Privacy Policy

1. Who we are and what this policy covers

Converx is operated by Converx Company Limited ("Converx", "we", "us"), Yangon, Republic of the Union of Myanmar. This policy applies to the Converx website at converx.net, the customer portal and public booking pages at my.converx.net, and the business workspace at app.converx.net (together, the "Services").

It applies to people who visit our website, people who book with or hold a customer account for a business that uses Converx ("customers"), and owners and team members of those businesses ("business users").

2. Converx and the businesses that use it

Converx provides software that salons and similar businesses use to run bookings, customer records, sales, loyalty, and their teams. Each business decides what it records about its own customers and why. For that information the business is the controller and Converx processes it on the business's behalf, under our Data Processing Addendum.

Converx is the controller of the personal data we decide about ourselves: Converx accounts and sign-in, the customer portal profile and the sharing choices you make in it, website enquiries, salon applications, subscription and billing records, review integrity, and the security of the Services.

If your question is about the record a particular business keeps about you — your visit history, notes, or balances with that business — contact that business first. If you contact us instead, we will pass your request to the business and help it respond.

3. Personal data we collect

• Account data: your name, email address and/or mobile number, sign-in methods, a hashed password (we never store it in readable form), language preference, and optional authenticator (two-step) enrolment.
• Customer portal data: the businesses you link with, the facts you choose to share with each (such as your display name, verified phone, email, or birthday), and confirmation of those links.
• Booking data: the business, branch, services, staff member, date and time you choose, and the name and verified phone number used to book.
• Records kept by businesses: visit and service history, purchases, payments recorded at the counter, loyalty and membership balances, notes the business makes (which may include allergies or treatment preferences), and photos the business uploads with your consent.
• Reviews: your ratings, optional comments, the display choice you make, and the visit the review relates to.
• Business user data: name, contact details, role and access granted by the owner, and — where the business records it — employment, availability, salary, and commission details.
• Business and billing data: salon application details, organization and branch details, subscription records, bank transfer references, transfer screenshots, and the outcome of payment verification.
• Support and communications: messages you send us and records of our replies.
• Technical data: IP address, browser and device information, request and error logs, security events, and the cookies and similar storage described in our Cookie Notice. If you use a "near me" search, your location is rounded to roughly 100 metres, used for that search, and not stored.

We do not ask for national identity numbers, payment card numbers, or bank sign-in credentials, and we ask businesses not to record them in Converx.

4. Where the data comes from

• From you, when you create an account, book, link with a business, write a review, apply for a business account, or contact us.
• From the businesses you visit, which record your visits, purchases, and notes in their workspace.
• From Google, if you choose to sign in with Google: your name, email address, and a Google account identifier.
• Automatically, from your device and from the operation and security of the Services.

5. How we use personal data and why

We do not sell personal data, and we do not use customer data that businesses hold in Converx for our own advertising or to build profiles across businesses.

6. Health-adjacent notes and photos

Businesses may record allergies, skin or hair conditions, or treatment preferences to provide a service safely. We treat these notes, any free-text note, and before-and-after photos as sensitive. They are never used for marketing segmentation and are excluded from general exports unless the person exporting holds an explicit permission.

Businesses must obtain your consent before taking before-and-after photos, and separate consent before using them in marketing.

7. Who we share personal data with

• Businesses you book with or link to: they see your booking and the facts you choose to share. Converx never tells you which businesses hold a record for your phone number, and never tells a business about your links with other businesses.
• Service providers that host and operate the Services for us, under written terms that limit their use of the data. They are listed in our Subprocessors document.
• Authorities, courts, or other parties where the law requires it, or where needed to protect the rights, property, or safety of people or of Converx. We review each request and disclose only what is required.
• A successor organization if Converx is reorganized, merged, or sold, subject to this policy.

8. Reviews

You can show a review under your display name or as "Anonymous customer". Converx keeps the link between the review and your account to prevent fake reviews and to handle reports, and never gives your contact details to the business. Because a review relates to a real visit, a business may still be able to work out who wrote it.

9. International transfers

The Services are hosted in Singapore, and some service providers process data in other countries. Where data leaves your country, we rely on contractual protections, the providers' security commitments, and the safeguards that the applicable law requires.

10. How long we keep data

We keep personal data only as long as needed for the purposes above, for the life of the relevant account or business, and for the periods required by law. Our Data Retention Policy sets out the periods for each kind of record, how deletion works, and how long backups last.

11. How we protect data

We encrypt data in transit with TLS and at rest using our hosting providers' encryption. Passwords are stored as one-way hashes, verification codes are stored only in hashed form, and sign-in is rate-limited. Each business's data is separated from every other business's. Business users can enable an authenticator app, and Converx administrators must use one.

Converx staff cannot browse a business's customers, bookings, sales, or notes. Limited support access requires a named support case, a reason, approval by a second administrator, and a time limit; the business owner is notified and every access is recorded in the business's audit history.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately.

12. Your rights and choices

Depending on where you live — including under Thailand's Personal Data Protection Act and the laws of Myanmar — you may have the right to:

• access the personal data we hold about you and obtain a copy;
• correct inaccurate or incomplete data;
• ask us to delete data, or to restrict or object to its use;
• receive data you gave us in a commonly used electronic format;
• withdraw consent at any time, without affecting earlier processing;
• complain to a data protection authority, such as Thailand's Personal Data Protection Committee.

You can update your profile, change what you share with each business, end a link, and delete your customer account in the portal. For anything else, write to privacy@converx.net. We will verify your identity and respond within 30 days, or tell you if we need longer and why. For records a business keeps about you, we will refer the request to that business.

13. Service messages and marketing

Service messages — verification codes, booking confirmations and reminders, invitations, and security or subscription notices — are part of the Services and cannot be switched off while you use them.

Marketing messages from a business are sent only with your recorded consent. You can opt out at any time, and an opt-out applies immediately to every channel and campaign of that business.

14. Children

Converx accounts are for people aged 18 or over. A younger person may be booked or recorded by a business only with a parent or guardian's involvement. If you believe a child has created an account, contact us and we will delete it.

15. Personal data incidents

If a security incident affects personal data, we will contain it, assess the risk, notify affected businesses without undue delay, and notify authorities and affected people where the law requires.

16. Changes to this policy

We will update this policy as the Services change. We will show the new effective date here and, for material changes, notify account holders in the Services or by email before the change takes effect.

17. Contact us

Converx Company Limited, Yangon, Republic of the Union of Myanmar. Privacy enquiries: privacy@converx.net. Security reports: security@converx.net.