Legal

Privacy Policy

What the Book My Spa apps collect, why, who it goes to, and what you can do about it — written against what the apps actually do rather than what they might one day.

Last updated: 20 August 2026

Overview

This policy covers the Book My Spa customer app and the Book my SPA Partner app, together with this website. It is issued by KAYLA MAYOTECH LLP (“we”, “us”), the operator of the platform.

In short: we collect the phone number you sign in with, whatever profile details you choose to add, the bookings you make, and — only if you allow it — your approximate location so we can show you spas nearby. We do not run analytics or advertising SDKs, and we do not handle payments.

Information we collect

Account information

  • Phone number. Required. It is how you sign in and how your account is identified, and it is stored on your device so you stay signed in.
  • Name, email address, date of birth and gender. Optional. Signing up only collects a phone number; these stay empty until you add them on the Edit Profile screen.
  • Profile photo. Optional, and only if you choose one from your camera or photo library.

Booking information

  • The spa, treatment, date, time slot, seat, duration and price of each booking, along with its status and any discount applied.
  • Your name, phone number and profile photo are copied onto the booking so the spa can see who is coming.
  • If a booking is cancelled, we record whether you or the spa cancelled it.

Content you submit

  • Reviews. A rating, an optional comment and the name on your profile. Reviews are public on the spa's page; if you have not set a name, the review is posted as “Anonymous”.
  • Reports about a spa. The reason you select, your description, a contact number you provide, and an optional photo. Reports are not public and are read only by the team that handles complaints.

Partner and staff information

  • Spa owners and staff sign in with a phone number and may add a name, email address, photo and a short profile line.
  • Verification documents. To list a spa we collect the owner's name and date of birth, a government ID (Aadhaar, PAN or driving licence, front and back), a trade licence, a GSTIN where one applies, spa or therapy certifications, and a reception phone number. These are used for verification and are never shown to guests.
  • Business details published to guests: the spa's name, description, photos, services and prices, amenities, opening hours, phone number and map location.

Device information

  • A push notification token for the device, so booking updates can reach you.
  • Basic app information such as the installed version, shown on the App Settings screen.

Location information

Location is optional and is only requested when you use the “Popular Near You” sort in the customer app. If you decline, everything else in the app continues to work — you can still search, sort by rating or price, and book.

When you allow it, we use your device location to:

  • work out your approximate area, which we do by converting the coordinates into an address and a postal code;
  • find verified spas near you, starting with your immediate area and widening to the district, state and then country only as far as needed to fill the list.

We do not track your location in the background, and we do not build a location history. The coordinates are used for the search you asked for and are not stored on your account.

How we use your information

  • To create and maintain your account, and to sign you in.
  • To show you spas, take your booking, hold your seat while you review it, and pass the request to the spa.
  • To tell you what happened to a booking — confirmed, declined, lapsed, cancelled or completed.
  • To show reviews on a spa's page, and to act on reports.
  • To verify a spa and its owner before the listing is published to guests.
  • To let a spa run its own shop: its bookings, walk-ins, staff and earnings.
  • To respond when you contact support.

We do not sell your information, and we do not use it to build advertising profiles.

What is shared with a spa

When you request a booking, the spa you booked with receives your name, phone number, profile photo (if you have one) and the details of that booking. They need it to recognise you at the desk and to contact you if something changes.

Spas do not receive your email address, date of birth or gender, and they cannot see bookings you have made anywhere else. A review you post shows the name on your profile, or “Anonymous” if you have not set one.

Reporting a spa does not tell that spa who reported it. The report goes to the team that handles complaints, and reporting a spa also removes it from your own home screen.

Third-party services

The apps rely on the following services. Each is used for the purpose described and is governed by its own privacy policy.

  • Google Firebase — authentication, database (Cloud Firestore), file storage (Cloud Storage), push notifications (Cloud Messaging) and server-side functions. This is where your account, bookings and uploaded images live.
  • MSG91 — delivery of the one-time code sent to your phone when you sign in. Your phone number is shared with them for that purpose.
  • Google Maps Platform — the map preview, street view image and directions link on a spa's page, and the map used by a partner to place their spa's pin.
  • A postal-code lookup service — called by our own server function to turn a postal code into a district when finding spas near you. Only the postal code is sent.

Notifications

With your permission, we send push notifications about your bookings — when a spa confirms or declines a request, and when a session is completed. The customer app has three separate switches under App Settings:

  • Push Notifications — on by default.
  • Booking Reminders — on by default.
  • Promotional Offers — off by default. Marketing messages are only sent if you turn this on.

You can turn any of them off at any time, in the app or in your device's notification settings.

Analytics and advertising

Neither app currently includes an analytics SDK, an advertising SDK, a crash-reporting SDK or any third-party tracker. We do not profile you, and there is nothing in the apps that follows you to other apps or websites.

This website serves its own fonts and images from its own domain and sets no cookies. If that changes — if analytics is added to the apps or the site — this policy will be updated before it is switched on.

Payments

Payment for a treatment is made at the spa, not in the app. Neither app collects or stores card numbers, UPI handles, bank details or any other payment credentials, and no payment processor is integrated.

A spa may record how a completed visit was paid for — for example “cash” or “card” — as part of its own bookkeeping. That is a note on the booking, not a payment instrument.

Where your data is stored

Your data is held in Google Firebase, on Google Cloud infrastructure, and may be processed in data centres outside your country. Your phone number is also stored locally on your own device so that you remain signed in between sessions.

Security

Data in transit is encrypted, and access to the database and file storage is governed by server-side security rules — a spa can reach its own bookings and staff, and you can reach your own account. Verification documents are not exposed to guests.

No system is perfectly secure, and we do not claim otherwise. If you believe your account has been accessed by somebody else, contact us at contact@bookmyspaapp.in.

How long we keep it

  • Your profile — until you delete your account, which you can do in the app.
  • Bookings — kept as part of the spa's own business records after an account is deleted, because both sides of a completed transaction have a legitimate interest in it and a business is required to keep its records.
  • Reviews — remain on the spa's page, since removing them would misrepresent the spa's rating.
  • Reports — kept while the complaint is being handled and for as long as needed afterwards.
  • Verification documents — kept for as long as the spa is listed, and afterwards where required for compliance.

See the account deletion page for exactly what is removed and what remains.

Your rights and choices

  • Access and correction. Your profile details can be viewed and edited in the app at any time.
  • Deletion. Profile → Delete Account removes your account. See the deletion page for the detail.
  • Location. Grant or revoke the permission at any time in your device settings; the app works without it.
  • Notifications. Three switches in App Settings, plus your device's own controls.
  • Reviews. The prompt after a visit can be dismissed, or turned off permanently with “Don't ask again”.

For anything you cannot do in the app, write to contact@bookmyspaapp.in and we will respond within a reasonable period.

Children's privacy

The apps are not directed at children. Accounts are intended for people aged 18 or over, and we do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

We will update this page when our practices change, and the “last updated” date at the top will change with it. Material changes will be signalled in the app.

Contact us

Questions about this policy, or about your data: