How we handle your details.

Optional AI treatment guide

If you send a message to the AI guide, your messages and the public treatment menu are sent to OpenAI to interpret your preferences. Please leave out names, contact details and medical information. You can always browse and book without using AI.

By using the chat after the training notice, you agree that Lavella may retain and review conversations for team training, quality improvement and understanding demand for treatments. Only administrators can read them. We automatically mask personal details. When personal health information is detected, we retain only an explicitly named neutral treatment interest where possible, such as pregnancy massage, and omit the private health details. Other messages in the conversation remain available. Automatic masking is not perfect, so please do not enter sensitive information. Conversations and related statistics are retained for 30 days and removed by our hourly cleanup. Earlier conversations were not saved. We do not automatically add treatments or change business policies based on chats.

We measure chat openings, language, broad device category, requests, suggested treatments, response speed, usage and estimated cost, and clicks to booking or WhatsApp. A signed first-party cookie lasting up to 24 hours links a booking click to a booking created through the site. The reporting views do not show booking contact details. WhatsApp clicks do not reveal whether a message was sent. Chat text is not sent to Google Analytics or Meta. Short-lived request counters and daily hashed network identifiers limit abuse and cost.

We request no stored response from OpenAI. OpenAI may still retain API data in abuse-monitoring logs for up to 30 days under its standard policies. API data is not used for model training by default. Processing may take place outside Thailand. The guide cannot assess medical suitability or make a reservation.

What we collect

• Bookings and visits: your name, email, phone or WhatsApp number, treatment, date and time, guest count, therapist preference and any notes you provide. Reception also records your visit, payments and any tip.
• Payments and gift vouchers: amounts, payment and refund references, the buyer’s details, recipient’s name and personal message. Full card details are handled by Stripe, not stored by Lavella.
• Enquiries: your name, email and message, delivered to our inbox. Please only include information needed to answer your question or arrange your treatment.
• Lavella Locals members: contact details, membership information and your choice about receiving member offers.
• Website use: browser and advertising identifiers, pages and booking events, and technical information used to operate and protect the website. Advertising measurement is explained below.

Why we use it

We use booking and payment details to arrange your visit, reserve a room and therapist, process deposits, vouchers and refunds, and send confirmations and reminders. Required contact and booking fields are needed to arrange an online booking; without them we cannot complete it.

We also answer enquiries, keep financial records, manage reception and therapist payments, and measure how our website and advertising perform. A guest who provides an email address may receive one review request after a visit. Member marketing emails are only sent to members who opted in.

Bookings and purchases are processed to provide the service you request. Financial records also support legal obligations. Enquiries, security and day-to-day administration support our legitimate business interests. You can withdraw consent for member marketing at any time by contacting us.

Who receives information

Authorised staff use information needed for their work. We also use the following services. Some providers process information outside Thailand, including in Singapore, the United States and Europe.

• Stripe handles online payments and the payment details you enter at checkout.
• Resend delivers confirmations, reminders, vouchers and review-request emails. Make passes booking details to our reception planning and messaging tools.
• Vercel hosts lavellaspa.com. Neon hosts the booking database in Singapore.
• Anthropic and OpenAI support optional staff AI tools. Text, images or audio submitted by staff can include guest information needed for that task.
• Google Analytics, Google Ads and Meta receive website or conversion information for measurement and advertising. See the next section for the data involved.
• Google Maps, Instagram, Facebook and WhatsApp apply their own privacy policies when you open or use those services.

Cookies and advertising measurement

A first-party cookie lasting up to 30 days records the first and most recent source of a visit, campaign labels and advertising click identifiers. When you book, we save this source with the booking to measure completed treatment revenue and therapist commission. A short-lived cookie also carries the current Google Analytics session for immediate booking confirmations. These records are cleared with the booking’s advertising identifiers.

On lavellaspa.com, Google Analytics and the Meta pixel load through Google Tag Manager after the page loads. They use cookies and identifiers to measure visits and advertising results. The current website does not show a cookie-choice banner.

The booking system also reports website booking confirmations and cancellations to Google and Meta. These reports include booking value, treatment and identifiers. Meta can receive hashed email addresses and phone numbers to match bookings with advertising activity. Hashing is not the same as making data anonymous.

You can block cookies in your browser and use Google’s and Meta’s privacy or advertising controls. Booking does not require advertising cookies. Blocking browser cookies does not by itself stop reports sent by the booking system; contact us if you wish to object to the use of your details for advertising measurement.

How long information stays

• Booking contact details, notes and advertising identifiers are cleared in the annual clean-up for visits more than three years old. This means removal normally happens between three and four years after the visit. Financial and treatment records remain for accounting and reporting.
• Buyer and recipient details on redeemed or cancelled vouchers are cleared in the annual clean-up once the voucher record is more than four years old. Other voucher records are retained while their status or remaining value needs to be resolved.
• Membership information remains until the membership is removed. Reception audit records are cleared after twelve months through a monthly clean-up.
• Enquiry emails remain in our inbox for handling and follow-up. Copies held by email, payment, messaging and hosting providers follow their own retention settings and any applicable legal requirements.

Your rights and choices

You can ask to access or receive a copy of your information, correct it, delete it, restrict its use or object to processing. Where applicable, you can request data portability or withdraw consent. These rights are subject to legal conditions; some financial records may need to be retained.

Email info@lavellaspa.com, preferably from the address used for your booking. We may ask for information to verify your identity. Tell us which request you want to make, including if it concerns information held in our messaging or other service providers. You can also raise a complaint with Thailand’s Personal Data Protection Committee.

To change or cancel an appointment, use the booking-management link in your confirmation email or contact the spa.

Contact Lavella Spa