HeiBook privacy notice
Last updated: 15 October 2026
1. Who we are
HeiBook is a booking system for massage and spa salons. The service is provided by:
Hello-Momo
179 Moo 4, Tambon Nondindaeng, Amphoe Nondindaeng, Buriram 31260, Thailand
Phone: +66 81 492 4293
Privacy contact email: [email protected]
We have not appointed a data protection officer. Contact us at the email address above for any question about personal data.
2. Our roles
- Salon customers and bookings: The salon that uses HeiBook is the data controller for information about its own customers. Hello-Momo is the data processor and handles that information only on the salon's instructions, under a data processing agreement (GDPR Art. 28). If you booked an appointment at a salon, the salon answers questions about your data. We help the salon respond.
- Website, trial and contact with us: Here Hello-Momo is the data controller for the information you give us.
This notice mainly covers the second group. Section 6 explains how we handle booking data as a processor.
3. What we collect
- Free trial form (from you): salon name, city, your name, email address, phone number (optional), message (optional), and a tick box confirming you have read this notice. The form also records the language and the page you came from, and any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content).
- Email to us (from you): what you write, and your email address.
- Spam protection (created by our system): we store a short-lived code (hash) of your IP address for up to 1 hour to limit how often the form and chat can be used. The IP address itself is not stored.
- Visit counting: we count visits and clicks without storing your IP address. The counter uses a code made from a random value that changes every day and does not show who you are. The code is deleted by the next day at the latest.
- Cookies: the sales pages use no tracking tools from other companies and no cookies for counting. The form sets one necessary cookie (csrftoken) that protects the form against misuse.
We do not collect information about you from other sources. We do not collect special categories of personal data (Art. 9).
4. Why we use it, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Reply to you and set up the trial you ask for | form data | Necessary to take steps at your request before entering into a contract (Art. 6(1)(b)) |
| Reply to email you send us | message, email address | Steps at your request before a contract (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)) |
| Spam and abuse protection | hashed IP address | Legitimate interests (Art. 6(1)(f)): keeping the form and chat free of automated abuse. Our balancing assessment is available on request from the contact in section 1 |
| Count visits without identifying you | anonymous daily code | Legitimate interests (Art. 6(1)(f)): understanding how many people visit the pages, without cookies and without storing the IP address |
| Run the service for the salon (booking data) | customer data from the salon | The salon's instructions; data processing agreement (Art. 28) |
We do not use this data for marketing without separate consent. We make no automated decisions and do no profiling (Art. 22).
5. Who receives it
- Our team at Hello-Momo.
- Google (Gmail): provider of the email service we use to send and receive email.
- Hello-Momo's own server in Thailand: where the form and chat data are stored.
- Cloudflare: provider of DNS and network service (proxy) that web traffic to the website passes through.
We do not sell your data.
6. Booking data we handle for salons (as processor)
- The data belongs to the salon. We use it only to run the bookings, never for our own purposes or marketing.
- We help the salon answer requests from data subjects. At present the system has no export button for customer data. Our team does exports and deletions on the salon's request.
- When the agreement with the salon ends, the salon can ask for its data to be exported within 30 days. After that we delete the data, including backups, within 90 days. Accounting documents about the agreement between us and the salon are excepted, see section 8.
- Sub-processors and the transfer to Thailand are covered in sections 5 and 7.
7. Transfers outside the EEA
Our servers are currently located in Thailand, which is outside the EEA. Your data is therefore not stored in the EU/EEA. The providers in section 5 may also process data outside the EEA.
The European Commission has not adopted an adequacy decision for Thailand (list checked 13 Oct 2026). For transfers we therefore rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, GDPR Art. 46(2)(c)). You can request a copy of the safeguards by contacting us at the email address in section 1.
We plan to move to a server in the EEA; no date has been set.
8. How long we keep it
The GDPR requires that data is kept no longer than necessary for its purpose (Art. 5(1)(e)). The law does not give a fixed number of days for this. Our plan:
| Data | Retention | Why |
|---|---|---|
| Contact details from people who do not start a trial (form, email, chat) | At most 90 days after last contact | Our own limit, not set by law. Basis: storage limitation, GDPR Art. 5(1)(e) |
| Trial that does not become a contract | Deleted within 90 days after the trial ends | Our own limit, same basis |
| Agreement, invoice and accounting material between us and a salon | For as long as the accounting and tax rules that apply to us require | Legal retention duty |
| Hash of IP address (spam protection) | Up to 1 hour | Technical setting in the system |
| Visit counting: daily code | Deleted by the next day at the latest. Totals (number of visits) may be kept without time limit because they cannot be linked to a person | The totals are anonymous |
| Booking data for the salon | For as long as the agreement with the salon lasts. After it ends: export on request within 30 days, then deletion within 90 days | GDPR Art. 28(3)(g) |
9. Your rights
You have the right to access, rectify, erase, restrict processing of, and port your data (GDPR Art. 15–20), and to withdraw consent at any time without affecting earlier processing (Art. 7(3)).
Right to object (Art. 21): you may object at any time to processing based on legitimate interests, for example the spam protection and visit counting.
Email [email protected] to use your rights. We reply within one month at the latest (GDPR Art. 12(3)). If your data is in a salon's booking system, we help the salon respond.
10. Complaints
You may complain to the Norwegian Data Protection Authority, Datatilsynet (www.datatilsynet.no), or to the authority in the country where you live or work, or where you believe an infringement happened (Art. 77).
11. Do you have to provide the data?
Providing the data is voluntary, but without the required fields we cannot set up your trial. It is not a legal or contractual requirement.
12. Changes
If we make material changes, we will tell you directly, for example by email, and show what changed.