Privacy Policy

Effective date: 31 August 2026 · Applies to the Massage Street mobile application and massage.st websites

Massage Street ("the App") is operated by BA Systems Ltd, a company incorporated in Georgia ("we", "us"). Massage Street serves users worldwide. This policy explains what personal data we collect, why, and the rights you have over it, and it applies wherever you use the Service. We honour the data-protection laws applicable to our users — including the EU General Data Protection Regulation (GDPR), Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) where our services are used in Thailand, and other equivalent regimes — alongside the law of Georgia, where we are incorporated.

The short version. We collect what the service needs and nothing more: your account details, your bookings, and — if you choose to use it — your body record. We do not run ads, we do not use third-party analytics or tracking, and we never sell your data. Your body record belongs to you: you can export it or delete it inside the app at any time.

1. Data we collect

Account data: name, email address, a hashed password (never the password itself), account role (customer, therapist, or shop owner), and language preference.
Sign-in with Google or Apple: if you choose these options, we receive your name, email address, and a unique account identifier from Google or Apple. We do not receive your Google or Apple password. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Body record ("Muscle Memory"): with your explicit consent, we store the body areas you ask to have worked on or avoided, pressure preferences, session-wear preference, and the notes and findings your therapist records after a session. This is health-related data and is treated as sensitive under applicable data-protection laws (including the GDPR and PDPA): it is collected only because it is the core service you signed up for, is visible only to you and to therapists you book, and is never used for marketing or shared with anyone else.
Bookings and reviews: your booking history and any ratings or reviews you write (you choose whether each review is public, private to the therapist, or both).
Therapist profile data (therapists only): your public profile — name, photo, work photos, specialties, tier, and performance statistics such as request and rebooking rates.
Waitlist: if you join the waitlist on our website, your email address, optional name, and stated interest.
Technical data: standard server logs (IP address, request time). We use no advertising or analytics SDKs.

2. Why we process it (lawful bases)

To provide the service (contract): accounts, bookings, schedules, reviews, therapist profiles.
Your body record (explicit consent): you create it by choosing to use Muscle Memory; you can withdraw consent at any time by deleting it in Settings.
Service communications (legitimate interest / consent): messages about your bookings; waitlist emails you asked for.
Safety and legal compliance (legal obligation / legitimate interest): preventing fraud and abuse, responding to lawful requests.

3. Who can see what

Customers: your body record is visible to you and to a therapist you have booked, so they can prepare for your session. Public reviews appear with your first name. Nothing else about you is public.
Therapists: your profile, photos, tier, statistics, and public reviews are visible to app users — that visibility is the product you joined for, and you consent to it when registering.
We never sell personal data and never share it with advertisers or data brokers.

4. Where your data lives

Data is stored on servers we control in the European Union (Finland), with network services provided by Vercel Inc. (USA) and Hetzner Online GmbH (Germany/Finland). Depending on where you live, this means your data may be transferred internationally; we apply the same safeguards described below regardless of where you are or where the data is processed.

5. Security

Passwords are stored only as salted hashes. Access to production systems is restricted to authorized personnel over authenticated, encrypted channels. We apply industry-standard measures appropriate to the size of our service and are continuously improving them. No system is perfectly secure; if a breach affecting your data occurs we will notify you and the relevant authorities as applicable law requires.

6. Retention

We keep your data while your account is active. Your body record and session history can be deleted by you at any time in Settings. If you delete your account, we remove your personal data within 30 days, except minimal records we must keep for legal, security, or accounting reasons.

7. Your rights

Under applicable data-protection laws (such as the GDPR or the PDPA — and as a matter of policy we extend these rights to all users everywhere) you may: access and export your data (Settings → Export my data), correct it, delete it (Settings → Delete my data, or contact us to delete the whole account), object to or restrict processing, withdraw consent, and lodge a complaint with your local data-protection authority (for example, Thailand’s Personal Data Protection Committee or an EU supervisory authority). We respond to requests within 30 days.

8. Children

Massage Street is not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has an account, contact us and we will delete it.

9. Changes

If we materially change this policy we will notify you in the app before the change takes effect. The current version always lives at this address.

10. Contact

Data controller: BA Systems Ltd, incorporated in Georgia. You can exercise your data rights directly in the app (Settings → Export my data / Delete my data), or email support@massage.st.