← Back to sign in

Courtesy Translation

Privacy Policy

Nuad Pro · Last updated 16 August 2026

This English version is a courtesy translation provided for convenience only. The Thai version is the governing text; in case of any conflict, the Thai text prevails.

1. Introduction

Nuad Pro (“we”, “us”, or “the Service Provider”) provides a massage shop management system as a web application, operated from Thailand. This Privacy Policy explains how we collect, use, disclose, and protect personal data in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”).

By registering for or using the service, you acknowledge that you have read and understood this policy.

2. Personal Data We Collect

We collect only the data necessary to provide the service:

  • Manager account data — the phone number used as the login identity.
  • Shop details — shop name, province, and operating hours.
  • Employee records entered by the manager — name and, optionally, a phone number. Employee phone numbers are used for in-shop contact only; employees have no accounts and cannot log in.
  • Massage session records — massage type, duration, price, and therapist commission.
  • Payment and subscription records — plan, amount, payment method, and date.
  • Platform notifications — service messages sent to your account.
What we do not collect, by design: we do not collect any personal data of your shop’s massage customers. The system performs no location tracking and does not access the device’s camera or microphone.

3. Purposes and Legal Bases of Processing

We process personal data for the following purposes:

  • Providing and maintaining the service (performance of a contract);
  • Calculating and collecting service fees, including issuing payment records (performance of a contract; legal obligation);
  • Providing support and answering enquiries (performance of a contract; legitimate interest);
  • Sending service notices, such as expiry reminders and service change announcements (legitimate interest).

We never sell or rent your personal data to third parties.

4. Legal Roles: Data Controller and Data Processor

In plain terms, the PDPA roles work as follows:

  • Manager account data and shop details — we are the data controller: we decide the purposes and means of processing this data.
  • Employee records entered by the manager — the shop manager (as employer) is the data controller of the employee records they enter, and we act as the data processor, storing and processing that data solely on the manager’s instructions.
Put simply: the manager decides which employee data to enter and is responsible for informing their employees (and obtaining consent where required) as the law provides. Our role is to store that data securely on the manager’s behalf.

5. Storage and Cross-Border Transfers

We use Google Firebase (Google Cloud) as our data processor and infrastructure provider. Your data may be stored on servers located outside Thailand.

Where personal data is transferred abroad, we ensure the transfer is subject to appropriate safeguards as required by the PDPA, such as data processing terms and the provider’s internationally recognized security standards, so that your data receives protection no less stringent than required under Thai law.

6. Data Retention

Session records and shop business data are retained for the life of the account, in line with the product’s design in which historical records become read-only and are never deleted automatically. Even after an account expires, you can still view your shop’s historical data for as long as we operate the service.

If you wish to have your personal data deleted or your account permanently closed, contact us via the channels in Section 11. We will act within a reasonable period, except where the law requires us to retain certain records (for example, accounting and tax evidence).

7. Your Rights as a Data Subject

Under the PDPA you have the right to:

  • access and obtain a copy of your personal data;
  • have your data corrected and kept accurate, complete, and up to date;
  • request deletion or destruction of your data;
  • request suspension of the use of your data;
  • object to the collection, use, or disclosure of your data;
  • withdraw consent (where processing is based on consent);
  • receive your data, or have it transferred, in a machine-readable format;
  • lodge a complaint with Thailand’s Personal Data Protection Committee (PDPC) if you believe we have violated the PDPA.

You may exercise these rights free of charge via the contact channels in Section 11.

8. Cookies and Analytics

We use cookies and similar technologies minimally and only as needed for the service to operate — for example, keeping you signed in — and we may collect anonymous usage statistics to improve the service. We use no advertising cookies and do not track you across other websites.

9. Data Security

We maintain appropriate technical and organizational security measures, such as encryption of data in transit, role-based access controls, and strict database access rules, to protect data against loss and unauthorized access, use, or disclosure.

10. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify you in advance through the service or your registered contact channel. The latest revision date is always shown at the top of this document.

11. Contact

For questions about this policy or to exercise your data subject rights, please contact: