Privacy Policy

BusinessKaki is a salon booking and business management platform for Singapore small businesses, operated by Simply Yours LLP (UEN T24LL0355L), a limited liability partnership registered in Singapore ("BusinessKaki", "we", "us", "our").

We are committed to protecting personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA"). This policy explains what we collect, why, how we protect it, and your rights.

From business owners and staff (our account holders): name, email address, mobile number, business name and UEN, staff names and roles, and billing information when you subscribe to a paid plan.

From salon customers (on behalf of our business users): name, phone number, appointment history, service preferences, and messages exchanged with the business through WhatsApp or the booking page. This data is collected and controlled by the salon you interact with; BusinessKaki processes it on the salon's behalf as a data intermediary under the PDPA.

Automatically: basic usage and device information (browser type, pages visited, approximate region) used to keep the service secure and improve it.

We use personal data to:

• Provide bookings, reminders, customer records, payments, and messaging features
• Send appointment confirmations and reminders via WhatsApp, SMS, or email
• Process payments through our payment providers
• Respond to support requests and service notices
• Comply with legal obligations, including tax and accounting requirements

We do not sell personal data. Marketing messages are only sent to customers who have given consent, and every marketing message includes a way to opt out. We respect Singapore's Do Not Call (DNC) Registry requirements.

Our WhatsApp features are delivered through the WhatsApp Business Platform operated by Meta. When you or your customers message a business through WhatsApp, message content and phone numbers are processed by Meta in accordance with the WhatsApp Business terms and Meta's privacy policies. We store conversation history so businesses can see and continue their customer conversations from the BusinessKaki dashboard.

We use a small number of infrastructure providers to run BusinessKaki:

• Supabase — database and authentication (data hosted in Singapore region)
• Cloudflare — website hosting and message processing
• Stripe — payment processing (card details are handled by Stripe and never stored on our servers)
• Meta (WhatsApp Business Platform) — WhatsApp messaging

Each provider is bound by its own security and data protection commitments. Where personal data is transferred outside Singapore, we ensure a standard of protection comparable to the PDPA as required by law.

We retain personal data only for as long as it is needed for the purposes above or as required by law. Businesses can configure a data retention period for their customer records, after which records are deleted. When an account is closed, associated personal data is deleted or anonymised within a reasonable period, except where retention is required for legal or accounting purposes.

Personal data is encrypted in transit and at rest. Access is restricted through role-based permissions and row-level security, so each business can only access its own data. We log administrative actions and review our safeguards regularly.

You may at any time:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Withdraw consent to the collection, use, or disclosure of your data
• Request deletion of your data, subject to legal retention requirements

If you are a customer of a salon that uses BusinessKaki, you can also make these requests directly to that business — we provide tools for businesses to fulfil them. We will respond to requests within 30 days.

You can request the deletion of your personal data from BusinessKaki at any time. We offer two ways to do this:

Option 1: Email request. Send a deletion request to [email protected] from the email address or phone number associated with your account. We will verify your identity, delete your personal data from our systems within 30 days, and confirm once this is complete, except where retention is required for legal, tax, or accounting purposes.

Option 2: Revoke access via Facebook. If you connected BusinessKaki using Facebook Login or granted it permissions through your Facebook account, you can revoke that access directly from Facebook:

1. Open Facebook and go to Settings & Privacy.
2. Select Settings.
3. Go to Apps and Websites.
4. Find Business Kaki in your list of active apps.
5. Click Remove to revoke its access to your Facebook account.

Removing the app in Facebook stops any further data sharing between Facebook and BusinessKaki. To also delete the data we have already stored, please additionally send an email request as described in Option 1 above — Facebook's removal step does not automatically delete data already held in our systems.

We use only essential cookies needed to keep you signed in and keep the service secure. We do not use third-party advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings; signing in requires essential cookies to work.

We may update this policy from time to time. Material changes will be notified through the dashboard or by email at least 14 days before they take effect. The "Last updated" date at the top shows the current version.

For any privacy question, PDPA request, or complaint, contact our Data Protection Officer at [email protected]. If you are not satisfied with our response, you may contact Singapore's Personal Data Protection Commission (PDPC) at pdpc.gov.sg.