Privacy Policy & Terms of Service

Official terms, disclosures, and data privacy commitments for employees, therapists, and authorized staff using the Zen Internal Super-App across Zen Family Spa & Reflexology locations.

Executive Disclosure for Google API Verification

Requested Scopes

openid, email, profile (basic user identification only).

Data Purpose

Internal authentication & role provisioning (Role 12: Operational Staff).

Zero Third-Party Sharing

Data is never sold or disclosed to external parties or advertisers.

Zen Family Spa ("we," "our," or "us") is deeply committed to protecting the privacy and security of our personnel. This Privacy Policy governs the manner in which we collect, use, maintain, and disclose information collected from users (employees, therapists, managers, and authorized contractors) of the Zen Internal App.

1. Information We Collect

When you sign in to the Zen Internal App using Google OAuth 2.0, we collect only the necessary identity data provided through your consent:

Full Name: To accurately identify you within the operational shift roster, attendance register, and task dispatch logs.
Email Address: Used as your unique account identifier, for authentication handshakes, and for critical operational notifications.
Profile Picture (Avatar URL): Used solely to render your staff avatar in the top navigation header and staff profile view.

2. How We Use Your Information

The data collected is utilized strictly for authorized internal business operations:

To facilitate secure single-sign-on (SSO) authentication and active session maintenance.
To automatically provision and enforce Role-Based Access Control (RBAC), mapping personnel to Role 12 (OPERATIONAL_STAFF) or administrative levels.
To synchronize work logs, biometric attendance records, room occupancy management, and back-of-house warehouse stock requests.

3. Data Storage, Hosting, and Security

Your profile and authentication metadata are securely stored using Supabase (PostgreSQL) enterprise cloud database infrastructure. We implement defensive security measures including:

PostgreSQL Row Level Security (RLS) policies restricting record access exclusively to authorized callers.
End-to-end TLS/HTTPS encryption in transit and AES-256 encryption at rest.
Strict audit logging and automated session token refresh cycles.

4. Third-Party Services & Zero Data Sale

We utilize Google OAuth strictly for user authentication. Your interaction with Google services is governed by the Google Privacy Policy.

Absolute Protection Commitment: Zen Family Spa never sells, rents, monetizes, or trades employee personal data with external third parties, brokers, or advertising networks under any circumstances.

5. Data Retention and Deletion Requests

We retain account data for the duration of the staff member's active employment. Upon resignation or termination of duties, access is revoked immediately. To request account deletion or data anonymization, contact our IT Department at support@zenfamilyspa.id.

6. Policy Updates

We may periodically update this policy to reflect operational or regulatory improvements. Any revisions will be reflected with an updated "Last Updated" timestamp at the top of this document.

7. Contact & Headquarters Information

Zen Family Spa Headquarters (PT Zen Family Spa)

Address: Jl. Sukajadi No.182, Cipedes, Kec. Sukajadi, Kota Bandung, Jawa Barat 40161, Indonesia

Official Email: support@zenfamilyspa.id

Website: https://zenfamilyspa.id

By accessing or utilizing the Zen Internal App, you explicitly agree to comply with and be bound by these Terms of Service.

1. Acceptance of Terms

This internal application is strictly reserved for the authorized personnel, employees, therapists, and management of Zen Family Spa. By authenticating via Google OAuth, you acknowledge that you have read, understood, and agreed to these terms in full.

2. User Accounts & Responsibilities

You are responsible for maintaining the confidentiality and security of the Google account credentials used to log in.
You must notify the IT Department immediately of any suspected breach or unauthorized access to your account.
Access by non-employees or unauthorized third parties is strictly prohibited and subject to legal action.

3. Acceptable Use Policy

You agree to use this application exclusively for lawful business duties related to Zen Family Spa operations. You shall not:

Attempt to probe, scan, or bypass any application security controls or database policies.
Introduce malicious code, unauthorized scripts, or automated scraping bots.
Access, tamper with, or export data outside your assigned operational scope or job role.

4. Intellectual Property

All code, UI designs, brand assets, database schemas, and operational algorithms are the exclusive intellectual property of Zen Family Spa. Unauthorized reproduction or reverse engineering is prohibited.

5. Termination & Access Suspension

Zen Family Spa reserves the right to suspend or terminate app access immediately and without prior notice upon breach of these terms, misconduct, or termination of employment.

6. Limitation of Liability

Zen Family Spa shall not be liable for any indirect, incidental, or consequential damages resulting from downtime, network failures, or temporary inability to access the internal system.

7. Governing Law

These Terms shall be governed by and construed in accordance with the laws of the Republic of Indonesia.

8. Contact Information

For questions regarding these Terms of Service, please contact the IT Department at support@zenfamilyspa.id.