Privacy policy

This policy explains how the karnakum.com website (including download.karnakum.com) collects and uses your personal data, under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA).

Each KARNAKUM app, such as YantTang, has its own privacy policy, available inside the app under Settings → Privacy policy. This policy covers the website only. The Thai version prevails if the two differ.

1. What we collect

Data	Why	Legal basis
Email, platform of interest (iOS/Android) and language — only if you join the waitlist	To tell you when the mobile app launches	Consent (s.19) — the box you tick in the form
Time of consent and version of the consent text	Proof that you consented	Legal obligation (s.19 para. 2)
Aggregate visit statistics (pages, country, device type)	To improve the website	Legitimate interest (s.24(5))
IP address and connection data in our network provider’s logs	To prevent attacks and abuse	Legitimate interest (s.24(5))

Visit statistics use Cloudflare Web Analytics, which uses no cookies and does not track you across sites, so this website shows no cookie banner.

We do not collect names, phone numbers, ID numbers, financial data or sensitive data under s.26. There is no advertising, and we never sell or trade data.

2. Service providers who process data for us

Provider	Role	Data involved
Cloudflare, Inc.	Hosting the website and downloads, visit statistics	IP address, connection data, aggregate statistics
Supabase Inc.	Waitlist database	Email, platform, language, consent record

Both may store data outside Thailand, which is a cross-border transfer under s.28. Both have data processing agreements (DPAs) and adequate safeguards in place.

3. How long we keep it

• Waitlist: until we announce the mobile app, then deleted within 30 days — or immediately on request
• Visit statistics: aggregate and not personally identifiable, kept for Cloudflare’s retention period
• Connection logs: kept for the security retention period set by the network provider

4. Your rights (ss.30–36)

You may request a copy, correction, deletion or restriction, object, or withdraw consent at any time. Withdrawing consent does not affect anything done before.

Send requests to the email under “Data controller” above, from the address you signed up with. We act within 30 days. If you believe we have infringed your rights, you may complain to the Personal Data Protection Committee (PDPC) (s.73).

5. Security

• HTTPS (TLS) on every page
• The waitlist table uses Row Level Security — the public can add an entry but cannot read the list
• Installers come with SHA-256 checksums on the download page

If a data breach occurs we will notify the PDPC within 72 hours and inform affected people without delay (s.37(4)).

6. Changes

If we make material changes we will show the new date at the top of this page, and ask for consent again if the change affects the purpose you agreed to.