· ภาษาไทย
Privacy policy — buyers and site visitors
1. Who we are
UNFLD (unfld.ai) is run by Theerakorn Prasutchai, an individual. Contact address: 17 Punnawithi 50, Bangchak, Phrakanong, Bangkok 10260. Email: privacy@unfld.ai. For this policy, we are the data controller.
2. What we collect
| What | When | Why | Legal basis |
|---|---|---|---|
| Your Google account email and name | You sign in with Google | To run your account | Contract |
| Your email address and name, if sign-in is refused | You try to sign in and are not yet invited | To offer you access later (waitlist) | Legitimate interest |
| Your business name and description, language, email preferences | You fill in Settings | To draft research plans that fit your business, and to email you as you chose | Contract |
| What you type to describe a decision, the plans, settings and research you create | You use the product, including before signing in | To draft and run your research | Contract; before sign-in, legitimate interest |
| Payment records: package, amount, date, Stripe payment id, receipt number | You top up | To credit your balance and issue receipts | Contract; legal obligation (tax) |
| Name, email, phone, organisation and message | You send an enquiry ("Talk to us") | To reply | Legitimate interest |
| Stars and comments | You give feedback | To improve the product, and to contact you if you tick the box | Legitimate interest; your consent for contact |
| Which screens you reached and which buttons you pressed, by id only; where your first visit came from (campaign tags or referring site) | You use the site | To see where the product is hard to use and which channels bring buyers | Legitimate interest |
| Your IP address | Every request | To limit abuse. Held in memory, not logged | Legitimate interest |
| That you visited our home or sign-in page, and whether you signed up or joined the waitlist, through Meta, TikTok and Google's advertising cookies | Only if you accept advertising cookies | To see whether our ads work, and to show UNFLD's ads to people who have visited | Your consent |
| When you make a plan or buy a package, sent from our server to Meta and TikTok: that it happened, the amount paid, a hash of your email, your browser type and those cookies' ids. Never your research or anything anyone said in it | Only if you accept advertising cookies | To show ads to people who planned and haven't bought, to leave out recent buyers, and to reach buyers again after about 60 days | Your consent |
We never record what you type in our analytics. Advertising cookies run only if you accept them, and only on our home page and sign-in page: never inside your account, your research, its conversations, or a shared research, and never on the page where your customers are interviewed.
Card and bank details. You pay by PromptPay QR through Stripe. We never see your bank account or card. Stripe's privacy policy covers what Stripe collects.
3. Cookies and browser storage
The banner on our home and sign-in pages offers Allow all or Allow only necessary. Necessary means only what keeps the site working: the sign-in cookie and the browser storage below. Everything else is listed here, and runs only if you choose Allow all. If we add a new kind of cookie, we list it here and ask you again.
- Necessary: one sign-in cookie (
unfld_session), HttpOnly, for 30 days. Needed to keep you signed in. - Necessary: browser storage for your preferences (language, light or dark), unsent drafts, your first visit's source, the id of your welcome discount code, and your cookie choice. It stays in your browser. When you sign in, we bind the discount code to your account's email.
- Advertising, only with Allow all: Meta (
_fbp), TikTok (_ttp) and Google (_gcl_au), set through Google Tag Manager on the home and sign-in pages. They last as each provider sets them: today about 3 months for_fbpand_gcl_au, and up to 13 months for_ttp. You can change your answer at any time from "Cookies" at the foot of the home page; choosing Allow only necessary stops them on your next visit.
4. Who receives your data
| Recipient | What | Where |
|---|---|---|
| Google Cloud | Hosts our servers and database | Bangkok, Thailand |
| Google (Sign-In) | Confirms your identity | United States and other countries where Google has data centres |
| Google Fonts | Your IP address, when your email app loads the fonts in an email from us. Our web pages don't load fonts from Google | United States and other countries where Google has data centres |
| Stripe Payments (Thailand) Ltd. and Stripe group companies | Payments | Thailand, and possibly the United States and other countries where Stripe operates |
| Anthropic, OpenAI, Google (Gemini) | Your research descriptions, business description and plans, to draft and analyse | United States or global |
| Amazon Web Services (SES) | Your email address and the emails we send you | Singapore |
| Cloudflare | Your email, your account's activity and enquiries, on our private operations dashboard | Several countries, across Cloudflare's network |
| Telegram | Alerts to the operator. Ids only: no name or email | Outside Thailand. Telegram does not name the exact country |
| Meta Platforms | With your consent: your visit to our home or sign-in page and whether you signed up, through its cookie; and that you made a plan or bought a package, from our server (section 2) | United States, and possibly Ireland and other countries |
| TikTok group companies | With your consent: the same | Singapore and other countries where TikTok has data centres |
| Google (Tag Manager, Google Ads) | With your consent: the same. Tag Manager loads the tags | United States and other countries where Google has data centres |
Some of these are outside Thailand, in countries that may not have adequate data protection standards under Thai law. We send data there because it is needed to provide the service under contract, or to do what you ask before a contract (Personal Data Protection Act, section 28 (3) and (4)). Advertising cookies rely on your consent (section 28 (2)). We work with these providers under each one's data processing terms.
We do not sell your data.
5. How long we keep it
| What | How long |
|---|---|
| Account, business details, research, reports | While your account is open, and deleted within 90 days after it closes |
| Receipts and payment records | 5 years from the end of the year of payment, or longer if tax or accounting law requires |
| Screen and button events | 365 days |
| Enquiries and waitlist entries | 2 years from your last contact, then deleted. If you ask us to delete them sooner, we do |
| Feedback | 2 years from when you sent it, then deleted or stripped of name and email |
| Interview recordings and transcripts in your research | 365 days, as set out in the data processing agreement |
6. Your rights
Under the Personal Data Protection Act B.E. 2562 you can ask to access, copy, correct, delete, restrict or move your data, object to its use, and withdraw consent. Write to privacy@unfld.ai. Deleting your account is a request we carry out by hand: we tell you what will be deleted and what tax law makes us keep. You can complain to the Personal Data Protection Committee (PDPC).
7. Emails
Receipts and sign-in emails always go. Emails about your research are on by default; turn them off in Settings. News and offers are off unless you opt in.
8. Security
Data is stored in a private cloud project in Bangkok with access restricted by role. Logs hold ids and numbers, not content. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
9. Children
UNFLD is for businesses. We do not knowingly collect data from anyone under 20 as a buyer or visitor.
10. Changes
This policy takes effect on 1 November 2026. We will post changes here with a new date, and email account holders about significant ones.