Privacy Policy

1. What we collect

• Account details: name, email address, phone number, role (buyer or maker) and how you sign in (email code, password, Google, LINE or Apple). From Google, LINE or Apple we receive only your name, email and profile picture.
• Order details: the pieces you buy, delivery name, address and phone number, delivery notes and order history.
• Payment data: handled by Stripe. We receive the payment status and the last digits / brand of your card, never your full card number.
• Maker details: studio name, location, portfolio and workshop photos, listings, verification documents, and the bank or PromptPay details we use to pay you.
• Messages and content: commission requests, price offers, messages with makers, reviews, and chat messages sent during live shows.
• Live video: if you host a live show, your camera and microphone are streamed to viewers in real time. Shows are not recorded.
• Technical data: device and browser type, IP address, pages viewed and error reports, used to keep the service secure and working.

2. Why we use it (and our legal basis)

• To provide the service you ask for — accounts, orders, payment, delivery, commissions, messaging and live shows (performance of a contract).
• To pay makers and keep accounting and tax records (legal obligation).
• To keep Baan safe, prevent fraud and abuse, verify makers and fix errors (legitimate interests).
• To send transactional emails about your orders, offers, payouts and account (performance of a contract).
• To send newsletters or marketing — only if you opt in, and you can unsubscribe at any time (consent).

3. Who we share it with

We share personal data only as needed to run Baan, and we never sell it:

• The maker fulfilling your order receives your name, delivery address, phone number and order details.
• Buyers see a maker’s public studio profile, listings and reviews.
• Service providers acting on our instructions: Stripe (payments), Supabase (database and sign-in), Vercel (website hosting and privacy-friendly analytics), Cloudflare (live video), Resend (email), Sentry (error monitoring), and Google, LINE or Apple if you sign in with them.
• Authorities, where the law requires it.

4. International transfers

Some of these providers store or process data outside Thailand — for example in South Korea (our database), Singapore, the United States or the European Union. Where we transfer data abroad we rely on providers with appropriate safeguards (such as standard contractual clauses), as required by the PDPA.

5. Cookies & similar technology

We use essential cookies to keep you signed in, remember your cart and your language. Our analytics (Vercel Web Analytics) are cookie-free and don’t track you across other sites. You can clear or block cookies in your browser, but some parts of Baan won’t work without the essential ones.

6. How long we keep it

• Account data: while your account is open, and deleted or anonymised within 90 days after you close it.
• Orders, payments and payouts: 5 years from the end of the accounting period, as required by Thai accounting and tax law.
• Messages and live chat: while your account is open, or until deleted by you or a host.
• Error reports and technical logs: up to 90 days.

7. Security

Data is encrypted in transit, access is restricted with row-level security so people only see what they’re allowed to, and payment details are handled by Stripe (PCI-DSS certified). No system is perfectly secure, but we take reasonable measures and will notify you and the authorities of a data breach where the PDPA requires it.

8. Your rights

Under the PDPA you have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have your data deleted, or its use restricted;
• receive your data in a portable format;
• object to processing based on our legitimate interests or for marketing;
• withdraw consent at any time (this doesn’t affect processing before you withdrew it);
• complain to the Office of the Personal Data Protection Committee (PDPC) in Thailand.

9. How to make a request

Email support@baan-th.com from the email address on your account. We’ll respond within 30 days. You can also update most of your details yourself under Account.

10. Children

Baan is not intended for children under 18 without the involvement of a parent or guardian, and we don’t knowingly collect their data.

11. Changes

We may update this policy as Baan grows. We’ll post the new version here with a revised date, and let you know of significant changes by email or in the app.