This is a translation provided for convenience. The Korean version is the binding text.
massa ("the company") is a home-visit booking platform connecting customers in Hanoi with verified massage and beauty providers. We handle personal data as set out below.
| 1. What we collect | Account — email, password (stored hashed), social login identifier. Profile — name, mobile number, gender, nationality, language. Booking — visit address including hotel and room number, date and time, request notes, payment method and amount. Location — approximate or precise device location, only with your consent. Providers — ID document, settlement account, business registration, qualifications, profile photos. Automatic — access times, device and browser information, app error logs. |
|---|---|
| 2. Why we use it | Identifying members and keeping you signed in; matching bookings to providers; location-based search where consented; confirming payment and settling commission; verifying provider identity; safety checks, handling reports and detecting fraud; answering enquiries; sending offers where you have opted in. |
| 3. Sharing | We do not sell personal data. The assigned provider receives your name, contact number, visit address and request notes, and nothing further. We disclose data to authorities only on a lawful request and only to the extent required. Provider ID and account details are never shown to customers and sit in private storage only reviewers can open. |
| 4. Processors | The Constant Company, LLC (Vultr) — server hosting, database, authentication and file storage, Seoul region, Republic of Korea. Vercel Inc. — delivery of the web assets loaded by the Android app, United States. Resend — transactional email such as password resets. Cloudflare, Inc. — domain and email forwarding. Google LLC — AI uniform rendering of profile photos (Gemini), United States. |
| 5. Retention | Account data is kept until you delete your account and destroyed immediately after. Booking, payment and settlement records are kept for the statutory period (usually 5 years). Report and dispute records are kept 3 years from resolution; provider identity documents 1 year from the end of the contract. |
| 6. Your rights | You may view and correct your data, withdraw consent and delete your account at any time. Edit under Account → Personal information; delete under Account → Delete account. Marketing consent can be withdrawn under Account → Terms and privacy, with no effect on your use of the service. |
| 7. Location | Location permission is used only for "near me" search and visit guidance, and only when you grant it. Collected coordinates are discarded once matching is done and are not accumulated. You can revoke the permission in device settings and still book by entering an address. |
| 8. Children | The service is for those aged 18 and over. We do not knowingly collect data from children. |
| 9. Security | All traffic is encrypted over HTTPS and passwords are stored in a form that cannot be reversed. The database enforces row-level security so records are visible only to their owner or an authorised reviewer. |
| 10. Contact | Write to our data protection contact at support@massaviet.com, or use Account → Safety centre in the app. |
| 11. Changes | Changes are announced in the app and on this page at least 7 days before taking effect. Material changes require fresh consent. |
Revised 6 September 2026 — the processor list was corrected to the providers actually in use after the move to self-hosted infrastructure.