Privacy Notice
Last updated: 8 October 2026
This notice explains what personal data Thai Massage Reviews (thai-info.massageguide.hu, “the site”) collects, why, how long it is kept, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Data controller
Always Amber Ltd
Lispole, Co. Kerry, Ireland
Email: privacy@alwaysamber.ie
Please contact us at this address with any question or request about your personal data.
2. What we collect and why
- Account details
- Username, email address, password (stored only as a one-way hash, never in readable form), preferred language,
the date you registered, whether your email address is confirmed, your member rank, and your member group
(set by the invite code you used, if any).
Why: to create and run your account, confirm your email address and let you log in. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)). - Reviews, comments and photos
- The ratings, prices, comments, questions and photos you submit. They are shown to logged-in members together
with your username and rank (photos only to members of “User” rank and above). Location data and other
metadata are removed from photos when they are uploaded.
Why: to publish reviews, which is the purpose of the site. Legal basis: performance of our contract with you (Art. 6(1)(b)). - IP address and hostname
- When you register, submit or edit a review, or post a comment, we store your IP address and its reverse-DNS
hostname.
Why: to prevent abuse, such as fake reviews, duplicate accounts and spam, and to investigate complaints. Legal basis: our legitimate interest in keeping the site honest and secure (Art. 6(1)(f)). - Emails
- We send you account emails (email confirmation, password reset) and notifications when someone comments on
one of your reviews. We do not send marketing emails.
Legal basis: performance of our contract with you (Art. 6(1)(b)). - Server logs
- Like any website, our server records technical information about requests (such as IP address, time and
page) to operate the service and diagnose faults.
Legal basis: legitimate interest in running a secure, working website (Art. 6(1)(f)).
We do not use your data for advertising or profiling, and we do not sell it.
3. Venues and masseuses who are reviewed
The site lists massage venues (name, address, phone number, website and social media links) and the names, usually working names, of masseuses, together with members’ reviews of them. This information comes from members, from our editors and from publicly available sources such as business listings. We publish it on the basis of our legitimate interest, and that of our members, in sharing honest consumer experiences (Art. 6(1)(f)). Reviews are visible only to registered members.
If you are a venue owner or a masseuse and want information about you corrected or removed, or you object to its publication, please email privacy@alwaysamber.ie. We will review every request and remove content that is inaccurate, unlawful or not justified by the interests above.
4. Cookies
We only use cookies that are strictly necessary for the site to work. We do not use analytics, third-party tracking or advertising cookies, so no cookie consent banner is needed.
| Cookie | Purpose | Duration |
|---|---|---|
sid | Session cookie: keeps you logged in and protects forms against forged submissions (CSRF). | 30 days |
lang | Remembers your choice of language (Hungarian / English). | 1 year |
invite | Remembers the invite code from an invite link, so it can be filled in on the registration form. | 30 days |
To protect the registration form against automated spam sign-ups, we may use Cloudflare Turnstile. It checks whether a visitor is a human, using technical signals such as the IP address and browser information, and may set cookies that are strictly necessary for that purpose. See the Turnstile Privacy Addendum and Cloudflare’s Privacy Policy.
5. Who we share data with
We use the following service providers (data processors), which process personal data only on our instructions:
- Hosting provider: stores the site, its database and uploaded photos on our server.
- Mailgun (Mailgun Technologies, Inc., part of Sinch), using its EU region: delivers our emails. Your email address and the content of the email are processed for delivery. Privacy policy.
- Cloudflare (only if Turnstile is enabled, see section 4).
Where a provider processes data outside the European Economic Area, the transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework. We may also disclose data where required by law, for example to a court or the police.
6. How long we keep data
- Account, reviews, comments, photos: for as long as your account exists. When your account is deleted, your reviews, comments and photos are deleted with it.
- IP addresses and hostnames: for as long as the related account, review or comment exists.
- Login sessions: up to 30 days. Email confirmation links: 24 hours. Password reset links: 1 hour.
- Accounts whose email address is never confirmed may be deleted.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted, including your whole account;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on our legitimate interests.
To use any of these rights, email privacy@alwaysamber.ie from the email address on your account. We will reply within one month. You can delete your own comments on the site at any time.
You can also complain to a data protection authority: in Ireland, the Data Protection Commission (our lead supervisory authority); in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH); or the authority in the EU country where you live.
8. Security
The site is served only over an encrypted connection (HTTPS). Passwords are stored as one-way hashes, and access to the database and administration area is restricted.
9. Age limit
The site is for adults only. You must be at least 18 to register. We do not knowingly collect data about anyone under 18.
10. Changes to this notice
We may update this notice, for example when we add a new service provider. The date at the top shows when it last changed. Significant changes will be announced on the site.