SWAP ME! is operated by [Company legal name] ("SWAP ME!"), [Registered address], Bangkok, Thailand ("we", "us"). We are the data controller for the personal data described here.

Contact us about privacy at [privacy@your-domain.com].

Depending on how you use SWAP ME!, we collect:

• Account details — your email address, name and profile photo. If you sign in with Google, X or LINE, that service shares your name, profile photo and the email address registered with it (with LINE, only if you allow it on LINE's consent screen). We use your email address to identify your account, send booking and order updates, and let you sign in by email. We never receive your password for those services. If you create a password with us, it is stored only as a secure hash by our authentication provider.
• Rental orders — the items, sizes and dates you book, the recipient name, phone number and delivery address, the payment method you choose and the amounts charged. We do not currently collect or store card numbers.
• Lender applications — closet name, phone number, LINE ID and Instagram (optional), province, the categories and number of pieces you plan to lend, your Thai national ID number and your bank name, account name and account number.
• Listings — the details and photos of items you list. Listing photos and descriptions are public so renters can see them.
• Usage data — if you allow analytics, we count your visits on our own servers: a random visitor ID, how many pages you viewed in a visit, the first page, your device type (mobile or desktop), which listings were viewed, and — when you're signed in — which days your account was active, so we can measure how often people come back. Vercel Web Analytics also records anonymous page-view statistics. See Cookies below.
• Messages and support requests you send us.

Your bag, saved items, chat drafts and saved delivery address are kept in your browser's local storage on your device, not on our servers, until you place an order.

We do not sell your personal data and we do not use it for automated decisions that have legal effects on you.

• Lenders and renters — only what is needed to complete a rental (for example, the lender sees the item, dates and delivery details for their order).
• Supabase — our database, authentication and file storage provider.
• Vercel — our hosting provider, and (with your consent) privacy-friendly web analytics.
• Google, X and LINE — when you choose to sign in with them.
• Delivery partners (such as Grab or Thailand Post EMS) — the recipient name, phone and address for your shipment.
• Authorities — when required by law.

Some of these providers store data on servers outside Thailand. Where that happens we rely on the provider's contractual and security safeguards as required by the PDPA.

• Account data — while your account is open, and deleted or anonymised within 90 days after you ask us to close it.
• Orders and payment records — up to 10 years, as required for accounting and tax.
• Lender applications — while you are a lender; rejected applications are deleted after 12 months. ID and bank details are removed when you stop lending, unless needed for outstanding payouts or legal obligations.
• Analytics — visit records are deleted after about 13 months; per-listing view counts are kept as totals without any personal data.

Data is encrypted in transit (HTTPS). Access is restricted by database security rules: you can only see your own orders and applications. Thai ID and bank details can be read only by you and authorised SWAP ME! administrators, and are masked in our admin tools until deliberately revealed.

Under the PDPA you can ask us to:

• access or get a copy of your personal data, and move it to another service;
• correct inaccurate data;
• delete or anonymise your data, or restrict how we use it;
• object to processing based on legitimate interest;
• withdraw consent at any time (for analytics, use Cookie settings below) — this doesn't affect processing done before you withdrew.

Email [privacy@your-domain.com]. We reply within 30 days. You can also complain to the Personal Data Protection Committee (PDPC) of Thailand.

We keep this minimal. Essential storage is always on because the site can't work without it; analytics runs only if you choose Accept all in the cookie banner.

You can change your choice at any time with Cookie settings.

SWAP ME! is for people aged 20 or over. Under-20s may use it only with the consent of a parent or guardian. If you believe a minor has given us data without consent, contact us and we will delete it.

We'll update this page when our practices change and show the new effective date. If the changes are significant we'll tell you on the site or by email before they apply.