Privacy Policy
Last updated: 16 July 2026
This Privacy Policy explains how Sorig (“Sorig”, “we”, “us”) collects, uses, shares and protects your personal data when you use the Sorig mobile application, the web app at app.mysorig.com, and this website (together, the “Service”).
Sorig is a marketplace that connects customers with independent spa and wellness providers (“Partner Spas”) in Bhutan. By using the Service you agree to this Policy.
In short: we collect only what we need to let you find spas, make bookings and pay for them. We do not sell your personal data. We do not store your full card details. You can delete your account at any time.
1. Who we are
Sorig is operated by FlexApps. If you have any question about this Policy or about your data, contact us at support@mysorig.com.
2. Data we collect
| Category | What it includes | Why we collect it |
|---|---|---|
| Account & profile | Name, email address, phone number, profile photo, wellness preferences and any health notes you choose to add | To create and secure your account, and to pass your booking details to the Partner Spa |
| Location | Approximate or precise device location, only while you use the app and only with your permission | To show spas near you and power map and distance features |
| Bookings | Services booked, dates and times, therapist selection, notes and special requests | To make, confirm and manage your appointments |
| Payments | Transaction amount, currency, status and the last four digits of your card | To process payments, refunds and receipts |
| Messages & reviews | Chat messages with Partner Spas, ratings, review text and photos | To operate in-app chat and publish reviews |
| Device & usage | Device model, operating system, app version, push notification token, crash and diagnostic logs | To deliver notifications, fix bugs and keep the Service stable and secure |
What we never collect
We do not collect your full card number, CVV or card expiry. Card details are entered directly into our payment processor’s secure form and never reach our servers. We do not collect contacts, photos from your gallery (other than images you deliberately upload), SMS or call logs.
3. Permissions we ask for
- Location — to find spas near you. The app works without it; you can search by name or place instead, and you can revoke this permission at any time in your device settings.
- Camera / photos — only when you choose to set a profile picture or attach a photo to a review.
- Notifications — to send booking confirmations, reminders and offers. You can turn these off at any time.
4. How we use your data
- Create and manage your account and keep it secure
- Show you spas, services and availability, including results near your location
- Process bookings, payments, refunds and cancellations
- Send booking confirmations, reminders and service updates
- Send offers and promotions, where you have not opted out
- Operate reviews, ratings and in-app chat with Partner Spas
- Detect and prevent fraud, abuse and security incidents
- Diagnose crashes and improve the Service
- Comply with legal, tax and accounting obligations
5. Who we share data with
We share personal data only as described below. We do not sell your personal data, and we do not share it with advertisers.
- Partner Spas — when you make a booking, the spa receives your name, contact details, the service booked, your appointment time and any notes you added, so they can prepare for and deliver your treatment. Each Partner Spa is an independent business and is responsible for its own use of that data.
- Stripe — our payment processor, which handles card data and processes transactions on our behalf. See the Stripe Privacy Policy.
- Google — Firebase Cloud Messaging for push notifications and Google Maps for map and location features. See the Google Privacy Policy.
- Hosting and infrastructure providers — who store and serve data on our behalf under contract.
- Authorities — where we are legally required to disclose data, or where disclosure is necessary to protect our rights, users or the public.
- A successor entity — if Sorig is involved in a merger, acquisition or sale of assets, subject to this Policy continuing to apply.
6. Legal bases for processing
Where data protection law requires a legal basis, we rely on: performance of a contract (to provide bookings you request), consent (for location access, notifications and marketing — withdrawable at any time), legitimate interests (to secure, improve and protect the Service), and legal obligation (for tax and compliance records).
7. Data retention
- Account data — kept while your account is active.
- Booking and transaction records — kept for up to 7 years after the booking, where required for tax, accounting and dispute resolution.
- Chat messages and reviews — kept while your account is active; reviews may remain published in anonymised form after deletion.
- Diagnostic logs — typically kept for up to 90 days.
When you delete your account, we delete or anonymise your personal data except where we must retain it by law, as described above.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to withdraw consent at any time. You can:
- View and edit most of your data directly in the app under Profile
- Turn off location or notification permissions in your device settings
- Delete your account in the app under Profile → Delete my account, or by following the steps on our account deletion page
- Contact support@mysorig.com to exercise any right — we respond within 30 days
9. Security
All data is encrypted in transit using HTTPS/TLS. Passwords are stored using one-way hashing, access to production systems is restricted to authorised personnel, and payment card data is handled entirely by our PCI-compliant payment processor. No system is perfectly secure, but we work to protect your data and will notify you and any relevant regulator of a breach affecting your personal data as required by law.
10. Children
The Service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with data, contact support@mysorig.com and we will delete it.
11. International transfers
Sorig operates in Bhutan, and some of our service providers (such as Stripe and Google) process data on servers outside Bhutan. Where data is transferred internationally, we rely on the safeguards those providers put in place, including standard contractual clauses where applicable.
12. Changes to this Policy
We may update this Policy from time to time. We will update the “Last updated” date above and, where the change is significant, notify you in the app or by email before it takes effect.
13. Contact us
Questions, requests or complaints about this Policy or your data:
- Email: support@mysorig.com
- Web: mysorig.com