Privacy Policy

1. Data we collect

• •Email and password (one-way hashed) for sign-up and login
• •First and last name
• •Birth date, birth time, and birthplace, used for traditional chart analysis — this data is stored only on your own device (browser storage). We do not keep it in our database; it is sent to our systems only for each analysis you request, and is not retained afterwards
• •Phone number, house/unit number, licence plate, account number, and the last 3 digits of your ID card — only when you request a Number360 report (we never ask for a full ID number). The free number checker at /number runs on your own device: the numbers you type are never sent to us or stored
• •Service usage history (science and topic viewed — reading content itself is not stored)
• •Subscription plan and payment information (via Stripe — we never store card details directly)
• •Name, email, and message when you contact us through the contact form
• •Website usage data via analytics/marketing cookies (only if you consent via the cookie banner)

2. Purposes and legal bases

• •Delivering personalised chart analysis from your birth data — performance of contract (Section 24(3))
• •Managing your account, subscription, and payments — performance of contract
• •Retaining payment records under accounting and tax law — legal obligation (Section 24(6))
• •Usage analytics and marketing via cookies — consent (Section 24(1)), withdrawable at any time
• •Securing the system and preventing abuse — legitimate interest (Section 24(5))

3. Disclosure to data processors

We do not sell or trade your personal data. We share only what is necessary with providers who process data on our behalf under data-processing agreements:

• •Supabase — database and account infrastructure
• •Stripe — payment processing (receives only your email and plan details, never birth data)
• •Anthropic — synthesis of your analysis from the details you submit (name, birth date/time, and numbers you enter)
• •Brevo — transactional email and contact-form replies
• •Google Analytics, Meta, and PostHog — usage analytics and marketing, only if you accept these cookies

4. International transfers

Some of the providers above store or process data on servers abroad (United States and European Union). We use providers with adequate data-protection standards bound by data-processing agreements, in line with Section 28 of the PDPA.

5. Retention periods

• •Account data (email, name, subscription plan) — kept for the life of your account, until you delete it
• •Birth data (date, time, place) — never stored in our systems; it stays on your device until you remove it (use “Edit birth date” on the reading page, or clear the site's data in your browser)
• •Service usage logs (science/topic) — automatically deleted within 7 days
• •Numbers you entered for a Number360 report (phone, address, etc.) and the report itself — kept in your account so you can reopen them at any time (reports you bought never expire), and deleted in full when you delete your account (Profile > Delete account)
• •Payment records — kept for the period required by accounting and tax law, even after account deletion
• •Contact messages — kept as long as needed to handle your enquiry

6. Your rights as a data subject

Under the PDPA you have the following rights, exercisable free of charge via the contact channel in Section 11:

• •Right to access and obtain a copy of your personal data
• •Right to rectification (editable yourself on the Profile page)
• •Right to erasure (available yourself at Profile > Delete Account)
• •Right to data portability
• •Right to object to or restrict processing
• •Right to withdraw consent you have given (e.g. analytics/marketing cookies)
• •Right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC)

7. Deleting your data and account

You can delete your account at any time at Profile > Delete Account. Once confirmed, your personal data, birth data, and usage history are removed from our systems immediately, except payment records that accounting and tax law require us to keep, which are unlinked from your identity. We also retain a minimal deletion record (email, name, plan, and consent evidence — never birth data or any analysis results) to verify your deletion request and resolve disputes, as permitted under Section 39 of the PDPA.

8. Cookies

Cookies essential for login and site operation are always used. Analytics and marketing cookies (Google Analytics, Meta, PostHog) — and similar technologies that store data in your browser — run only after you accept them on the cookie banner; if you decline, nothing in this group is loaded or stored. If you arrive through an advertising link, we keep the ad click reference in your browser for up to 90 days so we can tell which ad an order came from, again only with your consent. You can withdraw consent at any time using the button at the bottom of this page, which deletes that reference from your browser and immediately stops all such data being sent. Separately from cookies, we keep an anonymous usage counter on our own systems, so we can see how many times each page was opened and how far people got in a flow on a given day. It records only the step name, the page path without anything after the question mark, an advertising campaign label, and the timestamp. No user account, visitor identifier, IP address, or browser information is recorded, so it cannot be linked back to you or used to tell one person's visits apart from another's. This is aggregate, non-personal data, it uses no cookies, and it is deleted automatically within 180 days.

9. Minors

This service is not directed at minors. Users under 20 years of age must obtain consent from a parent or legal guardian before signing up and providing personal data, per Section 20 of the PDPA.

10. Changes to this policy

We may update this policy from time to time. For material changes we will notify you by email or in-app notice, and the date at the top of this page is always kept current.

12. Facebook Login

If you choose to log in using Facebook, we receive your name, email address, and profile picture from Facebook. This information is used solely to create and manage your Chata360 account. We do not post to your Facebook timeline or access your friends list.

You can revoke Chata360's access to your Facebook data at any time through your Facebook Settings > Apps and Websites. You may also delete your Chata360 account to remove all data we have collected.

11. Data controller and contact

Chata360 is the data controller under this policy. For questions, to exercise the rights in Section 6, or to request data deletion, contact us at hello@chata360.com