ကိုယ်ရေးအချက်အလက် မူဝါဒ

Who we are

Auryone is a web app that helps gyms, salons, clinics and other service businesses run their day: clients and members, appointments, sales, staff and pay. We call it the Business Portal.

If you have a question about this policy or about your data, please write to support@auryone.com.

Two kinds of data

• Your business's data: everything a business keeps in its portal, such as its clients or members, appointments, sales, staff, attendance, leave and pay. The business decides what it keeps and why, so the business is in charge of this data (the data controller). We look after it for the business, only on its instructions and under our agreement with it. If you are a client or a member of a business, or you work there, please ask the business first about how it uses your data.
• Account data: the details we need to run your sign-in and to look after the businesses that use Auryone, such as your name, your email or phone number, your role and your business. Auryone is in charge of this data.

What we collect

• Your account: your name, your email address or phone number, your business and your role.
• Your sign-in: your password or PIN, kept only in a protected form that nobody can read back; the two-step sign-in set-up of owners and managers; failed sign-in attempts, which lock an account for 15 minutes after five wrong tries; and when you signed in.
• Technical details: your IP address, your browser and the pages you open. Our hosting companies keep these in short-lived logs, to keep the portal working and safe.
• What your business enters: its clients or members (names, phone numbers, a Facebook name if given, and notes the client agreed to), visits, appointments, plans, payments, receipts and invoices, expenses with photos of their receipts, its staff (names, phone numbers, positions, photos, shifts and pay rules), attendance, leave and overtime requests, and payroll.
• Your place when you clock in or out: your browser asks you first. The portal uses the phone's place only to work out how far you are from your business, and keeps that distance in metres. It does not keep the place itself.
• Messages to us: when you write to us by Viber, Telegram or email, we receive your message and your contact details.

Why we use it

Your business needs a few details to give you an account, such as your name and your phone number or email. Without them, it cannot set up your sign-in.

We do not sell data, we do not show ads, and we do not use data to market to you. We do not send messages you did not ask for.

• To run the portal for your business. The legal basis is our contract with the business.
• To keep accounts and data safe: the lockout after wrong tries, two-step sign-in, the bot check on the sign-in page, and logs. The legal basis is the legitimate interest of Auryone, and of every business that uses it, in a safe service.
• To answer your questions and fix problems you tell us about. The legal basis is our contract with the business and our legitimate interest in helping you.
• To follow the law, for example to keep records the law asks for, or to answer a lawful request from an authority. The legal basis is that the law requires it.

Health details

Please do not write medical details in a leave reason or a note. "Sick" is enough. Health details are sensitive under data protection law and need extra care. Please also do not enter ID card numbers.

Who can see it

We never give data to advertisers or data brokers.

• People at your business, as far as the permissions set by its owner allow.
• Auryone, only when needed to run the portal, to fix a problem, or when the business asks us, for example to reset an owner's password.
• Companies that run parts of the portal for us, under contracts that require them to protect the data: Supabase (database, sign-in and stored files, in its Singapore region) and Cloudflare (hosting, network and security, including the bot check on the sign-in page).
• OpenStreetMap, when a page shows your business on a map or someone searches for an address. Its servers receive the request, which includes the IP address and the words searched for.
• Authorities, only when the law requires it.

Data outside your country

The data is stored in Singapore. Cloudflare may handle it in other countries, so pages load quickly wherever you are. When data leaves Thailand or Myanmar, we rely on the data protection terms of the companies that help us, which include standard clauses for sending data abroad.

How long we keep it

• Your business's data: for as long as the business uses Auryone. When a business stops, we give it a copy of all its data and delete ours within 30 days. Backups are deleted on their own schedule.
• Account data: for as long as the account is in use, and then with the business's data.
• Failed sign-in attempts and logs: for a short time, to protect accounts.
• Messages to us: for as long as we need them to help you.
• If a law requires us to keep some records for longer, we keep only those records, and only for as long as that law requires.

How we protect it

• Every connection to the portal is encrypted (HTTPS).
• Database rules keep each business's data apart from every other business's.
• Passwords and PINs are kept only in a protected form, and owners and managers sign in in two steps.
• The live database is backed up every day.
• If a problem puts data at risk, we tell the business within 72 hours of finding out, and help it tell the authorities and the people affected, as the law requires.

Your rights

Depending on where you are, you can ask to see your data and get a copy, to correct it, to delete it, to limit or object to its use, to get it in a form you can take elsewhere, and to take back a consent you gave.

For your business's data, please ask your business; we help it answer. For account data, please write to support@auryone.com. We answer within 30 days. In Thailand, you can also complain to the Office of the Personal Data Protection Committee (PDPC).

Children

The Business Portal is for people who work at a business. A business that keeps records of children, for example young gym members, is responsible for having a parent's or guardian's agreement where the law asks for it.

Changes to this policy

When we change this policy, we change the date at the top. If a change matters, we tell the businesses that use Auryone before it applies.

Contact

Questions or requests: support@auryone.com. Cookies are explained in the Cookie policy, and the rules for using the portal in the Terms of use.