← Back to Pick Our Date

Privacy Policy

Last updated: 21 September 2026

Pick Our Date (operated by Sam Bocker, sole trader, Thailand) respects your privacy. This policy explains what personal data we collect, why we collect it, and your rights over it.

1. Who is the data controller

Sam Bocker (sole trader), Phuket, Thailand. Contact: sambocker2411@gmail.com.

For payment processing, our Merchant of Record is Paddle.com Market Limited, which acts as an independent data controller for transaction data. See Paddle's Privacy Notice.

2. What data we collect and why

Category	Examples	Purpose
Invitation content	Names, photos, dates, custom messages you upload	To create and deliver your invitation
Recipient response	Chosen date, time, activity selection	To show you the recipient's answer on the status page
Contact	Email address (if provided)	To email the invitation link and payment receipt
Technical	IP address, browser type, language, timestamps	Security, abuse prevention, service diagnostics
Payment	Handled by Paddle only	We never see or store card numbers

3. Legal basis (GDPR / Thai PDPA)

• Performance of contract — to deliver the invitation you purchased.
• Legitimate interest — technical logs for security and abuse prevention.
• Consent — for optional emails or communications you opt into.
• Legal obligation — tax and accounting records via Paddle.

4. How long we keep it

• Invitation content: automatically expires 30 days after creation and is purged from active storage.
• Payment records: retained by Paddle for the period required by applicable tax laws (typically 5–10 years).
• Technical logs: 30 days rolling.

5. Who we share data with

• Paddle — for payment processing, taxation, and fraud prevention.
• Supabase (our database provider, EU-hosted infrastructure) — as data processor under a Data Processing Agreement.
• Netlify — website hosting.
• LINE Corp. — only when you purchase a sticker pack that we submit to LINE Store on your behalf.

We do not sell your data. We do not use it for advertising or third-party marketing.

6. Cookies and tracking

We use minimal, functional cookies only:

• Session cookie for the invitation editor (so your work-in-progress doesn't disappear).
• Language preference (Thai / English / Chinese).

No advertising cookies. No third-party analytics tracking individuals.

7. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten") — subject to legal retention requirements for payment records.
• Object to processing or request restriction.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time.
• Lodge a complaint with the Thai Personal Data Protection Committee or, for EU residents, your local supervisory authority.

To exercise any right, email sambocker2411@gmail.com. We respond within 30 days.

8. Security

All data in transit is encrypted with TLS. Data at rest is stored in Supabase with row-level security. Access is limited to what is strictly needed to operate the Service.

9. International transfers

Some processors (Paddle, Supabase, Netlify) may store or process data outside Thailand, including in the EU and US. In such cases, transfers are protected by standard contractual clauses or equivalent safeguards.

10. Children

The Service is not directed at people under 18. We do not knowingly collect personal data from minors. If you believe we have, please contact us and we will delete it.

11. Changes to this policy

We may update this policy. The "Last updated" date reflects the most recent revision.