PDPA Policy

This policy explains how Signa Asset Co., Ltd. collects, uses, stores, and protects personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

Signa Asset Co., Ltd.

Registration number: 0205567044915

Address: 88/1 Moo 1, Nong Prue, Chonburi 20150, Thailand

Contact: privacy@usevain.com

Signa Asset Co., Ltd. is the data controller for personal data collected through the VAIN platform. As data controller, we determine the purposes and means of processing your personal data.

Where we engage third party services to process data on our behalf, those parties act as data processors under our instruction.

Identity data

• Full name
• Email address
• Phone number

Business data

• Business name
• Business address
• Business registration details where provided

Google Business Profile data

• Google account email
• Business profile name and locations
• Customer review content including reviewer display names, ratings, review text, and timestamps
• Review response history

Technical data

• IP address
• Device type and browser information
• Login timestamps
• Usage patterns within the platform

Financial data

• Subscription plan details
• Payment timestamps
• Invoice records
• Payment method type

We do not collect sensitive personal data as defined under PDPA unless you voluntarily provide it in review content or business notes.

We process your personal data on the following lawful bases under PDPA:

Contractual necessity

Processing required to provide the VAIN service you have subscribed to, including account management, review management, and billing.

Legitimate interests

Processing for platform security, fraud prevention, and service improvement where our interests do not override your rights.

Legal obligation

Processing required to comply with Thai law including tax and accounting obligations.

Consent

Where we rely on consent, for example for marketing communications, you may withdraw consent at any time without affecting the lawfulness of prior processing.

We process personal data for the following specific purposes:

• To create and manage your VAIN account
• To provide booking, POS, and salon management features
• To connect to and manage your Google Business Profile reviews
• To generate AI assisted review reply drafts using review content
• To post approved or automated review replies on your behalf
• To process subscription payments
• To send transactional emails
• To provide customer support
• To maintain platform security
• To comply with legal and tax obligations
• To improve the platform based on anonymized usage data

We do not process your personal data for advertising, profiling for third party marketing, or any purpose not listed above.

We share personal data with the following processors only where necessary:

Anthropic PBC

Review text may be sent to Anthropic to generate reply drafts. Anthropic processes data only to provide the requested service under our instructions.

Supabase

Account and business data is stored on Supabase infrastructure under our control.

Payment processor

Financial data is processed by our payment processor for billing purposes.

Email delivery provider

Email address and message content is shared with our email provider for transactional emails only.

We require all processors to implement appropriate security measures and to process data only under our instructions. We do not sell personal data to any third party.

Some of our processors are located outside Thailand. Where personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with PDPA requirements, including contractual protections with processors.

We retain personal data only as long as necessary:

• Account and identity data: retained while your account is active and deleted within 30 days of account deletion request
• Google Business Profile data: retained while your Google connection is active and deleted within 30 days of disconnection or account deletion
• AI generated reply drafts: retained for up to 24 months or until deleted by you
• Technical and usage logs: retained for 12 months
• Financial records: retained for 7 years as required by Thai accounting law
• Support communications: retained for 24 months

As a data subject under PDPA, you have the following rights:

• Right to be informed: you have the right to know what personal data we collect and how we use it. This policy fulfills that obligation.
• Right to access: you may request a copy of the personal data we hold about you. We will respond within 30 days.
• Right to rectification: you may request correction of inaccurate or incomplete personal data.
• Right to erasure: you may request deletion of your personal data where we no longer have a lawful basis to retain it. Some data may be retained for legal or accounting obligations.
• Right to restriction: you may request that we restrict processing of your data in certain circumstances, for example while a correction request is pending.
• Right to data portability: you may request your personal data in a structured, commonly used, machine readable format where technically feasible.
• Right to object: you may object to processing based on legitimate interests. We will cease processing unless we have compelling legitimate grounds that override your interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to lodge a complaint: you may lodge a complaint with the Personal Data Protection Committee of Thailand at pdpc.or.th.

To exercise any right under PDPA:

Email: privacy@usevain.com

Subject line: PDPA Data Request

Include: your full name, registered email address, and a description of your request.

We will acknowledge your request within 7 days and respond fully within 30 days. We may request verification of your identity before actioning your request.

For complex requests we may extend the response period by a further 30 days with notice.

We implement appropriate technical and organizational measures to protect personal data:

• Encrypted data storage
• Encrypted data transmission via HTTPS
• Encrypted password storage using industry standard hashing
• Strict access controls limiting staff access to personal data
• Secure storage of OAuth tokens
• Regular security reviews
• Incident response procedures

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Personal Data Protection Committee within 72 hours of becoming aware and will notify affected individuals without undue delay where required.

VAIN uses essential cookies required for authentication and platform operation. We do not use advertising cookies, cross-site tracking cookies, or cookies for marketing profiling.

VAIN is a business platform. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that a minor has provided personal data, we will delete it promptly.

We may update this PDPA Policy from time to time. We will notify you of material changes by email or in-platform notice at least 30 days before changes take effect for existing users.

Data Controller

Signa Asset Co., Ltd.

88/1 Moo 1, Nong Prue, Chonburi 20150, Thailand

Registration number: 0205567044915

Email: privacy@usevain.com

Supervisory Authority

Personal Data Protection Committee of Thailand

pdpc.or.th