Privacy Policy

1. Who we are

Flippie is operated by Greenstead Co., Ltd., registered in Thailand. Under the Personal Data Protection Act B.E. 2562 (PDPA), we are the Data Controller for personal data collected through flippie.co.

Contact: flippie.orders@gmail.com

2. What data we collect

We collect the following personal data when you place an order:

We do not collect or store your full credit card or bank account details. PromptPay handles payment outside our system.

3. Why we collect it (legal basis under PDPA)

Under the PDPA, we must have a legal basis for processing personal data. We rely on:

• Performance of a contract (PDPA section 24(3)): to fulfil your order — print, package, and ship your flipbook. This covers name, address, phone, email, video, slip, message.
• Legitimate interest (section 24(5)): to improve the site, prevent fraud, and respond to support requests. This covers IP address, basic analytics, order history.
• Consent (section 19): for any marketing emails we may send (we don't currently send any). If we do start, you'll opt in first and can opt out anytime.
• Legal obligation (section 24(6)): to keep tax records as required by the Thai Revenue Code.

4. Who we share data with

We share data only with service providers we need to run the service. These third parties have agreed to handle data securely:

• Google (Drive, Sheets, Apps Script, Gmail, Analytics, Tag Manager): stores your video, print PDF, and payment slip in Google Drive; logs order details in a Google Sheet; sends internal order notifications via Gmail; processes site analytics. Privacy: policies.google.com/privacy
• EmailJS: delivers order confirmation emails. Privacy: emailjs.com/legal/privacy-policy
• Shipping carriers (Flash Express, Kerry, DHL, Thailand Post): we share your name, phone, and shipping address only.
• Web hosting (Namecheap): stores the website; receives basic server logs.

We will never sell your personal data. We will not share it for advertising or marketing purposes.

5. Cookies and tracking

We use the following:

• Essential cookies: for the order form to remember what you've selected during checkout. These are required for the site to work.
• Analytics (Google Tag Manager / Google Analytics): we measure how many visitors use the site, which pages they view, and where they come from. Data is aggregated and used only to improve the site.

You can disable analytics by using your browser's "Do Not Track" setting or installing a privacy extension. Disabling analytics will not affect your ability to place orders.

6. How long we keep data

Different data has different retention periods:

• Order data, customer details, payment slips, invoices: 3 years from order date. This matches the Thai Revenue Code requirement to keep accounting records.
• Uploaded video files and print PDFs: 90 days after order delivery. We may keep them longer only if needed to handle a return or dispute.
• Email correspondence: 3 years.
• Analytics data (Google): per Google's standard retention (typically 14 months or your account configuration).

You can request earlier deletion — see "Your PDPA rights" below.

7. Security

We protect your data with:

• HTTPS encryption everywhere on flippie.co
• Restricted access to Google Drive folders (only Greenstead staff)
• Strong passwords and two-factor authentication on internal accounts
• Limiting data shared with third parties to only what is necessary

No system is 100% secure. If we ever experience a data breach affecting your data, we will notify you and the Thai Personal Data Protection Committee (PDPC) within 72 hours, as required by section 37(4) of the PDPA.

8. Children

Flippie is intended for users aged 18 and older. If you are between 13 and 18, you may use the service only with consent from a parent or guardian. We do not knowingly collect data from children under 13. If you become aware that a child under 13 has provided us with data, please contact us so we can delete it.

9. International transfers

Some of our service providers (Google, EmailJS) are based outside Thailand. Data may be transferred to and processed in the United States and other countries. These providers adhere to international data protection standards (such as Standard Contractual Clauses). Under PDPA section 28, we ensure transfers are made only to countries with adequate protection or under appropriate safeguards.

10. Your PDPA rights

Under the Personal Data Protection Act B.E. 2562, you have the following rights:

• Right to be informed — about how we use your data (this policy)
• Right to access — request a copy of the personal data we hold about you
• Right to rectification — correct any inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten"), subject to legal retention rules
• Right to restrict processing — pause certain uses of your data
• Right to data portability — receive your data in a portable format
• Right to object — object to certain processing, including direct marketing
• Right to withdraw consent — at any time, where processing is based on consent
• Right to lodge a complaint — with the Personal Data Protection Committee (PDPC) if you believe we are mishandling your data

To exercise any right, email flippie.orders@gmail.com with your order reference. We respond within 30 days.

Complaints to the PDPC: pdpc.or.th

11. Changes to this policy

We may update this Privacy Policy. The "Last updated" date at the top changes when we do. For material changes, we'll try to notify you by email if you have an active order or have given us your address.

12. Contact us

For privacy questions or to exercise your rights:

• Email: flippie.orders@gmail.com
• Subject line: "PDPA Request — [your order reference]"
• Postal: Greenstead Co., Ltd., Bangkok, Thailand