1. Data we collect

When you place an order or create an account, you give us:

• Your name, phone number, shipping address and email address.
• If you sign in with LINE (LINE Login): your LINE user ID, display name, profile picture and, if you allow it, the email address on your LINE account. If you sign in with Google: your name, email and profile picture from Google.
• What you ordered, including any gift-card message, engraving text, coupon code and the shipping option you chose.
• Photos you upload for photo lockets, and any other images you upload for your order.
• Payment: if you pay by PromptPay or bank transfer, the payment slip image you upload. If you pay by card, your card details are entered into Stripe's payment form and go directly to Stripe — we never see or store your card number. We keep only the Stripe payment reference and the amount paid.
• Messages you send to our LINE Official Account, and the replies we send.

2. Data collected automatically

• Pages you visit and actions you take on the site (for example, adding to cart or starting checkout), the type of device (mobile or desktop), and a random visitor ID stored in your browser.
• Where you came from: campaign parameters (utm_*) and ad click IDs (gclid, fbclid, ttclid) in the link you clicked. These are kept in your browser for up to 30 days and saved with your order.
• When you place an order: your IP address, browser user agent, the page URL, and Meta's _fbp / _fbc cookies, if present. These are saved with the order so a purchase can be matched to a Meta ad (see section 4).
• Technical error reports (the page URL, your browser user agent and the error message) so we can fix problems.

3. How we use your data

• To make, pack and deliver your order, and to contact you about it (contract).
• To check payments, prevent fraud and keep the site secure (legitimate interest).
• To keep accounting and tax records (legal obligation).
• To answer your messages on LINE and send order updates, tracking numbers and photos of your finished piece.
• To understand how the site is used and to measure whether our ads lead to sales (legitimate interest — you can object; see section 9).

We do not sell your personal data.

4. Analytics and advertising

The website uses these third-party tools. Each one sets its own cookies and receives data about your visit under its own privacy policy.

• Google Analytics 4 and Google Ads conversion tracking — page views and shopping events such as add-to-cart and purchase.
• Meta Pixel (Facebook/Instagram) — page views and shopping events from your browser.
• Meta Conversions API — when an order is paid, our server sends Meta the order value, product IDs, your email address, phone number and account ID in hashed (SHA-256) form, the _fbp / _fbc cookies, your IP address and browser user agent. Meta uses this to tell us whether a purchase came from one of our ads. Hashing turns the value into a code; Meta can still match it to an account it already knows.
• TikTok Pixel and LINE Tag — page views and purchase events, when we run ads on those platforms.

The site does not currently show a cookie consent banner. You can block or delete cookies in your browser settings, and you can control ad personalisation in your Meta, Google, TikTok and LINE account settings. Blocking cookies does not stop you from ordering.

5. LINE Official Account

• When you add us as a friend or message us, LINE gives us your LINE user ID and your messages. We store the conversation so our team can reply and see your order history.
• We may ask for the email you used at checkout so we can link your LINE account to your orders.
• We use LINE to send order updates, tracking numbers and photos of your finished jewelry.
• We may use an AI model provider (an OpenAI-compatible service) to help answer product questions in LINE chat. Your recent messages are sent to that provider to produce a reply, and you can ask for a person at any time.

6. Who we share data with

We share only what each party needs to do its job:

• Shipping carriers (for example Flash Express, Kerry Express, Thailand Post, J&T Express) — your name, phone number and address, to deliver your parcel.
• Stripe — card payments. Your bank or payment app — PromptPay and bank transfers.
• Google (Firebase and Google Cloud) — stores our database, accounts and uploaded files. Vercel — hosts the website.
• Meta, Google, TikTok and LINE — the analytics and advertising data described in section 4.
• LINE — LINE Login and LINE Official Account messaging.
• An AI model provider — LINE chat messages, as described in section 5.
• Government authorities, when the law requires it.

Some of these providers process data outside Thailand (for example in the United States). We use providers that apply their own data protection safeguards.

7. Storage and security

Order and account data is stored in Google Firebase. Order records cannot be read directly from a browser; they are accessed through our server, and our team uses a signed-in admin system.

Uploaded files — photo-locket photos, payment slips and photos of finished orders — are stored in Google Cloud Storage at long, hard-to-guess web addresses so our team and LINE can display them. Anyone who has the exact address of a file can open it, so please do not share those links.

8. How long we keep data

• Orders, payment records and slips: as long as needed to fulfil the order, handle returns and meet Thai accounting and tax record-keeping requirements.
• Accounts and LINE conversations: until you ask us to delete them.
• Campaign and ad-click data in your browser: up to 30 days.

We do not yet delete data automatically on a fixed schedule. If you want your data deleted, contact us (section 11) and we will delete what we are not legally required to keep.

9. Your rights under the PDPA

You have the right to:

• Access your personal data and get a copy of it.
• Ask us to correct data that is wrong or incomplete.
• Ask us to delete or anonymise your data.
• Ask us to restrict how we use your data.
• Receive your data in a commonly used format, or have it sent to another company (data portability).
• Object to us using your data, including for analytics and ad measurement.
• Withdraw consent you have given, at any time. This does not affect what we did before you withdrew it.
• Complain to the Personal Data Protection Committee (PDPC) of Thailand, www.pdpc.or.th.

To use any of these rights, message us on LINE (section 11). We may ask you to confirm who you are first. We will reply within 30 days.

10. Changes to this policy

If we change how we use personal data, we will update this page and the "Last updated" date.

11. Contact us

For privacy questions, requests to access or delete your data, or anything else, message MAD CREATION CLUB on our LINE Official Account. You can also reach us on Instagram.