Privacy notice

1. Data controller

[TODO_LAUNCH registered company name], registration number [TODO_LAUNCH], address [TODO_LAUNCH registered address].

Contact for personal-data matters: privacy@boonmangcloud.com or the LINE Official Account in the footer.

2. What we collect and why

• Contact form: name, phone or LINE ID, email (if given), business type and the details you enter, so we can reply about the service you asked about. Legal basis: the consent you give via the checkbox on the form.
• Project brief on the quote page: your name, contact channel, email (if given) and the project details you enter, such as the domain, what the site is for, what material you have and when you need it, together with the price options you selected, so we can prepare a quote and contact you about that project. It is forwarded to our email and LINE and is not stored on the website. Legal basis: the consent you give via the checkbox on the form.
• Chat on the website (the Chat with us button): your name, the topic you pick, how to reach you (LINE ID or email), the message you type and the page you opened the chat on, so we can reply about your enquiry. It is forwarded to our email and LINE, and kept on our systems for up to 30 days under your reference code so that our LINE Official Account can show you a summary as soon as you send that code in the chat. Your IP address is kept temporarily for up to one hour to limit sending to 3 messages per hour. If you choose to be answered by email, we send one confirmation to that address (at most one a day per address) and keep a hash of the address for up to 24 hours so it is not sent twice. Legal basis: the consent you give via the checkbox in the chat; for the IP address, legitimate interest in preventing spam.
• The website check on the homepage: the domain you enter is used to send one request to that site and show you the result. We do not record the domain together with anything that identifies you. We keep only aggregate daily counts, and your IP address temporarily for up to one hour to enforce the limit of 5 checks per hour. Legal basis: legitimate interest in preventing abuse.
• Contact via LINE: what you send to our LINE Official Account is processed by LINE Corporation under LINE's policies and by us to answer you. Our automatic reply reads messages for a reference code from the website; when it finds one, it links that code to your LINE account (kept as a hash of your LINE user ID for up to 30 days) and replies with a summary of what you sent on the website. Legal basis: steps taken at your request before entering a contract.
• Analytics cookies (Google Analytics 4): run only after you accept them in the cookie banner. They record pages viewed, duration, device and approximate location (anonymised, full IP collection disabled). Legal basis: consent, withdrawable at any time via the Cookie settings link in the footer.
• Server logs: our hosting provider keeps request logs (IP, URL, time, browser) for security and troubleshooting for up to 30 days. Legal basis: legitimate interest in system security.
• Client data when contracting: name, address, tax ID and payment details for invoicing and tax compliance. Legal basis: performance of a contract and legal obligation.

3. Cookies

This site uses two kinds of cookies: (1) necessary cookies, used only to remember your consent choice, and (2) analytics cookies (Google Analytics 4), which run only with consent.

You can change your choice at any time from the Cookie settings link at the bottom of every page. Declining analytics does not affect the site.

4. Retention

• Contact form and website chat data: no more than 24 months after the last contact, unless a contract follows, in which case for the contract term and as accounting law requires (up to 10 years)
• IP addresses for rate limiting: no more than 1 hour
• A hash of your email address, to avoid sending the confirmation twice: no more than 24 hours
• Website chat details awaiting a LINE match, and the hash of the LINE user ID a reference code is linked to: no more than 30 days
• Server logs: no more than 30 days
• Analytics data: per the Google Analytics setting of 14 months

5. Processors and international transfers

We use the following providers, some outside Thailand, each with data-protection safeguards to international standards:

• Vercel Inc. (USA): hosting and server logs
• Upstash (USA): counters for rate limiting (temporary IP), the confirmation-email hash, and website chat details awaiting a LINE match (up to 30 days), only when enabled
• Resend (USA): delivers contact-form and chat messages to our email, and the confirmation email to you when you choose email
• LINE Corporation (Japan/Thailand): LINE Official Account and form notifications
• Google LLC (USA): Google Analytics 4, only with consent
• Cloudflare Inc. (USA): Turnstile spam protection on the form

6. Your rights

Under PDPA you have the following rights, which we act on within 30 days of a request:

• Access and obtain a copy of your personal data
• Have inaccurate data corrected
• Have data erased when it is no longer needed
• Restrict processing
• Receive your data in a machine-readable format
• Object to collection, use or disclosure
• Withdraw consent at any time, without affecting prior processing
• Complain to the Personal Data Protection Committee office if you believe we have not complied with the law

7. Security

All data travels over encrypted connections (HTTPS), the site sets a full set of security headers, and access to form submissions is limited to the people who answer them. We never store payment-card data on our systems.

8. Changes

We may update this notice from time to time. The current version always shows its last-updated date at the top. Material changes will be announced on this page.