Consent & Personal Data Notice

1. Controller and service nature

The Samta / จับยามสามตา platform operator is the personal data controller under Thailand’s PDPA (B.E. 2562). The product is entertainment astrology — not medical, legal, or financial advice.

2. Personal data we may process

• Account — user id, email (Google), display name, avatar, guest/member status
• Birth profile — birth date/time/place, approximate coordinates, timezone, optional gender
• Location / place — place search text and resolved coordinates for timezone (no continuous GPS tracking by default)
• One-off device GPS reading (only when you tap it) — on the profile page you may let the browser read your current coordinates to help fill your birth coordinates. One read per tap, no continuous tracking, nothing stored server-side until you confirm and save the profile, and you can clear or edit it anytime
• LINE / LIFF — LINE user id and profile fields you authorize
• Cookies / session — necessary auth, security, and consent cookies
• Payments — plan status / Stripe customer ids (full card numbers stay with Stripe)
• Feedback — messages you submit
• Palm reading (camera, not stored) — if you open ดูลายมือ and consent on that page, palm frames are processed on your device then discarded. We do not store palm images or print templates (separate from face reading).
• Face reading (camera, not stored) — if you open โหงวเฮ้ง and consent on that page, face frames are processed on your device then discarded. We do not store face images or biometric identity (separate from palm reading).
• Luo Pan (compass / coarse location, not stored) — if you open หล่อแก and consent on that page, heading and optional coarse coordinates stay on your device. They are not sent to the server or stored.

3. Purposes

• Provide the entertainment astrology features you request
• Authentication, session, security, and abuse prevention
• Subscriptions and payments via Stripe
• Product improvement (if you opt into analytics)
• Marketing messages (if you opt in)
• Respond to feedback and data-subject requests

4. Legal bases (PDPA + careful entertainment framing)

• Consent — optional analytics/marketing and any sensitive processing that may require separate consent
• Contract / performance of your request — delivering the service you signed up for (profile, session, checkout you start)
• Legitimate interests — limited to security, fraud/spam prevention, and minimal technical logs for an entertainment app — not invasive ad profiling or selling personal data

5. Data subject rights

Under PDPA (and GDPR where applicable) you may request access, rectification, erasure, restriction, objection, withdrawal of consent, and portability within legal limits. Use the feedback form and mark the request as “PDPA / Privacy”.

6. Retention

Account/profile data for the life of the account (or until deletion request, subject to legal holds). Consent records are kept as evidence for a reasonable period. Payment card details are not stored on our servers.

7. Disclosures and cross-border transfers

Processors may include Google, LINE, Stripe, and hosting providers, which may process data outside Thailand. Transfers occur only as needed to run the service, with appropriate safeguards where required.

8. Cookies and analytics

Necessary cookies for login/security/consent; optional analytics/marketing per the checkboxes above.

9. ISO standards — guiding only (no certification claim)

We follow high-level information security and privacy management practices inspired by ISO/IEC 27001 and ISO/IEC 27701 as guiding standards (access control, backups, logging, data minimisation). This page does not claim that Samta is ISO-certified.

10. GDPR-aligned transparency (EU/EEA users)

Where the GDPR applies, lawful bases may include Art. 6(1)(a) consent, Art. 6(1)(b) contract, and Art. 6(1)(f) legitimate interests for security/abuse prevention, balanced against your rights. You may withdraw consent at any time without affecting prior lawful processing. Primary service terms remain under Thai law except where mandatory consumer/privacy law provides otherwise.

Palm reading (ดูลายมือ) — separate camera consent

Palm lines/prints may be biometric in some contexts. This feature is entertainment palmistry in Thai vocabulary, not medical advice.

• The camera does not start on page load — you must tick consent and tap start
• Frames are processed on your device then discarded; this server does not accept or store palm images
• Sharing defaults to reading text only, not a photo of the hand — friends/family is fine; do not post palm photos publicly
• Leaving the tab stops camera tracks

Face reading (โหงวเฮ้ง) — separate camera consent

Facial images may be biometric. This feature is entertainment physiognomy in Thai vocabulary, not medical advice and not appearance judgment.

• The camera does not start on page load — you must tick consent and tap start
• Frames are processed on your device then discarded; this server does not accept or store face images
• Sharing defaults to reading text for friends/family (personal/household use) — no face photo
• Public posting requires written permission from the face owner, confirmed again every time
• Leaving the tab stops camera tracks; screenshot blocking on the web is best-effort, not 100%

Luo Pan (หล่อแก) — separate location / motion consent

หล่อแก uses the phone compass and may show coarse coordinates for entertainment feng-shui direction reading.

• Compass and GPS do not start on page load — you tap to enable each
• Coarse coordinates appear on screen only after you tick consent; they are not sent to the server or stored
• Paid members only

Crystal ball (ลูกแก้ว) — separate coarse-location consent

ลูกแก้ว may use coarse coordinates as part of the on-device yes/no seed. Coordinates stay on your device.

• GPS does not start on page load — you must tick consent first
• Coarse coordinates are not sent to the server or stored; no photos are kept
• Free to play. Entertainment only — not a prediction or advice

Auspicious Stylish — on-device photo consent

Auspicious Stylish may show your profile photo or a photo you pick on this device so the look appears on your screen.

• A face upload is not required — a silhouette and yam colors still work
• The chosen image stays on your device — this server does not receive or keep it
• You must tick consent before a profile or local photo is used

11. Contact / privacy contact (DPO-style)

No formal separate DPO appointment is declared in this document. Contact us via the feedback form with subject “PDPA / Privacy”.