Privacy

KamraiDee stores what the app needs. This notice follows the Thai Personal Data Protection Act B.E. 2562 (PDPA).

Effective 18 September 2026. Last updated 19 October 2026. Thai law governs this notice. Switch the site language for Thai.

1. Who we are

KamraiDee (กำไรดี) is an app for shops that make or find what they sell. Website kamraidee.com. Sign-up is open to everyone at /signup.

Data Controller: Siam Vintage Trading Co., Ltd. (บริษัท สยาม วินเทจ เทรดดิ้ง จำกัด), company registration number 0205568013151, which runs KamraiDee.

Rights requests and questions: hello@kamraidee.com or LINE Official Account @504rpmhu. You can also send a note from Help after you have a workspace. No Data Protection Officer is appointed yet.

This notice covers kamraidee.com, public tools, the blog, public shop pages at /m/your-handle, signup, a signed-in workspace, Help, and LINE OA. It does not cover LINE as a platform, banks that run PromptPay, Grab, Shopee, or other marketplaces.

2. Two roles

We are the controller for account records, your account profile, security logs, Help and LINE messages to us, affiliate records, and billing records when paid plans are charged.

You are the controller of what you type in the workspace: stock, formulas, sellables, orders, calendar, labels, your customers’ name and phone, PromptPay details you attach, invoices you generate. We process that content only to run the service you asked for.

Do not upload another person’s data unless you have a lawful reason. If a shop customer wants a name or phone changed or deleted, they should ask your shop first.

3. What we store

• Account: name, email, hashed password or Google sign-in, language, pack, margin and unit settings, shop handle and photo.
• Shop records you type: stock, formulas, sellables, orders, calendar, customers, labels.
• Public shop page content you choose to publish.
• Help / bug / wishlist notes and optional screenshots.
• Affiliate handle and referral cookie kd_ref (30 days).
• Supplier Corner advertisers: business name, tag, contact email / phone / LINE so our team can confirm the listing payment. Public visitors see a short preview. Signed-in shops see the name, tag, listing copy, and map. Phone, LINE, and email show only after a signed-in shop presses Contact this supplier.
• Contact this supplier presses: when a signed-in shop presses it, we record which supplier, which shop account, the time, and where it was pressed (supplier search, the public suppliers page, or Save to stock). We use this to stop scraping and to show suppliers how many shops asked. A supplier sees counts only, never which shop.
• Payment slips and the name on the transfer, when you pay for a plan by PromptPay or bank transfer.
• When billing is switched on: payer name, tax invoice fields you enter, and a payment token from the processor. We do not intend to store full card numbers.

Automatically: IP address, approximate region, browser and device, pages viewed, session cookies needed to keep you signed in, and error logs.

Public tools on /tools do not need an account. We do not save those numbers as a shop profile. Server logs may still record that the page was requested.

We do not ask for sensitive personal data under PDPA Section 26 (health, biometrics, religion, criminal records, and similar). Do not send that in a screenshot. KamraiDee is a business tool. It is not for children under 20. Write to hello@kamraidee.com or @504rpmhu if you think we have a minor’s data.

4. Why we use it (lawful bases)

• To open a workspace — steps toward a contract.
• To run stock, formulas, orders, labels, and the public shop you switch on — performance of a contract.
• To answer Help and LINE — contract and legitimate interest in fixing the product.
• To keep the service secure and stop abuse — legitimate interest; legal duty where a computer-crime or PDPA rule applies.
• To send service mail (security, downtime) — contract.
• To send optional tips — consent, or legitimate interest for an existing customer, with an easy stop.
• To charge a plan and keep tax records when billing exists — contract and legal obligation.
• To follow a court, PDPC, or Revenue Department order — legal obligation.
• To record Contact this supplier presses and show suppliers a count — legitimate interest in a fair directory and in stopping contact scraping.

Where we rely on consent, we ask in plain language with no pre-ticked box. You can withdraw as easily as you gave it. Some fields are required to open a workspace. If you withhold them, we cannot perform the contract.

5. Cookies

• Necessary: session and security, language (EN/TH), theme on this device.
• Referral: kd_ref for 30 days if you arrive on a share link.

Analytics and advertising: Google Analytics 4 (Google), Meta Pixel (Meta Platforms) and TikTok Pixel (TikTok) run only after you tap Accept on the cookie bar. They help us measure visits and our ads on Facebook, Instagram and TikTok. If you tap Decline, none of them load. You can change your choice any time with Cookie settings in the footer. Continued browsing is not consent. You can delete cookies in your browser. Necessary ones return on the next visit because a signed-in workspace needs them.

6. Who we share with

We do not sell personal data.

• Cloud hosts that run the site and store the database. The site is deployed on Vercel. Shop data sits in our database provider. Those machines may be outside Thailand.
• Google, if you choose Google sign-in.
• Google (website analytics, only if you said yes)
• Meta Platforms (USA/Ireland), for visit and ad-measurement data, only after you tap Accept.
• TikTok (Singapore/USA), for visit and ad-measurement data, only after you tap Accept.
• LINE, if you add @504rpmhu or connect LINE on a later flag.
• Resend (USA), which sends account emails such as sign-up confirmation, password reset and service notices.
• Omise is not used during the beta. Manual payment slips are seen by our team only. Our team pays affiliate cash-outs by hand. There is no automatic bank transfer yet.
• Teammates on seats you create.
• The public, only for what you publish on /m/your-handle.
• Authorities when Thai law requires it.

Overseas transfers use a contract with the processor and security measures. Your data may be stored or processed in Japan, Singapore and the United States (our database, hosting and email providers). PromptPay is a bank rail you show your customer.

7. How long we keep it

• Active account and workspace: while the account exists.
• After you ask us to delete: up to 90 days in backups and logs, then delete or anonymise, unless law requires a longer copy.
• Help notes: about 24 months after close.
• Contact this supplier press records: kept 24 months, then deleted.
• Security logs: about 12 months, longer if an incident is open.
• Billing and tax records when they exist: at least 5 years from the accounting period.

8. Security and breach

We use HTTPS, access control, hashed passwords, and logged staff “view-as” that stays read-only. No system is perfectly safe. If a personal-data breach may affect rights and freedoms, we notify the Office of the PDPC without undue delay and within 72 hours where feasible, unless the event is assessed as no-risk. If the risk is high, we also notify affected people without undue delay.

9. Your rights

Under the PDPA you may withdraw consent, access and copy your data, correct it, object (including to marketing), ask us to erase or anonymise, restrict use while a dispute is open, and receive data you gave us in a readable form where the law allows. Workspace CSV export is one practical way to take shop records with you. You may complain to the PDPC: pdpc.or.th · saraban@pdpc.or.th · +66 2 111 8800.

To ask us to delete or export your data, email hello@kamraidee.com or message @504rpmhu.

Write to hello@kamraidee.com with the subject “PDPA rights request”, or message @504rpmhu. We will verify who you are and aim to reply within 30 days of a complete request. These rights cover your data. For your shop customers stored in the workspace, you are the controller — edit the row or instruct us in writing.

10. Marketing and LINE

Service messages (security, billing later) are part of the product. Tips and news go out only with consent or where the rules allow contact with an existing customer. Every marketing email will have a stop link. Block or unfriend @504rpmhu to stop OA messages. We honour an opt-out as soon as we can, and within 7 days.

11. Changes

We will change this page when processing, processors, or the law changes. The date at the top will move. A material change also gets a short note by email, in-product banner, or LINE where we can reach you.

TermsSign up freeHelp