever you are located — it is not limited to users in Europe. The legal bases in Section 3, the transfer safeguards in Section 6, the retention periods in Section 8, the rights in Section 9.4 and the breach notification commitments in Section 12 therefore apply to every user of the Platform.

If you are in the United Kingdom, the UK GDPR applies in the same way. If you are in Thailand, the PDPA applies in addition. Where two of these differ, we apply whichever gives you the stronger protection.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will: (a) update the “Last updated” date at the top of this page; (b) notify Owners via the dashboard or email; and (c) post the revised Privacy Policy on this page. Material changes will not be applied retroactively to personal data collected before the change without your consent where required by law. We encourage you to review this Privacy Policy periodically.

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, including exercising your rights under the GDPR or the PDPA, contact us at:

• Controller: RoomFlow AB (organisationsnummer 559597-0087)
• VAT number: SE559597008701
• Registered address: Solrosgatan 18, 722 45 Västerås, Sweden
• Email: support@toosabai.com
• Website: www.toosabai.com

If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority, as described in Section 9. Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, “IMY”), imy.se.