Privacy Policy

Effective: October 28, 2025 · Cookie information updated October 15, 2026

Introduction

Dantara Thai Wellness & Spa ("Dantara", "we", "us", or "Controller") respects your privacy and is committed to protecting the personal data we collect. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we retain it, the rights available to Texas residents under the Texas Data Privacy and Security Act (TDPSA), and how to exercise those rights. This policy applies to data collected through our website, booking platform(s), Dantara Assistant Bot, in‑person intake forms, apps (if any), and other interactions with Dantara.

Controller & Contact

• Controller: Dantara Thai Wellness and Spa, 18810 Preston Rd, Dallas, TX 75252, USA.
• Privacy contact: privacy@dantaraspa.com

I. Categories of Personal Data We Collect

Retention (summary): Appointment/transaction records — 7 years; marketing records — until consent withdrawal or 3 years; analytics data — 13 months; sensitive health data — retained only as necessary for treatment and recordkeeping.

II. How We Use Personal Data

• Provide, manage, and improve services and the website.
• Process bookings, payments, confirmations, and reminders.
• Respond to inquiries and provide customer support.
• Detect and prevent fraud and security incidents.
• Conduct analytics and measurement to improve user experience.
• Deliver and measure advertising where not opted out.
• Generate internal, non-public safety & technique guidance: We may use aggregated or de‑identified portions of intake data (e.g., areas to avoid, treatment preferences) to create internal therapist guidance that helps tailor safe and appropriate services. This data is not sold, is not used for third‑party advertising, and is not used to train publicly available AI models.

III. Sharing & Third‑Party Processors

We engage trusted service providers (processors) to perform services on our behalf under written agreements that require appropriate security measures. Primary processors include:

• Microsoft — hosting and secure storage (bot infrastructure).
• Fresha — bookings and intake platform.
• Google — analytics and advertising (Google Analytics 4, Ads).

We maintain Data Processing Agreements with our processors and use appropriate safeguards for any cross‑border transfers.

IV. TDPSA Consumer Rights (Texas Residents)

Texas residents have the following rights under the TDPSA, subject to statutory exceptions:

• Access: Confirm whether we process your personal data and obtain a copy.
• Correction: Request correction of inaccurate personal data.
• Deletion: Request deletion (subject to exceptions such as recordkeeping obligations).
• Opt‑Out: Opt out of targeted advertising, sale, or certain profiling.
• Portability: Receive certain personal data in a portable format.
• Appeal: Appeal a denied request.

Verification & timing: We will verify requests using reasonable methods (for example, verifying account email or recent appointment date) and respond within 45 days (may extend for an additional 45 days where necessary). Contact details are below.

V. Consent & Sensitive Data

We process sensitive health information only with explicit, affirmative consent. Example intake language we use:

Internal guidance use (optional): We may separately use limited, de‑identified elements of intake data (such as treatment preferences or regions marked for caution) to refine internal service safety and technique selection for staff. This processing is confined to quality and safety improvement, excludes payment details, and is never sold or shared externally for advertising. You may opt out of this internal guidance use at any time by emailing privacy@dantaraspa.com; opting out will not affect your ability to receive services.

VI. Cookies, Tracking & Analytics

Your choice: Google Analytics and Google Ads measurement are optional on our public website. They stay blocked until you select “Allow optional” or enable measurement in Cookie settings. Rejecting optional cookies does not prevent you from browsing, contacting us or following a booking link. Use the persistent Cookie settings control to change or withdraw your choice.

Google measurement: If you allow it, Google Analytics measures page visits and interactions, and Google Ads measures actions such as opening directions. Google receives technical request information and may set first-party measurement cookies, including _ga, _ga_* and _gcl_*. This is not a cookieless or server-only implementation. We do not enable Google signals or personalized advertising through these tags. Our website tracking does not send intake responses, health information, chat messages or contact-form contents.

Essential storage: We store your cookie choice in your browser’s local storage for up to 180 days. If browser storage is unavailable, your choice applies only to the current page. Other essential storage may support site operation and your interface preferences. Withdrawing consent removes accessible Google measurement cookies for this site and reloads the page to stop the running tags; it does not erase information previously received by Google.

Global Privacy Control (GPC): When your browser sends a GPC signal, our optional Google measurement stays off, even if you previously allowed it. You can still browse and book normally.

Other services: Google Maps embeds, Fresha booking pages and other linked services may make requests or use cookies under their own policies. Our Cookie settings control Dantara’s Google measurement tags, not those independent services. Fresha manages booking confirmations and its own tracking choices; opening a booking link on our site is not recorded as a confirmed appointment.

How to opt out

• Open Cookie settings and choose “Reject optional.”
• Enable the Global Privacy Control signal in a supported browser.
• Use browser controls to delete stored choices and cookies or block third-party services.
• Send a privacy request to privacy@dantaraspa.com.

VII. Security

• HTTPS/TLS for data in transit
• Access controls, authentication, and role‑based access
• Least‑privilege data access and audit logging
• Vendor management and Data Processing Agreements with processors

VIII. Children

Our site is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe we have collected such data, please contact privacy@dantaraspa.com to request removal.

IX. International Transfers

Personal data processed by our service providers may be transferred to the United States and other countries. Where required, we implement appropriate safeguards (for example, contractual protections) for lawful transfers.

X. Changes to this Policy

We may update this policy to reflect changes in our practices or legal obligations. Material changes will be posted with a revised effective date and, where practical, notified to users.

XI. Contact & Appeals

• Email: privacy@dantaraspa.com
• Web form / opt‑out anchor: /privacy.html#opt-out
• Mail: Dantara Thai Wellness and Spa, Attn: Privacy Compliance, 2535 W Division St Suite A2, Arlington, TX 76012

If you are not satisfied with our response to a privacy request, Texas residents may contact the Office of the Attorney General for the State of Texas.

Definitions

• Controller: the party that determines purposes and means of processing (Dantara).
• Processor: a party that processes personal data on behalf of the controller.
• Sensitive data: e.g., health information or medical conditions.

---

Last updated: October 28, 2025. If you need a copy of this policy in another format, contact privacy@dantaraspa.com.