Privacy policy

[Operator or company name] ("we") runs Sightview, which gathers trends for cafés and other small businesses. This policy explains what personal data we collect, what we use it for and your rights under Thailand's Personal Data Protection Act B.E. 2562 (PDPA). We are the data controller for members' personal data.

1. Data we collect

• Account: your email and password (stored one-way hashed; we cannot see your password).
• Business details: your type of business and province (or "outside Thailand"). We don't ask for your shop's name, address or phone number.
• Acceptance of terms: the version and the date and time you accepted.
• Things you set up: signals you follow, saved chart views, alert channels (your account email, or Slack, Discord or Teams webhook links you paste), your plan, and personal data links (we keep only a hash of each link and when it was last used).
• Technical data: cookies needed to keep you signed in, and system logs such as sign-in times and IP addresses kept by our infrastructure providers for security.

Trends on the board come from public news, official statistics and research. We analyse them only in aggregate, never store the names or profiles of commenters, and never make signals about a single person or shop.

2. What we use data for, and the legal basis

• Creating and running your account, signing in and password resets (performance of contract)
• Choosing signals and local data that fit your type of business and province (performance of contract)
• Sending emails your account needs, such as confirmation and reset links (performance of contract)
• Sending alerts and summaries to channels you add yourself; pause or remove them any time (performance of contract)
• Looking at usage in aggregate, such as members per province, to improve the service (legitimate interest)
• Preventing misuse and keeping the system secure (legitimate interest)

If we ever send marketing messages or LINE summaries to you personally, we will ask for your separate consent, which you can withdraw at any time.

3. Sharing

We do not sell or rent personal data. We share only what is needed with processors that help run the service: our database and authentication provider (Supabase), web hosting (Vercel) and email delivery (Resend). These may store data on servers outside Thailand; we choose providers with adequate data-protection standards as the PDPA requires. Alerts you send to Slack, Discord or Teams are then covered by that service's own policy.

We may disclose data when required by law or by order of a competent authority.

4. How long we keep it

We keep account and business details while you are a member and delete them as soon as you delete your account. System logs are deleted on our providers' schedules, usually within 90 days.

5. Your rights

• Access your data or get a copy
• Correct it (you can change your type of business and province on the account page)
• Delete your account and all data (you can do this yourself on the account page)
• Ask for portability, object, or ask us to restrict use
• Withdraw consent you gave, without affecting earlier use
• Complain to Thailand's Personal Data Protection Committee (PDPC)

Contact [Privacy contact email] to use these rights. We reply within 30 days.

6. Cookies

We use only cookies needed to keep you signed in, which can't be switched off, and one that remembers the language you chose. We don't use advertising or third-party tracking cookies; if we ever add them, we will ask first.

7. Security

Data travels over encrypted connections (HTTPS), and the database only lets each account see its own data. If a breach puts you at risk, we will notify the PDPC within 72 hours and tell you promptly.

8. Changes to this policy

If we change this policy in an important way, we will tell you by email or on the website before it applies. See also our Terms of service.