Privacy Policy

1. Introduction

SabaiGo (“we”) respects your privacy. This policy explains how we collect, use, and disclose personal data when you use our website, SabaiGo apps for iPhone and Android, and booking services.

This policy aligns with Thailand’s Personal Data Protection Act (PDPA).

2. Data we collect

Account data: email registration and sign-in process your name, email and authentication information through Supabase. If you choose a website sign-in provider such as LINE, Google or Facebook, we may receive the name, email and provider identifiers you authorize.

Booking data: contact name, email, phone, date, time, number of guests, booked activities, and notes.

Payment data: transfer slips, amounts, and payment status. We do not store card numbers directly — online payments are processed by authorised payment providers.

Technical data: cookies required for login, language preferences, and core site functionality.

The mobile app stores your language, activity cart, party size, selected dates and options, and the latest downloaded catalogue on your device so you can continue later. Sign-in session data is stored in the operating system’s secure storage and the local session is removed when you sign out.

Sign-in, booking, receipt uploads, activity tickets and account management use screens within the app and send necessary data to SabaiGo over HTTPS. Online payment may open the payment provider’s page before returning to the app to check payment status.

Account deletion requests: we record the associated account ID, name and email, submission time, deadline, status, and administrator actions to receive, review, and track your request.

When configured, the website may use Google Ads and Meta Pixel to measure visits and advertising results, including purchase-event data such as transaction references, amounts, and currency sent to those providers.

3. How we use data

To process bookings, confirm payments, and communicate booking status.

To send booking and payment confirmation emails.

To improve our services, prevent fraud, and comply with legal obligations.

4. Third-party sharing

We use trusted providers such as Supabase (database and auth), Resend (email), and payment providers (e.g. Xendit). Data is shared only as needed to deliver the service.

We may share booking details with activity operators to fulfil your reservation.

We do not sell your personal data to third parties.

5. Retention and security

We retain data as long as needed for service delivery, legal compliance, and dispute resolution.

We apply appropriate security measures, including HTTPS encryption and access controls.

Account deletion may exclude booking and payment records, supporting documents, and request records that remain necessary for service obligations, legal requirements, or disputes. The team reviews the need to retain these records before completing the request.

6. Your rights

Under PDPA, you may request access, correction, deletion, or objection to processing of your personal data by contacting us.

You may opt out of marketing communications at any time.

You can submit a deletion request from Account > Request account deletion or the website’s account-deletion page after signing in. The team will review and complete your request within 30 days of submission, subject to the retention exceptions in this policy. Submitting a request does not delete the account immediately and does not cancel a booking or request a refund.

7. Contact

For privacy questions or PDPA requests, please contact us using the email in the website footer.