Privacy Policy

1. Our role for each type of data

QueueD collects two groups of personal data, in which we play different roles, and we explain them separately throughout this document.

• Shop account data, such as the shop owner’s name, email address and the staff you invite. For this data, we are the personal data controller.
• Customer data recorded by the shop, such as the names and phone numbers of people who use the shop’s services. For this data, the shop is the data controller, and we are the data processor acting on the shop’s behalf. If you are a customer of a shop and wish to exercise your rights, please contact the shop you use directly. We will cooperate with the shop in carrying out that request.

2. Data we collect

Shop and staff account data

• Shop name, shop address, shop phone number, business hours and days off
• Shop owner’s name, the email address used to log in, and the password, stored using one-way encryption
• Staff names, login email addresses (if any), photos, work schedules and days off
• Plan in use, subscription status and billing history

Customer data recorded by shops

• Name, phone number, LINE user ID and LINE display name (if the shop records them or the customer connects LINE)
• Notes the shop writes about that customer
• Booking history, appointment times, services used, prices, the number of visits and missed appointments, total spending, and blacklist status set by the shop

Data generated through use

• IP addresses, used to limit the number of login and sign-up attempts and to prevent password guessing
• System error logs, used to fix problems

What we do not collect: We do not store credit card numbers, expiry dates or CVVs. Card numbers are sent from your browser directly to Beam without passing through our servers. We store only a card reference ID and the payment method type. We also do not use advertising trackers or sell your data to anyone.

3. Purposes and legal bases

• Performance of a contract: creating accounts, verifying identity, scheduling bookings, and charging fees for the plan you selected
• Legitimate interests: keeping the system secure, preventing misuse, and improving the service
• Compliance with law: keeping accounting and tax records as required by law

We send service-related emails, such as email verification, password setup and billing status notices. These emails are necessary for using the service and cannot be unsubscribed from while you still have an account.

4. Third-party service providers

We use the following providers to operate the system. Each accesses only the data necessary for its function, and some have servers outside Thailand, which means your data may be transferred outside the Kingdom of Thailand.

• Neon: primary database
• Prisma Data Platform: database connection and caching layer
• Cloudflare R2: storage for uploaded images
• Upstash: rate limiting for security
• Beam: payment processing (a provider based in Thailand)
• Resend: sending service-related emails
• Render and Netlify: hosting for the system and the website

If a shop enables customer notifications via LINE, the customer’s name and contact details are sent to the provider of that channel in order to deliver the messages the shop instructs.

We do not sell, rent or exchange personal data with third parties for marketing purposes.

5. Data retention

• Shop data and the shop’s customer data are kept for as long as the account remains active.
• After an account is cancelled, we keep the data for a further 90 days so that you can restore the account. After that, it is automatically deleted or anonymized so that individuals can no longer be identified.
• If you want your data deleted before that period ends, contact support@queue-d.app. We will act on your request within 30 days.
• The log of edits made within a shop, which records who made each edit and when, is kept for 30 days and then deleted automatically.
• Financial and tax documents are kept for the period required by law, even after the account has been deleted.

6. Rights of the data subject

Under the Personal Data Protection Act B.E. 2562 (2019) (PDPA), you have the right to:

• access and obtain a copy of your data
• have inaccurate or outdated data corrected
• have your data deleted or destroyed
• have the use of your data restricted
• object to the collection or use of your data
• have your data transferred to another data controller
• withdraw consent you have previously given
• lodge a complaint with the Office of the Personal Data Protection Committee

To exercise your rights, contact support@queue-d.app. We will act on your request within 30 days. If you are a customer of a shop that uses QueueD, please contact that shop first, because the shop is the controller of your data.

7. Data security

• Passwords are stored using one-way encryption. We cannot read your password.
• All connections are encrypted with HTTPS.
• Each shop’s data is kept separate. One shop cannot access another shop’s data.
• The number of login attempts is limited to prevent password guessing.

No system is 100 percent secure. If a personal data breach occurs that poses a risk to the rights and freedoms of individuals, we will notify the Office of the Personal Data Protection Committee within 72 hours where feasible, and notify affected persons as required by law.

8. Access to your shop by the QueueD team

In some cases, our team needs to access your shop management system as the shop owner, in order to investigate or fix a problem you have reported or one we have detected ourselves.

• Each time this happens, we immediately email the shop owner, together with the reason the team recorded.
• Each access grant is valid for 15 minutes.
• You can view the full access history, and see which edits came from our team, on the settings page of the shop management system.
• We do not access your shop for marketing purposes, or to view your customers’ data without a necessary reason.

9. Cookies and storage on your device

This website does not use cookies for advertising or behavioral analysis. The shop management system stores a login token and your color mode setting in your browser so that you do not have to log in again each time. This is necessary for the service to work.

10. Data of minors

This service is intended for business operators. We do not knowingly collect data from minors. If a shop records data of customers who are minors, the shop is responsible for obtaining parental consent as required by law.

11. Changes to this policy

If there are material changes, we will notify you by email or in the app at least 30 days before they take effect.

12. Contact us

Data controller: QueueD
Email: support@queue-d.app

For other ways to reach us, see our Contact us page.