Privacy policy

translate This English version is a convenience translation. The Thai version prevails.

Summary: we collect only the data needed to provide the service, and we do not sell data. A store's customer data belongs to the store, and you can ask to access, correct or delete your data.

1. Who the data controller is

• User account data, subscription payment data and data entered on the website — Resale Intelligence is the data controller.
• A store's customer data (such as people who sell items to or buy items from the store) — the store is the data controller. We are a data processor acting only on the store's instructions. If you are a customer of a store, please contact that store directly.

2. Data we collect

Information	Purpose	Legal basis
Name, email, phone number, password (hashed), 2FA settings	Creating and securing your account	Contract
Sign-in and activity logs (IP, device, time)	Security, fraud prevention and audit trail	Legitimate interests
Store name, address, tax ID, invoices, payments	Billing and issuing documents	Contract / legal obligation
Name, phone number and email from website forms	Getting back to you as you requested	Consent
App usage events, such as creating a store, completing a purchase or sale, or opening a report (linked to a user ID, with no names, phone numbers or store customer data)	Improving the service and measuring usage by pilot stores	Legitimate interests
Technical error reports (no form input data; users are identified by ID only)	Detecting and fixing errors	Legitimate interests
Cookie consent records: your choice, the time, the policy version, the page, the language, and hashes of your IP address and browser (only when you accept non-essential cookies or withdraw that acceptance)	Proving when you gave or withdrew consent	Legal obligation

3. Cookies and browser storage

We use only the cookies and browser storage the site needs to work and stay secure, as listed in the table below. We don't use analytics, advertising or third-party tracking cookies.

• resale-intelligence-session Cookie

  Remembers that you are signed in and links your requests to your session. Session data stays on the server; the cookie is encrypted and scripts on the page can't read it.

  Category

  Necessary

  Duration

  8 hours after your last activity

  Set by

  This site

• XSRF-TOKEN Cookie

  Protects your form submissions against cross-site request forgery (CSRF).

  Category

  Necessary

  Duration

  8 hours after your last activity

  Set by

  This site

• remember_web_… Cookie

  Keeps you signed in on this device. Set only if you tick "Remember me" when signing in, and ends when you sign that device out or change your password.

  Category

  Necessary

  Duration

  30 days

  Set by

  This site

• locale Cookie

  Remembers the language you chose (Thai or English).

  Category

  Necessary

  Duration

  1 year

  Set by

  This site

• cookie_consent Cookie

  Remembers your cookie choice so we don't ask again on every page.

  Category

  Necessary

  Duration

  1 year

  Set by

  This site

• theme Browser storage (localStorage)

  Remembers the theme you chose (light, dark or follow device). Kept on your device only and never sent to our servers.

  Category

  Necessary

  Duration

  Until you clear this site's data in your browser

  Set by

  This site

• sidebar Browser storage (localStorage)

  Remembers whether you collapsed or expanded the side menu in the app. Kept on your device only.

  Category

  Necessary

  Duration

  Until you clear this site's data in your browser

  Set by

  This site

• static-v1 Browser cache (Service Worker)

  Keeps the site's files (scripts, fonts, icons) and the offline notice page on your device so pages open faster. It holds no store data or personal data, and is used only on the live site over HTTPS.

  Category

  Necessary

  Duration

  Until the next version of the site replaces it

  Set by

  This site

Cookies and data this site keeps in your browser

Name	Used for	Category	Duration	Set by
resale-intelligence-session Cookie	Remembers that you are signed in and links your requests to your session. Session data stays on the server; the cookie is encrypted and scripts on the page can't read it.	Necessary	8 hours after your last activity	This site
XSRF-TOKEN Cookie	Protects your form submissions against cross-site request forgery (CSRF).	Necessary	8 hours after your last activity	This site
remember_web_… Cookie	Keeps you signed in on this device. Set only if you tick "Remember me" when signing in, and ends when you sign that device out or change your password.	Necessary	30 days	This site
locale Cookie	Remembers the language you chose (Thai or English).	Necessary	1 year	This site
cookie_consent Cookie	Remembers your cookie choice so we don't ask again on every page.	Necessary	1 year	This site
theme Browser storage (localStorage)	Remembers the theme you chose (light, dark or follow device). Kept on your device only and never sent to our servers.	Necessary	Until you clear this site's data in your browser	This site
sidebar Browser storage (localStorage)	Remembers whether you collapsed or expanded the side menu in the app. Kept on your device only.	Necessary	Until you clear this site's data in your browser	This site
static-v1 Browser cache (Service Worker)	Keeps the site's files (scripts, fonts, icons) and the offline notice page on your device so pages open faster. It holds no store data or personal data, and is used only on the live site over HTTPS.	Necessary	Until the next version of the site replaces it	This site

Read the details and change your settings at any time in our Cookie policy and cookie settings

4. Disclosure of data

We do not sell or rent out personal data. We disclose data only to service providers that are needed to provide the service (such as servers, databases, file storage and backups, email delivery and error tracking), under contracts that require confidentiality, or when required by law. A list of service providers is available on request through the contact details below.

One store's data is never shown to another store. Network data (if it is enabled in the future) will consist only of anonymous aggregates that identify neither people nor stores. See the Data policy

5. Retention periods

• User account data: for as long as the account is active
• Invoices and payments: for the period required by tax and accounting law
• Audit log: for the life of the store account, because it serves as evidence of transactions Each entry keeps the name and email address of the person who acted, as they were at the time, and can't be changed, so it stays for the legally required period even after the user account is deleted or anonymised.
• Website form data: 24 months, then deleted automatically, or sooner if you ask
• App usage events: 25 months, then deleted automatically
• Cookie consent records: 24 months, then deleted automatically
• Signed-in device list (IP address and browser): deleted automatically after 90 days without use, or 30 days after that device is signed out
• Backups: up to 35 days, then replaced by the next backup cycle

6. Security

Sensitive data is encrypted, each store's data is separated at the database level, and every important action is logged. Details in Data security

7. Your rights

Under the Personal Data Protection Act B.E. 2562 (2019) you have the rights in this table. If you are a store's customer (for example someone who sold an item to or bought one from the store), please make your request to that store, because the store controls your data.

Right	How to use it
Access and a copy	See your account details on your profile page in the app. Ask for a copy of any other data we hold about you through the contact details below.
Data portability	Store owners can download all of their store's data (customers, stock, transactions and members) as CSV files themselves under Settings > Data export. Ask for your own account data as a file through the contact details.
Correction	Change your name, email address, phone number and language yourself on your profile page. Financial transactions are corrected by voiding them with a reason and recording them again, never by overwriting.
Erasure or anonymisation	Ask through the contact details. We anonymise and disable your account and delete what you entered in the website's forms, except data the law requires us to keep (section 5). If you are a store's only owner, transfer ownership or close the store first.
Restriction or objection	Ask through the contact details, saying which data and why. We will tell you our decision and the reasons.
Withdrawing consent	Cookies: on the cookie settings page, or with the "Cookie settings" link at the bottom of every page. Website form data: ask us to delete it through the contact details. Withdrawing consent doesn't affect what was done before you withdrew it.
Complaints	You can complain to the Office of the Personal Data Protection Committee (PDPC) at pdpc.or.th

We reply within 30 days of receiving a verified request. We always verify your identity before acting on a request, for example by replying to the email address registered on the account.

Some data, such as financial transactions and the audit log, may have to be kept to meet legal obligations even after a deletion request. In that case we will tell you why.

8. Contact

Resale Intelligence · our contact page

9. Changes to this policy

If there are significant changes, we will give notice in the app and by email to the store owner before they take effect. The date of the last update is shown at the top of this page.