1. Who we are and what this covers
This policy covers WelcomeBird: the owner app for iPhone and Android, the web dashboard at app.welcomebird.com, the businesses' booking pages at welcomebird.com addresses, and this website. WelcomeBird is made and run by MAROTECH SOLUTIONS (Registration no. 202603017053 (CT0159782-U)), Kuala Terengganu, Malaysia. "We" means MAROTECH SOLUTIONS.
We handle personal data under Malaysia's Personal Data Protection Act 2010 (PDPA), as amended.
2. Two roles: ours and the business's
WelcomeBird has two kinds of people in it, and our role is different for each.
- Business owners, admins and staff
- When you create a WelcomeBird account, we decide what we collect and why. We are responsible for your data (in PDPA terms, the data user or controller).
- The businesses' customers
- When you book with a business, the business decides what it asks for and what it does with it. The business is responsible for your data. We store and process it on the business's behalf, only to run its bookings, and for nothing else.
So if you booked a haircut, the salon is responsible for your booking details, and WelcomeBird is the tool the salon uses to keep them.
3. What we collect about business accounts
- Your name, email and phone number
- To create your account, sign you in, send account emails and codes, and reach you about your business or a support question.
- Your password
- Stored only as an Argon2id hash. We cannot read it.
- Your business details
- Name, address, opening hours, services, prices, staff, courts or tables, photos and your booking page's settings. Most of this is shown publicly on your booking page, because that is its purpose.
- Billing details
- The name, billing email and address on your receipts, and your payments, invoices and receipts. Card and bank details stay with Stripe.
- Devices and sessions
- The phones and browsers you are signed in on, so you can see them and sign them out. A notification token from Apple or Google, so we can send booking alerts to your phone.
- Counter devices
- If you pair a tablet or browser as a loyalty counter, a record of each pairing and action, so you can see who did what.
- Support messages
- What you write to us and what we write back.
4. What we handle for businesses about their customers
- Name, phone number and email
- So the business knows who booked, and so we can send the code, confirmation and reminders. The email is optional.
- Bookings
- The service, person, court or table, date and time, party size, notes you add, and the booking's history: made, changed, cancelled, checked in.
- Phone codes
- When you confirm a booking with a 6-digit code, we keep the code (hashed), the IP address and the browser name, to stop abuse. Deleted a day after the code expires or is used.
- Ratings
- If the business asks you to rate a visit and you do, your stars and comment. Only the business sees them.
- Loyalty points
- If the business runs a loyalty programme: your points, visits and the amounts the business records for them.
- Business notes
- Private notes the business keeps about you.
Customers do not need an app or a password. We do not build profiles of customers across businesses: each business sees only its own customers.
5. Why we use it
- To provide the service: booking pages, the calendar, messages, check-in, ratings and loyalty points.
- To keep it secure: sign-in codes, limits on attempts, and stopping fake sign-ups and abuse.
- To bill for paid plans and credits and send receipts.
- To answer support questions and tell you about changes to the service.
- To meet our legal duties, such as tax and accounting records.
We do not sell personal data. There are no adverts in WelcomeBird, and we run no analytics or tracking tools of our own on the dashboard, the booking pages or this website. The owner app uses Google Maps and, on Android, Google ML Kit, described in the next section. Google may receive some device and usage data through them, under its own terms.
6. Who else receives it
Named, because "trusted partners" is not a disclosure. Each one does one job and receives only what that job needs.
- Mocean
- Sends SMS and WhatsApp messages: phone codes, confirmations, changes, reminders and rating requests. Receives the phone number and the message.
- Meta (WhatsApp)
- Delivers the WhatsApp messages sent through Mocean, under WhatsApp's own terms. Receives the phone number and the message.
- Brevo
- Sends emails: account emails, booking emails, receipts and notices. Receives the email address and the message. Open and click tracking is turned off.
- Stripe
- Takes payments for plans and message credits, by card or FPX online banking. Receives the billing details and handles card and bank details itself.
- Google (Firebase Cloud Messaging)
- Delivers notifications to the owner app on Android and iPhone. Receives the device token and the notification's text.
- Google (Maps SDK, in the owner app)
- Powers address search and the map pin when you set your business address in the app. Google may receive your search text, the map area you view, and device and usage data such as your IP address and device details, and handles them under Google's Privacy Policy.
- Google (ML Kit, in the Android owner app)
- Scans QR codes with your phone's camera, to check customers in and to pair counters and devices. On iPhone, the app uses Apple's own built-in scanner instead. The scan runs on your phone, and the camera image is not sent to us. Google may receive device and usage data, such as crash and performance information, under Google's Privacy Policy.
- Cloudflare (Turnstile)
- Checks that a sign-up on the web dashboard is a person, not a bot. Runs on the sign-up page only and sees that browser's request.
- Our cloud hosting provider
- Runs the servers and databases that store WelcomeBird's data.
Messages and booking pages can include an "Open in Google Maps" link to the business's address, and a business can link to its own Google review page. Following those links takes you to Google, under Google's own policy.
We may also share data when the law requires it, or to protect people from harm.
7. Cookies and storage
- This website
- No cookies. If you close the offer bar at the top, your browser remembers that in local storage, on your device only.
- The web dashboard
- A session cookie that keeps you signed in, for up to 30 days. If you use a browser as a loyalty counter, cookies that keep that counter paired. All are secure, first-party cookies, needed for the dashboard to work.
- Booking pages
- No cookies. After you confirm your phone, your sign-in is kept in that browser tab only, for 30 minutes.
- Sign-up page
- Cloudflare Turnstile runs there to stop bots, and may use its own storage to do that.
We use no advertising or analytics cookies.
8. How long we keep it
- Your account's data is kept while your account exists. You can delete your account in the app or on the dashboard; see Delete your account. A closed business is deleted for good 30 days after it closes.
- Customers' names, phone numbers, emails and notes on bookings are erased automatically 2 years after the booking ended, when the customer has not booked with that business since.
- A booking's manage link stops working 30 days after the appointment. A rating link stops working 14 days after it was sent.
- Loyalty points expire as the business chooses: never, or after 6, 12 or 24 months without a visit.
- Our record of messages sent keeps only masked phone numbers and emails, and is deleted after 180 days.
- Phone-code records, with their IP address, are deleted a day after the code expires or is used.
- Bookings made on our demo booking pages are deleted every night, with the customers' details.
- Invoices and receipts, with the bill-to details on them, are kept for as long as Malaysian tax and accounting law requires.
- When an owner deletes their account, we keep a coded fingerprint of their email and phone for 12 months, only to stop a second free trial. It cannot be turned back into the email or phone.
- Server logs are kept to a fixed size and overwritten as new ones come in.
9. Where it is processed
Our data is stored with our cloud hosting provider. Some of the providers named above operate outside Malaysia, so the data they receive may be processed abroad. Each processes it only for the job it does for us, and we choose providers that protect personal data to a standard comparable to the PDPA.
10. Keeping it safe
All traffic is encrypted in transit. Passwords are stored as Argon2id hashes and phone codes as hashes. Each business's data is kept apart in the database, so one business cannot read another's. Staff see only what their role allows. The dashboard's cookies are secure and cannot be read by page scripts.
No system is beyond reach. If a breach affects your data, we will tell you, and the authorities where the law requires, with what happened and what to do, in plain words.
11. Your rights
- See what we hold
- Most of it is in the app or the dashboard. Ask, and we will tell you the rest.
- Correct it
- Edit your details in the app or dashboard. For anything else, ask.
- Delete it
- See Delete your account.
- Withdraw consent
- Turn off notifications on your phone, or ask us to stop. Some data is needed to run your account, so withdrawing consent for it means closing the account.
Write to hello@welcomebird.com for any of these. You do not have to give a reason. We answer within 21 days, as the PDPA requires.
12. If you booked with a business
The business you booked with is responsible for your details. To see, correct or delete them, ask that business first: its contact details are on its booking page and in your booking messages.
You can change or cancel a booking yourself from the link in your confirmation, or with Find my booking on the business's page.
If you cannot reach the business, or it does not answer, write to hello@welcomebird.com with the business's name and the phone number you booked with. We will pass your request to the business, and help it act on it.
13. Children
WelcomeBird accounts are for adults running a business, and not for anyone under 18. Customers book through a business, and a business that takes bookings for children is responsible for getting a parent or guardian's agreement. If you believe a child has a WelcomeBird account, write to hello@welcomebird.com and we will remove it.
14. Changes to this policy
When this policy changes, the date at the top changes too. If we will do something materially different with data we already hold, we will tell business owners by email or in the app before it takes effect, rather than quietly editing this page.
15. Contact
Questions or requests about your data: hello@welcomebird.com.
MAROTECH SOLUTIONS (Registration no. 202603017053 (CT0159782-U)), Kuala Terengganu, Malaysia.
