Privacy policy

Last updated 18 Oct 2026

ecommerce-platform Co., Ltd. ("we") runs ecommerce-platform, a marketplace where brands sell to you directly. This policy explains how we handle your personal data under the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). We are the data controller for your account and for the platform. Each brand you buy from is a separate controller for the orders it fulfils.

What we collect

Account details from Google when you sign in: your name, email address and profile picture. We never see your Google password.
Order details when you check out: the recipient's name, phone number and delivery address, the items you bought, the price you paid, and any note you leave for the brand.
Payment evidence: the transfer slip you upload. We do not collect card or bank login details; you pay the brand directly from your own banking app.
Returns and reviews: your reason for a return, photos you attach, and reviews you write.
Technical data needed to run the service: your IP address and browser details in our security logs, and the cookies described in our cookie notice.

Why we use it

To provide the service you asked for (PDPA section 24(3), contract): to sign you in, keep your bag, pass your order to the brand, show your order history and handle returns.
To keep the marketplace safe (section 24(5), legitimate interest): to prevent fraud and abuse, enforce our terms and secure our systems.
To meet legal obligations (section 24(6)): for example tax and accounting records.
With your consent (section 19), for anything else we ask you about. We do not send marketing email without it.

The brand you order from receives your order details, delivery address, contact details and payment slip so it can confirm payment, ship and handle returns.
Service providers who process data for us under contract: hosting (Vercel), database (MongoDB Atlas), file storage (Amazon Web Services), email delivery (SendGrid), rate limiting and scheduling (Upstash) and Google sign-in. Some of them store data outside Thailand; we rely on their contractual safeguards as PDPA section 29 requires.
Authorities, when the law requires it.

We do not sell your personal data.

How long we keep it

Your account, for as long as you keep it.
Orders and payment evidence, for as long as tax and accounting law requires (generally 5 to 10 years), even if you delete your account. The brand may keep its own copy for the same reason.
Security logs, for up to 12 months.

Your rights

Under the PDPA you can ask to access, correct or delete your data, receive a copy in a portable format, object to or restrict how we use it, and withdraw consent at any time. You can:

download a copy of your data from Account → Privacy & data;
ask us to delete your account from the same page.

We reply within 30 days. If you're not satisfied, you can complain to the Office of the Personal Data Protection Committee (PDPC).

Children

The service is for people aged 20 or over, or with a parent's or guardian's consent.

Changes