Privacy Policy / นโยบายความเป็นส่วนตัว

1. Data we collect

• Account: email and LINE/Google OAuth identity (managed by Clerk). The app itself only reads your email and user id — never your name or profile details.
• Portfolio: positions, quantities, average cost, P&L, cash balance, deposits/withdrawals, and your trade journal (including self-recorded emotions).
• Alert channels: LINE user id (only when you link it yourself) and email for delivery.
• Usage: daily AI usage counts, email send logs, alert history.
• Billing: Stripe customer id (card data never touches our servers).
• Never collected: real name, address, phone, national id, birthdate. No tracking, analytics, or advertising cookies.

2. Purposes and legal basis (PDPA)

Consent (email/LINE alert opt-ins — withdraw anytime in Settings), contract (providing the portfolio, alert, and subscription services you signed up for), and legitimate interest (rate limiting, abuse prevention, security).

3. Third-party processors

See the table in the Thai section above: Clerk (auth, US), Supabase (database, Singapore), Cloudflare (edge compute, global), Vercel (hosting, Singapore), Resend (email, US), LINE (notifications, JP/TH), Stripe (billing, US), Vercel AI Gateway & OpenRouter (AI chat context — no name/email in prompts), and QuickChart.io (five anonymous price points for LINE chart images). Market-data providers (Finnhub, Yahoo, TradingView, FMP) receive tickers only — never personal data.

4. Cookies

Essential cookies only: sign-in (Clerk), language, and theme. No tracking, analytics, or advertising cookies. AI chat history stays in your browser's localStorage and is never stored server-side.

5. Retention

Data is kept while your account is active. Read notifications: 90 days. Email logs: 90 days. AI usage stats: 1 year. Transient caches: minutes to days. Account deletion removes everything within 30 days (except consent records we must retain as legal proof).

6. Your rights

Access, rectification, erasure, objection, restriction, and portability under PDPA sections 30–36. Self-service: "Download my data" (JSON export of all your tables) and "Delete my account" in Settings. Channel consent can be withdrawn anytime in Settings. Direct requests: valtherosz@gmail.com — answered within 30 days.

7. Cross-border transfers

Personal data may be transferred to processors in the US, Singapore, and Japan (see section 3) under contractual safeguards (data processing agreements with each provider).

8. Security & breach response

TLS everywhere, row-level security, webhook signature verification, and a strict Content-Security-Policy. In the event of a personal data breach we notify Thailand's PDPC within 72 hours and affected users without delay when the risk is high.