Privacy Policy

• Account information: your name, work email address and role (member, administrator or owner). Accounts are created by an administrator; your password is handled by our authentication provider and stored only as a secure hash – we never see it.
• Profile photo (optional): if you upload one, it is cropped in your browser and stored as a small image.
• Bookings: the rooms you book, meeting titles, notes, times, and the people you invite, together with their replies (going, awaiting reply, declined).
• Google account information (only if you choose “Connect Gmail”): your Gmail address and an access token that lets the app send email from your Gmail. See section 3.
• Preferences and technical data: your language choice, and the cookies described in section 7. Our hosting providers keep standard server logs (such as IP address and time of a request) for security and troubleshooting.

We do not sell your information, use it for advertising, or share it with anyone outside the purposes in this policy.

• To let you sign in, book rooms, see availability and manage your bookings.
• To show other signed-in colleagues who has booked a room (organizer name, meeting title, time and room), so everyone can plan around each other.
• To send invitation, cancellation and password-reset emails.
• To keep the service secure, prevent double bookings and fix problems.

Connecting Gmail is optional. If you connect it from your profile page, Google asks you to allow KFT BookRoom to “send email on your behalf” (the gmail.send permission) and to share your email address.

• What we access: only permission to send email, plus your Gmail address. We cannot read, search, change or delete any of your email, contacts or other Google data.
• How we use it: only to send the meeting invitations and cancellation notices that you trigger in the app (for meetings you organize), so they arrive from your own address and appear in your Sent folder. Nothing is sent without an action by you or an administrator acting on your booking.
• Storage: the access token Google gives us is encrypted (AES-256) before it is stored in our database. It is kept in a table that no browser or other user can read, and it is used only by our server.
• Sharing: we do not share, sell or transfer Google user data to anyone, and we do not use it for advertising, for building user profiles, or to train artificial-intelligence or machine-learning models.
• Human access: no person reads the content of the emails sent through your Gmail, except when you ask us for help, when it is needed for security, or when the law requires it.
• Removal: click “Disconnect” on your profile page at any time. We revoke the permission at Google and delete the stored token immediately. You can also remove access at myaccount.google.com/permissions; the app then stops using it. Deleting your account deletes it too.

KFT BookRoom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Signed-in colleagues can see room bookings (organizer, title, time and room) and the names of people in the directory used for invitations.
• Guest lists and replies are visible only to the meeting organizer, the people invited, and administrators.
• Administrators and the owner can manage accounts, rooms and bookings.
• Service providers who run the app for us (section 5) process data only on our instructions.

These providers may process data outside Cambodia. We choose providers that protect data with industry-standard security.

• Supabase – database, sign-in and file storage (servers in Singapore).
• Vercel – web hosting (servers in Singapore).
• Google – the Gmail API (only if you connect Gmail), our email delivery account, and Google Maps links for the office location.

• Account and booking data: while your account exists. Cancelled bookings are kept as history.
• When an administrator deletes your account, your profile, bookings, invitations and any connected Gmail token are deleted.
• Gmail tokens: until you disconnect, revoke access at Google, or your account is deleted.

We use only what the app needs to work – no advertising or analytics trackers:

• A sign-in session cookie that keeps you logged in.
• A language cookie and a browser storage entry that remember English or Khmer.
• A short-lived security cookie during “Connect Gmail”, deleted when the connection finishes.

Data is sent over encrypted connections (HTTPS). Access to data is controlled by database rules, so each person only reaches what their role allows. Google tokens are encrypted at rest. No system is perfectly secure, but we work to protect your information and fix issues quickly.

• See and correct your name and photo on your profile page; change your password there at any time.
• Disconnect Gmail at any time.
• Ask us for a copy of your data, or to correct or delete it, by writing to thongmengdeva@gmail.com.

KFT BookRoom is a workplace tool and is not intended for children under 16.

We may update this policy. The date at the top shows the latest version; for important changes we will tell users in the app.

Questions or requests about privacy: KFT CO., LTD., thongmengdeva@gmail.com.