Privacy Policy - Bangkok Through My Eyes
This Privacy Policy explains how the independent sole operator of the website located at bangkoktme.com and the brand "Bangkok Through My Eyes" ("we", "us", "our", or the "Operator") collects, uses, discloses, transfers, and protects personal data when you access or use our website, content, features, accounts, and services (collectively, the "Service"), and describes your privacy rights and how to exercise them.
This Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meaning given to them in the Terms of Service.
1. Data Controller and Contact
1.1 For the purposes of the EU General Data Protection Regulation (the "GDPR"), the UK GDPR, and other applicable data-protection laws, the Operator is the "controller" of the personal data processed in connection with the Service. We operate as an independent sole operator; we do not publish the name or physical address of any individual operator in this Policy.
1.2 You may contact us regarding privacy matters, or to exercise your rights, at:
- Privacy and general: connect@bangkoktme.com
- Support telephone: +66 83 246 5737
- Billing-related data: billing@bangkoktme.com
1.3 We will respond to privacy requests within the timeframes required by applicable law. We may need to verify your identity before acting on a request, as described in Section 11.
2. Scope
This Policy applies to personal data we process about Users and visitors of the Service. It does not apply to the data-processing practices of third parties whose websites, applications, or services you may access through links or integrations on the Service, including any Third-Party Services described in our Terms of Service. We encourage you to review the privacy policies of those third parties.
3. Personal Data We Collect
We collect the following categories of personal data:
3.1 Account data. When you create an account, our authentication provider processes your email address and an associated password credential (stored in hashed/secured form by the provider, not in plain text by us). We may also process an account identifier and the date your account was created.
3.2 Profile and preference data. Information associated with your account and your use of the Service, including your selected plan or membership tier, your language and theme preferences, your saved favorites, and the itineraries you build using the "My Trip" feature.
3.3 User-generated content. Content you choose to submit, such as community reviews, ratings, comments, and any text or information contained in them. Please remember that User Content you post publicly may be visible to others; do not include sensitive personal information in your User Content.
3.4 Approximate geolocation data. At or around the time of signup, and in connection with analytics, we may derive an approximate location (such as country and city) from your IP address. If you choose to enable location-based features (such as distance-to-venue search), then, with your explicit consent given through your browser, we access your device's geolocation to calculate distances and travel times. This precise location is used only to provide the feature in your browser; it is not stored on our servers or shared with third parties, and you can turn it off at any time.
3.5 Usage and analytics data. Information about how you interact with the Service, such as pages and content viewed, referring and exit pages, links and features used, the date and time of your visit, and similar engagement signals, collected through our self-hosted, privacy-friendly analytics described in Section 7.
3.6 Device and technical data. Technical information automatically generated when you use the Service, such as your IP address (which may be truncated, hashed, or otherwise minimized by our analytics), browser type and version, device type, operating system, screen characteristics, and language settings.
3.7 Payment-related data. If you purchase a Paid Membership, payment is processed by Paddle.com ("Paddle"), which acts as the Merchant of Record. We do not collect or store your full payment card number, CVV, or bank account details. Paddle and its payment processors handle that information directly. We may receive from Paddle limited transaction-related data, such as a transaction or subscription identifier, the product purchased, the billing country, the amount and currency, the partial/last digits or type of payment instrument, and the status of the transaction (e.g., succeeded, renewed, refunded, charged back).
3.8 Communications data. If you contact us (for example, by email to one of our contact addresses), we process the information you provide, including your email address and the contents of your message, in order to respond and keep a record of the correspondence.
3.9 Cookies and similar technologies. Information collected through cookies and local storage, as described in Section 6.
3.10 We do not intentionally collect special categories of personal data (such as data revealing health, religion, political opinions, or sexual orientation). Please do not submit such data through the Service, including in your User Content.
4. How and Why We Use Personal Data (Purposes and Legal Bases)
We process personal data for the purposes set out below. Where the GDPR or UK GDPR applies, we rely on the legal bases indicated.
4.1 To provide and operate the Service — including creating and authenticating your account, enabling favorites, "My Trip", and community reviews, and delivering content and features. Legal basis: performance of a contract with you (Article 6(1)(b)); and our legitimate interests in operating the Service (Article 6(1)(f)).
4.2 To process payments and manage Paid Memberships — including provisioning access, handling renewals, and reconciling transactions with Paddle. Legal basis: performance of a contract (Article 6(1)(b)); and compliance with legal obligations such as tax and accounting (Article 6(1)(c)).
4.3 To personalize your experience — such as remembering your language and theme preferences. Legal basis: performance of a contract (Article 6(1)(b)) and/or your consent (Article 6(1)(a)) and/or our legitimate interests (Article 6(1)(f)).
4.4 To measure and improve the Service — using privacy-friendly analytics to understand aggregate usage, diagnose problems, and improve content and performance. Legal basis: our legitimate interests in understanding and improving the Service (Article 6(1)(f)); where required by applicable law, your consent (Article 6(1)(a)).
4.5 To approximate your location for relevance, fraud prevention, and analytics. Legal basis: our legitimate interests (Article 6(1)(f)); where required, your consent (Article 6(1)(a)).
4.6 To communicate with you — including responding to inquiries, sending service-related and transactional messages, and providing important notices about the Service, your account, or these terms. Legal basis: performance of a contract (Article 6(1)(b)); our legitimate interests (Article 6(1)(f)); and, where required for non-transactional marketing, your consent (Article 6(1)(a)).
4.7 To moderate content and enforce our terms — including reviewing, screening, and removing User Content, and detecting, investigating, and preventing prohibited conduct, fraud, abuse, and security incidents. Legal basis: our legitimate interests in protecting the Service, our Users, and third parties (Article 6(1)(f)); and compliance with legal obligations (Article 6(1)(c)).
4.8 To provide AI-assisted features and generate content — certain features and news imagery are produced using third-party artificial-intelligence services (see Section 8). Where these features involve personal data, we process it on the basis of our legitimate interests in offering and operating such features (Article 6(1)(f)) and/or your consent (Article 6(1)(a)) where required. We do not use your account data or User Content to train third-party AI models except as necessary to provide a feature you have requested.
4.9 To comply with law and protect rights — including responding to lawful requests, establishing, exercising, or defending legal claims, and protecting the rights, property, and safety of the Operator, our Users, and the public. Legal basis: compliance with legal obligations (Article 6(1)(c)); and our legitimate interests (Article 6(1)(f)).
4.10 Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing as described in Section 10.
5. How We Share Personal Data
5.1 We do not sell your personal data for money. We share personal data only as described below:
(a) Service providers / processors. With third parties that process personal data on our behalf to operate the Service, as listed in Section 8. These providers are authorized to use personal data only as necessary to provide their services to us.
(b) Payments. With Paddle (as Merchant of Record) and its payment processors, to process your purchases and manage subscriptions. Paddle processes your payment data as an independent controller under its own privacy policy.
(c) Public User Content. Where you post community reviews or other User Content intended to be public, that content (and any information you include in it, together with any associated public display name) is shared with and visible to other Users and visitors.
(d) Legal and safety. With courts, regulators, law-enforcement, or other authorities, and with our professional advisors, where we believe in good faith that disclosure is necessary to comply with applicable law or legal process, to enforce our Terms, or to protect the rights, property, or safety of the Operator, our Users, or others.
(e) Business transfers. In connection with, or during negotiations of, any merger, acquisition, financing, reorganization, sale of assets, or other business transaction, personal data may be transferred to the relevant successor or acquirer, subject to this Policy.
5.2 We may also share aggregated or de-identified information that cannot reasonably be used to identify you.
6. Cookies and Similar Technologies
6.1 We use cookies and browser local storage ("Cookies") to operate the Service, remember your preferences, and measure usage. Cookies fall into the following categories:
(a) Strictly necessary — required for the Service to function, including authentication and maintaining your logged-in session, and security. These cannot be switched off through our systems without impairing the Service.
(b) Preferences — used to remember choices you make, such as your language and theme, to provide a more personalized experience.
(c) Analytics — used by our self-hosted analytics (see Section 7) to understand how the Service is used in an aggregate, privacy-friendly manner. We do not use Cookies for cross-site tracking or third-party advertising.
6.2 How to control Cookies. You can control and delete Cookies through your browser settings, and you can clear local storage maintained by the Service. Most browsers allow you to refuse or delete cookies; however, if you block strictly necessary Cookies, parts of the Service (including login) may not work properly. Where required by applicable law, we will request your consent before setting non-essential Cookies and will provide a mechanism to manage your choices.
7. Analytics
We use Umami, a privacy-friendly web-analytics tool that we host ourselves ("self-hosted"), to understand aggregate usage of the Service. Umami is designed to minimize personal data, does not use cross-site tracking, and does not build advertising profiles. The analytics data we collect is described in Sections 3.5 and 3.6 and is used for the purposes in Section 4.4.
8. Third-Party Processors and Service Providers
We rely on the following categories of third-party providers, which may process personal data on our behalf or in connection with the Service. Some of these providers are located, or process data, outside the European Economic Area ("EEA"), the United Kingdom, or your country of residence (see Section 9).
8.1 Authentication and database (Supabase). Provides user authentication and database/storage services that hold account data, profile and preference data, favorites, "My Trip" itineraries, and User Content.
8.2 Hosting and content delivery (Netlify). Provides website hosting and content-delivery-network services to serve the Service to you; processes technical and connection data such as IP addresses and request metadata.
8.3 Payments (Paddle). Acts as Merchant of Record and processes payments and subscription billing. Paddle is an independent controller of the payment data it collects directly from you.
8.4 Analytics (Umami — self-hosted by us). Provides aggregate, privacy-friendly usage analytics as described in Section 7.
8.5 Artificial-intelligence services (Anthropic; Hugging Face). Provide AI-model and image-generation capabilities used to power certain features and to generate news imagery and other content. Where a feature you use sends data to these providers, that data is processed to deliver the feature.
8.6 Outbound third-party links (e.g., Grab). The Service contains outbound affiliate, order, and booking links to Third-Party Services (such as ride-hailing and food-ordering providers). When you follow such a link, the relevant third party processes your data under its own privacy policy; we are not responsible for those practices.
8.7 Where required by applicable law, we enter into data-processing agreements with our processors that obligate them to protect personal data and to process it only on our instructions.
9. International Data Transfers
9.1 Because we and our providers operate globally, your personal data may be transferred to, stored in, and processed in countries other than your own, including countries that may not provide the same level of data protection as your jurisdiction.
9.2 Where we transfer personal data originating in the EEA, the United Kingdom, or other jurisdictions with cross-border transfer restrictions to a country that has not been recognized as providing an adequate level of protection, we implement appropriate safeguards as required by applicable law. These safeguards may include the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Agreement or Addendum, where applicable), reliance on adequacy decisions, or other lawful transfer mechanisms. You may request further information about the safeguards we apply by contacting connect@bangkoktme.com.
10. Data Retention
10.1 We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to provide the Service, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements.
10.2 In general: (a) account, profile, and preference data are retained for as long as your account remains active and for a reasonable period afterward; (b) User Content may persist after account closure to the extent necessary for the integrity of the Service or as permitted by the license in our Terms, though we will take reasonable steps to disassociate or remove it on request where required by law; (c) transaction and billing records are retained for the period required by applicable tax and accounting laws; and (d) analytics data is retained in aggregate or minimized form for the period necessary for our analytics purposes.
10.3 When personal data is no longer required, we will delete, anonymize, or de-identify it, or securely restrict its further processing, in accordance with applicable law.
11. Your Privacy Rights
11.1 How to exercise your rights. You may exercise the rights described below by contacting us at connect@bangkoktme.com. We may ask you to verify your identity (for example, by confirming control of the email address associated with your account) before we act on your request, to protect your data from unauthorized access. We will respond within the period required by applicable law. You may also use an authorized agent to submit a request where permitted by law, subject to verification.
11.2 Rights under the GDPR / UK GDPR. If you are located in the EEA, the United Kingdom, or another jurisdiction that grants such rights, you have the right, subject to conditions and exceptions under applicable law, to:
(a) Access — obtain confirmation of whether we process your personal data and a copy of it;
(b) Rectification — have inaccurate or incomplete personal data corrected;
(c) Erasure — request deletion of your personal data ("right to be forgotten") in certain circumstances;
(d) Restriction — request that we restrict the processing of your personal data in certain circumstances;
(e) Portability — receive certain personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where technically feasible;
(f) Object — object to processing based on our legitimate interests, and to object at any time to processing for direct-marketing purposes;
(g) Withdraw consent — where we rely on consent, withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal; and
(h) Lodge a complaint — lodge a complaint with your local data-protection supervisory authority. EEA residents can find their authority via the European Data Protection Board; UK residents may contact the Information Commissioner's Office (ICO). We would, however, appreciate the chance to address your concerns first.
11.3 Rights under California law (CCPA/CPRA). If you are a California resident, you have the right, subject to verification and to exceptions under the California Consumer Privacy Act as amended by the California Privacy Rights Act, to:
(a) Know / Access — request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties with whom we disclose it;
(b) Delete — request deletion of personal information we collected from you, subject to legal exceptions;
(c) Correct — request correction of inaccurate personal information we maintain about you;
(d) Opt out of "sale" or "sharing" — opt out of the "sale" or "sharing" (cross-context behavioral advertising) of personal information; and
(e) Limit use of sensitive personal information — to the extent applicable.
We will not discriminate against you for exercising any of these rights.
11.4 We do not sell your personal information. We do not "sell" personal information for monetary consideration, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under California law. If our practices change, we will update this Policy and provide any required opt-out mechanism.
11.5 Other jurisdictions. Residents of other jurisdictions (including other U.S. states and other countries) may have similar rights under their local laws. Contact us at connect@bangkoktme.com and we will handle your request in accordance with applicable law.
12. "Do Not Track" and Global Privacy Control
Some browsers offer a "Do Not Track" ("DNT") signal. There is no industry-standard response to DNT signals, and because we do not engage in cross-site behavioral tracking, we do not currently respond to DNT signals. Where required by applicable law (including for California residents), we will treat a recognized opt-out preference signal, such as the Global Privacy Control (GPC), as a valid request to opt out of any "sale" or "sharing" of personal information for the browser or device from which it is received, to the extent such processing occurs.
13. Security
13.1 We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction, including reliance on reputable infrastructure providers, encryption in transit, access controls, and the principle of not storing payment-card data ourselves.
13.2 However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, and you provide personal data at your own risk. You are responsible for keeping your account credentials confidential. If you have reason to believe your account or data is no longer secure, please contact us immediately at connect@bangkoktme.com.
14. Children's Privacy
14.1 The Service is intended for adults and is not directed to children. We do not knowingly collect personal data from children under the age of sixteen (16), or under such lower age of digital consent as may apply in your jurisdiction (and in no event under thirteen (13) where U.S. law applies).
14.2 If you are below the applicable minimum age, you must not use the Service or provide any personal data. If we become aware that we have collected personal data from a child below the applicable age without appropriate consent, we will take reasonable steps to delete it. If you believe a child has provided us with personal data, please contact us at connect@bangkoktme.com.
15. Third-Party Links and Services
The Service contains links to and integrations with Third-Party Services that we do not own or control. This Policy does not apply to those third parties. We are not responsible for the privacy practices or content of any Third-Party Service, and we encourage you to review their privacy policies before providing them with personal data.
16. Changes to This Policy
16.1 We may update this Policy from time to time. When we make changes, we will revise the "Last updated" date at the top of this Policy and, where the changes are material, we will take reasonable steps to notify you (for example, by posting a notice on the Service or, where appropriate, by email).
16.2 The updated Policy becomes effective when posted, unless a later effective date is stated. Your continued use of the Service after the updated Policy takes effect constitutes your acknowledgment of it, to the extent permitted by applicable law. Where your consent is required for any new processing, we will obtain it as required.
17. Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Privacy and general: connect@bangkoktme.com
- Support telephone: +66 83 246 5737
- Billing-related data: billing@bangkoktme.com
- Partnerships: partnerships@bangkoktme.com