Last Updated: June 11, 2026

Welcome to TMHK.app (hereinafter referred to as the “Platform”, “System”, or “Service”). This Service is owned and operated by Tech Monkey Co Ltd (hereinafter referred to as the “Company”, “We”, “Us”, or “Our”).

We place the highest priority on the data privacy and security of our users (hereinafter referred to as the “Merchant”, “User”, or “You”) and your shop’s clients (hereinafter referred to as the “End-Users”). This Privacy Policy explains how we collect, use, disclose, transfer, and safeguard personal data when you register an account, visit our website tmhk.app, or utilize the system. By accessing or using the Service, you explicitly consent to the collection and processing of personal data as described in this Privacy Policy.

1. Categories of Data We Collect

In order to deliver robust appointment scheduling, point-of-sale checkout, and automated notification services, we collect two primary categories of information:

1. Merchant Data (Owners and Employees):

   • Account Registration Information: Your name, company/salon legal entity name, Business Registration (BR) details (if applicable), mailing address, customer support email address (e.g., used for raising tickets via [email protected]), contact phone/WhatsApp number (such as +852 6018 1440), and login credentials.

   • Third-Party Credentials (BYOK): Dedicated Meta WhatsApp Business API keys, tokens, and configuration data provided by the Merchant to activate automated workflows.

2. End-User Data (Your Clients):

   • When your clients engage in online booking or physical checkouts via our service, the system records data on your behalf, including full names, phone numbers, appointment timestamps, selected service treatments, service history records, billing amounts, package balances, and treatment progression photographs (Before/After albums) uploaded by the Merchant.

2. Purposes of Data Processing

We process the collected data strictly for the following technical and operational business purposes:

1. Executing Core Infrastructure: Operating and synchronizing daily booking appointment calendars, POS registers, automated treatment package deductions, and employee commission payroll calculations.

2. Automated Marketing & Outbound Communications: Transmitting transaction receipts, reservation confirmations, and proximity reminders via the Merchant’s official Meta channel based on pre-set automation triggers.

3. Technical Escalation & Support: Diagnosing server architecture anomalies, debugging codebase errors, and addressing your technical support inquiries raised through our helpdesk email or official corporate WhatsApp.

3. Data Storage, Encryption, and Third-Party Sub-processors

1. Enterprise Cloud Encryption: our Service is a 100% cloud-hosted SaaS infrastructure. We do not store data on local physical hard drives. All Merchant and End-User matrices are encrypted and securely stored within our core cloud backend infrastructure—Supabase cloud databases. Automated multi-region backup protocols execute every 24 hours to prevent data loss.

2. Third-Party Communication Disclosure (Meta API): The Merchant acknowledges that to transmit automated WhatsApp notifications, relevant parameters (client names, booking times) are bridged via API protocols to the official cloud servers of Meta (Facebook Inc.). Data processing by Meta is governed strictly by Meta’s own corporate privacy terms. We does not have the technical authority or right to read or inspect private text conversations between the Merchant and their clients.

4. Disclosure and Sharing of Personal Data

We strictly enforce a zero-selling policy. We do not sell, rent, lease, or trade Merchant or End-User personal records to any third-party marketing brokers. Data disclosure may occur only under the following exceptional circumstances:

1. Legal Mandates: To comply with enforceable legal processes, court orders, or statutory regulatory demands enforced by government authorities within the Hong Kong Special Administrative Region.

2. Corporate Protection: Where disclosure is reasonably necessary to investigate, prevent, or take administrative action regarding breaches of our Terms of Service, financial fraud, or threats to the structural security of Tech Monkey Co Ltd.

5. Data Autonomy and Rights (Access & Deletion)

In strict compliance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, you hold the following legal privileges:

1. Access & Rectification: You can log in to your administrative master dashboard at any time to review, alter, or update your company profiling parameters and staff access permissions.

2. Permanent Eradication: Upon a decision to terminate your software subscription, you may deactivate your account prior to the end of the current cycle. Following account closure and a structural grace period, you may formally request our engineering team to completely wipe and delete all historical commercial ledger and client repositories from our Supabase cloud nodes.

6. Information Security & Merchant Guard Responsibilities

1. We implement standard cryptographic encryption protocols (SSL/TLS) to secure data packets in transit over network connections.

2. Critical Security Disclaimer: No digital architecture on the internet is entirely impenetrable. The Merchant bears exclusive liability for maintaining the confidentiality of their Master Account credentials. The Company accepts zero liability for data exposure resulting from administrative negligence, such as leaving unlocked local hardware terminals (e.g., iPads, mobile phones) unattended at salon reception desks or sharing active credentials across unauthorized personnel.

7. Amendments to This Policy

We reserve the right to amend this Privacy Policy dynamically. Material updates will be broadcasted directly on our official web domain or transmitted via your registered corporate registration email. Continued utilization of following updates constitutes your absolute acceptance of the revised Privacy Policy.

8. Contact Information

For privacy inquiries, statutory data access requests, erasure executions, or to lodge data management concerns, please reach out to our dedicated Data Protection Officer through our official corporate touchpoints:

• Corporate Legal Entity: Tech Monkey Co Ltd

• Registered Administrative Address: Rm31, 14/F, Block B, Wah Lok Industrial Centre, 31-41 Shan Mei Street, Fotan, HK

• Data Protection Helpdesk Email: [email protected]

• Official Support WhatsApp: +852 6018 1440