Privacy Policy

Calista Thai Massage ("we", "us") runs this website and the studio at 353 Remuera Road, Auckland 1050, New Zealand. We handle personal information under the New Zealand Privacy Act 2020.

What we collect

When you visit any page

• Your IP address, the page you opened, the time, and your browser details (user agent).
• An approximate place taken from your IP address (country, region, city).
• Where you came from: the website that sent you, and advertising tags in the link (for example Google Ads click and campaign tags).

If you allow device location (the question on the site): your exact position from your browser, and how accurate it is. If you do not allow it, we do not ask your browser for it; we keep only the IP address and the approximate place from it. You can change your choice at any time with the "Change your location choice" link at the bottom of every page.

When you book online

• Your name, phone number and e-mail address, and any notes you write.
• The treatment, therapist, day and time, the price, and whether it is paid.
• For security and to confirm who made the booking: your IP address, your location (the exact position if you allowed it, otherwise the approximate place from your IP address) and your browser details.

If you create an account (optional; you never need one to book)

• Your name, phone number and e-mail address, and the bookings linked to your account.
• Your password is never stored. We keep only a one-way scrambled form of it (a salted hash) that cannot be turned back into the password.
• When you sign in: your IP address and browser details. A sign-in cookie keeps you signed in for up to 30 days; scripts on the page cannot read it. You can delete your account at any time from the My account page.

When you send us a message on the contact page: your name, e-mail, phone (if you give it) and your message.

Card payments

If you pay online, you pay on a secure page run by Stripe, our payment provider. Your card number, expiry date and security code are typed on Stripe's page only. We never see, receive or store them. We keep only a reference from Stripe, the amount and whether the payment succeeded. Stripe handles card data under its own privacy policy.

Why we use it

• To run your booking: show free times, hold your therapist, confirm, change or cancel your booking, take payment, and contact you about it.
• To keep the website and our bookings safe: stop fake or repeated bookings, spot misuse and check who made a booking.
• To understand how people find and use the website, and how our advertising performs, so we can improve both.
• To answer your messages, and to send you the e-mails about your booking and account (booking confirmations and password reset links).

We do not sell your information.

Who can see it

• Our staff, only for running the studio and the website.
• Service providers that run the website for us: Cloudflare (hosting, database and e-mail delivery) and Stripe (payments).
• Anyone the law requires us to give it to.

Some of these providers store information outside New Zealand.

Cookies and storage in your browser

• Your location choice (allowed or declined) is remembered in your browser so we do not ask again.
• For this visit only, your browser keeps the advertising tags from the link you came from and, if you allowed it, your position.
• While you fill in the booking form, what you typed is kept in your browser tab so a refresh does not lose it. It is never sent anywhere until you book, and it is removed when the booking is made.

How long we keep it, and how we protect it

We keep personal information only as long as we need it to run the business and to meet our legal duties, then delete it or make it anonymous. Bookings and customer details are kept in a protected database and only authorised people can reach them. Data is sent over encrypted connections.

Your rights

You can ask to see the personal information we hold about you, to correct it, or to have it deleted where the law allows. To do this, e-mail us at calistathaimassage@gmail.com or call 027 777 4226. We will answer within 20 working days. If you are not happy with our answer you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Changes

If we change what we collect, we will update this page and its date.

Questions? Contact us