Last updated: 10 August 2026
BusinessKaki is a salon booking and business management platform for Singapore small businesses, operated by Simply Yours LLP (UEN T24LL0355L), a limited liability partnership registered in Singapore ("BusinessKaki", "we", "us", "our").
We are committed to protecting personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA"). This policy explains what we collect, why, how we protect it, and your rights.
From business owners and staff (our account holders): name, email address, mobile number, business name and UEN, staff names and roles, and billing information when you subscribe to a paid plan.
From salon customers (on behalf of our business users): name, phone number, appointment history, service preferences, and messages exchanged with the business through WhatsApp or the booking page. This data is collected and controlled by the salon you interact with; BusinessKaki processes it on the salon's behalf as a data intermediary under the PDPA. Where a business operates more than one outlet under the same company (UEN) and has linked them, this record — including prepaid package credit — may be recognised across those outlets, since they are the same legal entity. This never happens between outlets that are separate companies.
Automatically: basic usage and device information (browser type, pages visited, approximate region) used to keep the service secure and improve it.
We use personal data to:
We do not sell personal data. Marketing messages are only sent to customers who have given clear, individual consent, and every marketing message includes a way to opt out. Because we send marketing messages only on this consent basis, they fall within the consent exemption to Singapore's Do Not Call (DNC) Registry requirements under the PDPA — we rely on that individual consent rather than screening numbers against the DNC Registry.
Our messaging features are delivered through the WhatsApp Business Platform operated by Meta. When you or your customers message a business through WhatsApp, message content and phone numbers are processed by Meta in accordance with the WhatsApp Business terms and Meta's privacy policies. For businesses using BusinessKaki's managed WhatsApp connection, messages may also route through an authorised third-party messaging infrastructure provider that connects to Meta's WhatsApp Business Platform on the business's behalf, in addition to Meta itself. We store conversation history so businesses can see and continue their customer conversations from the BusinessKaki dashboard.
We use a small number of infrastructure providers to run BusinessKaki:
Each provider is bound by its own security and data protection commitments. As a data intermediary under the PDPA, where personal data is transferred outside Singapore — by us or by these providers — we ensure through contractual terms and vendor standards that it receives a level of protection comparable to that required under the PDPA.
Our systems and databases are hosted in Singapore. Some of our infrastructure and support providers may have staff located outside Singapore who can access data in the course of providing technical support; this access is bound by confidentiality obligations and a standard of protection comparable to the PDPA. Messaging through WhatsApp also involves a disclosure to Meta — and, for managed connections, our WhatsApp technology partner — which process data internationally under their own terms (see section 4).
We retain personal data for as long as it is needed for the purposes described above — in practice, for as long as your account, or your relationship with a business that uses BusinessKaki, remains active — or as required by law.
Deletion happens on request rather than automatically. A business owner can permanently erase an individual customer's record from their dashboard at any time. Account holders and customers can also request deletion of their data through the processes described in sections 8 and 9, including closing a business account entirely. Where retention is required for legal, tax, or accounting purposes, we keep the minimum data needed to meet that obligation even after a deletion request.
Personal data is encrypted in transit and at rest. Access is restricted through role-based permissions and row-level security, so each business can only access its own data. We log administrative actions and review our safeguards regularly.
As a data intermediary under the PDPA, if we discover a data breach involving the customer data we process on a business's behalf, we will notify that business without undue delay so it can meet its own reporting obligations, including to the affected individuals and to the Personal Data Protection Commission where required.
Your rights, and who to ask, depend on whose data it is:
If you are one of our account holders (a business owner or a staff member of a business that uses BusinessKaki), you may at any time ask us to:
We will respond to these requests within 30 days.
If you are a customer of a business that uses BusinessKaki(for example a salon's client), that business is legally responsible for your data under the PDPA, and we only process it on their behalf as a data intermediary. Please direct your access, correction, withdrawal-of-consent, and deletion requests to that business directly. We provide the tools for them to action your request and will support them in doing so, but we do not decide these requests ourselves on their customers' behalf. To request full erasure of your data, contact the business directly using the deletion process in section 9. If the business no longer operates or cannot be reached, you may contact our Data Protection Officer (section 12) and we will assist. Where that business operates multiple outlets linked under the same company, your request is honoured across all of them, since they are the same legal entity.
If you are one of our account holders (a business owner or staff member), you can request the deletion of your personal data from BusinessKaki at any time.
If you are a customer of a business that uses BusinessKaki, that business holds and controls your data; please send your deletion request to the business directly (see section 8). The step below is for our own account holders.
Send a deletion request to [email protected] from the email address or phone number associated with your account. We will verify your identity, delete your personal data from our systems within 30 days, and confirm once this is complete, except where retention is required for legal, tax, or accounting purposes.
We may update this policy from time to time. Material changes will be notified through the dashboard or by email at least 14 days before they take effect. The "Last updated" date at the top shows the current version.
For any privacy question, PDPA request, or complaint, contact our Data Protection Officer at [email protected]. If you are not satisfied with our response, you may contact Singapore's Personal Data Protection Commission (PDPC) at pdpc.gov.sg.