Privacy Policy

This Privacy Policy explains how Upnshop ("Upnshop", "we", "us") — a booking platform operated by 李宛芸 — collects, uses, retains, and protects the personal data you provide on the upnshop.com platform and the booking websites it hosts.

Upnshop provides platform services that let businesses create booking websites and manage appointments, and let customers book online.

For account data, platform-usage data, and the platform-operation data described in this Policy, we are the data controller. For the bookings you make with a business and the customer data that business manages, that business is an independent data controller and is responsible for complying with the personal-data-protection laws applicable in its own jurisdiction.

Based in: Tainan City, Taiwan

Privacy contact: [email protected]

1. Data we collect

Account data
Name, email address, phone number, and a password stored using secure hashing.

Booking data
The bookings you make, including the business, service, staff member, date, time, and any notes or other personal-data fields the business asks you to provide.

We collect only the personal data necessary to provide the service, and do not ask you for information unrelated to the service.

Sign in with Google
If you choose to sign in with your Google account, we receive the following from Google:

• Name
• Email address
• Google account identifier (Google User ID)

We do not receive or store your Google password.

We use this information only to create and verify your account and, where you have explicitly authorised it, to store the relevant access tokens needed to provide the feature you enabled.

Unless you separately authorise it, we do not access your Gmail, Google Drive, Google Calendar, or other Google account data.

Technical and usage data
We may automatically collect:

• IP address
• Browser type
• Operating system
• Device information
• Usage logs
• Website analytics data
• Cookies and related technical information

to help us keep the platform secure, improve service quality, and analyse how the platform is used.

2. How and why we use your data

We may use your personal data for the following purposes:

• creating, managing, and verifying your account (including Google sign-in);
• creating, confirming, modifying, and cancelling bookings;
• sending you notices relating to bookings, account security, service updates, important operational matters, and other notices necessary to provide the service;
• providing customer support;
• maintaining platform security and preventing fraud, abuse, and unauthorised access;
• maintaining, improving, and developing platform features;
• meeting legal obligations and handling disputes.

We process your personal data on the following legal bases:

• performing the service you request;
• complying with legal obligations;
• protecting platform security and our legitimate interests;
• your consent, where required by law;
• other bases permitted by the Personal Data Protection Act and other applicable laws.

3. Who we share your data with

We may share your personal data to the extent necessary:

The business you book with
Your booking information and the contact details needed to fulfil the booking are provided to the business you book with.

For the data it collects and manages, the business is an independent data controller, responsible for complying with applicable personal-data-protection laws, and for how it collects, uses, retains, and manages that data.

Third-party service providers
To provide and improve the platform, we may use third-party service providers, such as:

• cloud hosting
• database services
• email delivery services
• website analytics tools
• sign-in / authentication services (including Google)
• other services required to operate the platform

These providers may process your data only on our instructions and must take appropriate security measures to protect your personal data.

Third-party links
The platform may contain links to third-party websites or services, whose privacy policies and data practices are the responsibility of those third parties.

Google
If you use Google sign-in or other Google integrations you have actively enabled, we exchange the information necessary for that feature with Google.

Government authorities
Where required by law or lawfully requested by a competent authority, we may provide relevant data as required by law.

We do not sell, rent, or trade your personal data, nor provide it to third parties for their own marketing purposes.

4. International transfers

Our platform infrastructure, data centres, or some service providers may be located in countries or regions outside your own.

Where your personal data is transferred across borders, we take appropriate safeguards as required by applicable law to ensure your data remains reasonably protected.

5. Data retention

We retain your personal data for as long as your account is active and for the period necessary to provide the service.

After that, we may continue to retain relevant data for the period necessary to meet legal, accounting, tax, dispute-resolution, or other statutory obligations.

Once the retention period ends, we delete, anonymise, or otherwise handle your personal data in accordance with law.

6. Your rights

To the extent permitted by applicable law, you may:

• inquire about or request access to your personal data;
• request that data be supplemented or corrected;
• request deletion of data;
• withdraw your consent (where applicable);
• exercise other data-related rights provided by law.

You may also request deletion of your account at any time.

We will retain data required by law; the remainder will be deleted or anonymised within a reasonable period.

If you have made bookings with a business, that booking data may still be retained by the business under its own legal obligations or operational needs. To exercise rights relating to that data, please contact the business directly.

To exercise these rights, contact: [email protected]

We will respond to your request within a reasonable time and complete processing within the period required by law.

7. Cookies

We may use cookies and similar technologies, including:

• essential cookies (sign-in, account verification, and platform security);
• functional cookies (saving your preferences);
• analytics cookies (e.g. website traffic analysis, where enabled).

You can manage non-essential cookies through your browser settings or any cookie controls we provide.

8. Security

We take reasonable technical and organisational measures to protect your personal data, including but not limited to:

• encryption in transit
• secure password hashing
• access controls
• system monitoring
• security updates

However, no method of transmission over the internet or electronic storage can be guaranteed 100% secure.

If an incident occurs that may affect the security of your personal data, we will take the measures required by applicable law and, where necessary, notify affected users and the competent authorities.

9. Children

The platform is not directed to children below the age of consent required in their jurisdiction.

We do not knowingly collect the personal data of minors without appropriate consent.

10. Changes to this policy

We may update this Privacy Policy from time to time.

The updated version will be posted on this page, and the "Last updated" date above will be revised.

Where required by law, we will separately notify you of material changes.

11. Contact

If you have any questions, suggestions, or requests to exercise your rights regarding this Policy or your personal data, please contact:

李宛芸 (operating as Upnshop)
Tainan City, Taiwan
Email: [email protected]